Controller security testing