I work in the InfoSec profession as an IT auditor. One of my duties at work is testing and verifying that necessary security requirements are in place before code and application updates are released to production environment. Our team in conjunction with QA function signs off on documentation indicating successful completion of testing. I am the team lead of my team.
One of our applications will be upgraded in production soon, and updates to be deployed are being tested. This application directly interfaces with credit card information of customers in addition to other sensitive customer data. Automated security testing have been completed already and results are OK. I wrote additional scenarios today, intending to manually test them later this week given the data sensitivity. However my manager told me that he does not feel additional testing is necessary due to coverage and the business need to deploy to production timely. I anticipate completion of manual test to take at most 2 - 3 days.
Automated testing excels in detecting commonly known vulnerabilities such as SQL injection, but are often insufficient to detect more complex issues or flaws in business logic of application. Without additional manual testing, at least of what I feel would be high-impact vulnerabilities, I am not comfortable in signing off on security requirements testing results.
How do I make a business case to convince my manager of additional testing?