A testing system for testing computer system security, comprising: a test hub interposed between tester computers and a computer system under test, wherein a tester computer is a computer used by a tester interacting with the computer system under test to test for security vulnerabilities of the computer system under test, and wherein the test hub is configured to monitor communication between the tester computers and the computer system under test to facilitate replay of detected vulnerabilities and to provide secure routing of communications of the tester computers to the computer system under test wherein the test hub has an access to the computer system under test that is specific to the test hub; a test results database, coupled to the test hub, containing records of tester interactions with the computer system under test and responses of the computer system under test to the tester interactions; a test mark database, coupled to the test hub, containing records related to granular elements of the computer system under test that are amenable to being tested for security vulnerabilities, wherein a record of the test mark database indicates whether a corresponding granular element has been tested for security vulnerabilities; a similarity engine, wherein the test mark database indicates actual testing of a first set of granular elements and inferred testing of a second set of granular elements where the similarity engine determines that the second set of granular elements is similar to the first set of granular elements such that testing of the second set of granular elements can be inferred from testing the first set of granular elements; a coverage application, coupled to the test mark database, that inputs data from the test mark database and outputs data indicating which granular elements of the computer system under test are to be tested. a test hub interposed between tester computers and a computer system under test, wherein a tester computer is a computer used by a tester interacting with the computer system under test to test for security vulnerabilities of the computer system under test, and wherein the test hub is configured to monitor communication between the tester computers and the computer system under test to facilitate replay of detected vulnerabilities and to provide secure routing of communications of the tester computers to the computer system under test wherein the test hub has an access to the computer system under test that is specific to the test hub; a test results database, coupled to the test hub, containing records of tester interactions with the computer system under test and responses of the computer system under test to the tester interactions; a test mark database, coupled to the test hub, containing records related to granular elements of the computer system under test that are amenable to being tested for security vulnerabilities, wherein a record of the test mark database indicates whether a corresponding granular element has been tested for security vulnerabilities; a similarity engine, wherein the test mark database indicates actual testing of a first set of granular elements and inferred testing of a second set of granular elements where the similarity engine determines that the second set of granular elements is similar to the first set of granular elements such that testing of the second set of granular elements can be inferred from testing the first set of granular elements; a coverage application, coupled to the test mark database, that inputs data from the test mark database and outputs data indicating which granular elements of the computer system under test are to be tested.