It is important to note that security testing is very different from functional testing. Functional testing determines whether a piece of software does what it is supposed to do. Security testing attempts to confirm that a piece of software does what it is supposed to do and nothing else. Needless to say, this is a much larger space to test.
There are three primary categories of security testing:
1. Component level security testing
2. Secure deployment testing
3. End-to-end security penetration testing