security testing means verifying that unauthorized users are denied, not just that authorized users succeed. Automated security validation using `EXEC CICS QUERY SECURITY` scales this across hundreds of profiles.