John is responsible for application security at his company. he is concerned that the application reacts appropriately to unexpected input. what type of testing would be most helpful to him?