The "testing" server could be your live server. DW needs a testing server defined but there is no reason why it can't point to the live server as the testing server.
Yes. Powercms already uses securityassist for a lot of the functionality... we used the previous version of securityassist for most of the security functionality in powercms and it can be easily upgraded to the new version.