Abstract: A computer-implemented method and a data processing system for testing device security are provided. The method includes executing on one or more processors the steps of: receiving a configuration file; executing a plurality of security tests on a device based on the configuration file received; identifying a suspected application on the device from the security tests; simulating a test condition to trigger an attack on the device by the suspected application; monitoring a behaviour of the device under the simulated test condition; and performing a forensic data analysis on the behaviour of the device under the simulated test condition.