Enumeration isn’t just useful for security testing

I work on marketing for VirtuProbe, and something I’ve noticed while digging into the product is how much overlap there is between security testing and regular software testing.

Security people probably don't need an explanation of why enumeration matters. You want to know what's actually there before you start testing it.

I’ve found the same idea comes up with integration testing. You may have an API, a mail server, a database, LDAP, DNS, or some other service involved in the same workflow, but you don't always know how everything behaves until you start probing it.

That’s one of the things I find interesting about VirtuProbe. It lets you interact with different protocols from the same local workspace and turn those interactions into reusable probes and chains.

What caught my attention is that this isn't only useful when you're trying to find security issues. A tester can use the same approach to figure out what a system actually exposes and how the different pieces behave before building out the test cases.

I'm interested on how other testers and security researchers approach this.

Do you usually enumerate first and then build your tests around what you find, or do you start with the expected workflow and investigate the unexpected stuff later?