Fuzzing (fuzz testing) is an automated testing technique that feeds large volumes of malformed, unexpected, or random input to a program in order to uncover crashes, memory errors, and security flaws.
A fuzzer generates or mutates inputs and watches how the target reacts, flagging any case that triggers a crash, a hang, or a memory violation. Modern coverage-guided fuzzers go further, steering new inputs toward code paths that have not been exercised yet, which makes them remarkably good at finding buffer overflows and edge-case bugs that humans overlook. A classic example is feeding thousands of corrupted files to a document parser until one causes a segmentation fault. The honest limitation is that fuzzing can only find bugs in code it actually reaches, and it can never prove that a program is bug-free. Each crash it reports still needs triage, because not every crash is exploitable and analysts must judge which findings represent real risk. Used well, though, fuzzing surfaces serious input-handling flaws faster than manual review ever could.
How is fuzzing tested on the CISSP?
Fuzzing sits in Domain 6, Security Assessment and Testing, which accounts for 12% of the exam. Expect it framed as a dynamic testing technique for discovering unknown vulnerabilities.