Focused exclusively on web applications (not network, wireless, or physical) - Can be overwhelming: version 4.2 contains over 90 individual test cases - Does not define engagement lifecycle (scoping, contracts, etc.) - Some test cases require significant expertise to execute properly