. . . "Redspin believes the minimum level of application testing necessary to answer that question is an application scan followed by 3 days of manual testing and reporting." .