A project team is nearing the release of a new customer-facing web application that will process credit card payments. The organization's security policy requires that all externally accessible applications handling cardholder data undergo a controlled attempt to exploit vulnerabilities before they are allowed into the production environment. The project manager must schedule the appropriate activity in the release plan. Which activity satisfies this requirement?