Best Practices for Compliance and Security Testing at Scale