Direct answer
Choose an assessment request budget with the system owner using known capacity, current traffic and the cost of the specific operation. Monitor service health and adjust or stop when agreed conditions are reached; a fixed requests-per-second number alone cannot guarantee safety.
Identify costly operations
A search, report export or password reset can consume more resources than a static page. List endpoints with expensive backend work, email delivery, payment effects or fragile dependencies. Exclude or separately approve operations that change records, generate notifications or incur third-party charges.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Establish a baseline
Ask operations for normal traffic, latency, error rate and known capacity limits during the proposed window. Agree a starting concurrency and request rate below the owner's approved limits, accounting for other tests and real users. Do not infer capacity from a successful single request.
- Identify the test source addresses and window.
- Set a shared budget across concurrent testers and tools.
- Define alerts, contacts and a pause threshold.
Increase only with evidence
Begin with a small authorized sample and observe system health. For an expensive export route, prefer a dedicated small fixture and a low-frequency test rather than repeated full production exports. If error rates rise or an owner requests a pause, stop and follow the escalation plan.
Reference: OWASP Web Security Testing Guide.
Record the untested boundary
A rate budget may prevent evaluation of a high-load control. State the route, method, limit and outcome in the coverage record. The owner can arrange a separate load test or staging assessment if the remaining question matters.
Assessment limits
Rate and concurrency controls cannot eliminate operational risk, especially when requests trigger asynchronous work. Monitoring and agreement with all affected service owners remain necessary.
Frequently asked questions
Is a low request rate always safe?
No. One request can trigger an expensive query, email or payment. Review each operation and monitor the service.
Does a production rate limit test replace load testing?
No. A bounded security check and a planned load test answer different questions and need their own approvals.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.