A computer-implemented method of identifying one or more test cases for penetration testing of an application associated with an entity, the method comprising: receiving data related to the application from one or more data sources; determining, based on the received data, a threat score indicating one or more threats to the application, a vulnerability score indicating one or more vulnerabilities of the application to the one or more threats, a human error score indicating probability of the one or more threats due to one or more human errors, a business impact score indicating impact of the application on the entity, and a popularity score indicating popularity of the application, wherein the threat score is a quantified likelihood of the one or more threats occurring as a result of using the application based on a predicted usage of the application, the vulnerability score is a quantified likelihood of the one or more threats occurring as a result of using the application based on a number and/or strength of security safeguards provided in the application, and the human error score is a quantified likelihood of the one or more threats occurring as a result of using the application based on the likelihood of human errors occurring when using the application; determining a threat quantifier value, based on the threat score, the vulnerability score and the human error score, by multiplying a sum of the threat score and the vulnerability score by the human error score and dividing by a constant variable; determining an impact quantifier value based on the business impact score and the popularity score, by multiplying the business impact score by the popularity score, further multiplying by 2, and dividing by the constant variable; determining a threat severity level and an impact severity level based on the corresponding threat quantifier value and the impact quantifier value; and identifying the one or more test cases based on a combination of the threat severity level and the impact severity level for performing penetration testing of the application. receiving data related to the application from one or more data sources; determining, based on the received data, a threat score indicating one or more threats to the application, a vulnerability score indicating one or more vulnerabilities of the application to the one or more threats, a human error score indicating probability of the one or more threats due to one or more human errors, a business impact score indicating impact of the application on the entity, and a popularity score indicating popularity of the application, wherein the threat score is a quantified likelihood of the one or more threats occurring as a result of using the application based on a predicted usage of the application, the vulnerability score is a quantified likelihood of the one or more threats occurring as a result of using the application based on a number and/or strength of security safeguards provided in the application, and the human error score is a quantified likelihood of the one or more threats occurring as a result of using the application based on the likelihood of human errors occurring when using the application; the threat score is a quantified likelihood of the one or more threats occurring as a result of using the application based on a predicted usage of the application, the vulnerability score is a quantified likelihood of the one or more threats occurring as a result of using the application based on a number and/or strength of security safeguards provided in the application, and the human error score is a quantified likelihood of the one or more threats occurring as a result of using the application based on the likelihood of human errors occurring when using the application; determining a threat quantifier value, based on the threat score, the vulnerability score and the human error score, by multiplying a sum of the threat score and the vulnerability score by the human error score and dividing by a constant variable; determining an impact quantifier value based on the business impact score and the popularity score, by multiplying the business impact score by the popularity score, further multiplying by 2, and dividing by the constant variable; determining a threat severity level and an impact severity level based on the corresponding threat quantifier value and the impact quantifier value; and identifying the one or more test cases based on a combination of the threat severity level and the impact severity level for performing penetration testing of the application.