In this chapter, we introduced our security testing project, NodeGoat. We also discussed the security tool selection criteria we should consider when building a security automation framework. A security automation framework typically includes security testing tools, a web service, testing results, an automation framework (such as Robot Framework), automation scripts, and security payloads. In coming chapters, we will learn how to complete the testing automation framework and demonstrate automated testing for the NodeGoat website, fuzz API security testing, and infrastructure security testing.