Scope
Agree objectives, systems, authorization, test windows, exclusions, stop conditions, owner and escalation contacts.
OUTPUT / RULES OF ENGAGEMENTMETHODOLOGY / STRIKE0A controlled strike.
A controlled strike.
A defensible result.
A clear engagement path makes continuous testing safe, observable and operationally useful.
01 / MISSION PROTOCOLSCOPE. CHALLENGE. PROVE. CLOSE.
Challenge
Coordinate parallel investigations to examine relevant exposure hypotheses while staying inside approved limits.
OUTPUT / TEST TRACEProve
Review permitted validation evidence, confirm impact and connect technical observations to the business objective.
OUTPUT / VERIFIED DOSSIERClose
Assign remediation actions, explain priorities and re-run the relevant test after the fix to check the risk pathway.
OUTPUT / REMEDIATION RECEIPT02 / SAFETY FIRSTTHE LIMITS ARE THE DESIGN
Offensive by nature.
Controlled by design.
01 / Permission before execution No tests without explicit written authorization and agreed targets.
02 / Production-conscious defaults Stop and escalate when proposed actions could change sensitive data or disrupt service.
03 / Restricted evidence Minimize and redact collected evidence, subject to customer retention and access rules.
04 / Human accountability Named operators review critical findings and consequential judgment calls.
05 / No false certainty Scope limits, failed tests and unverified findings are clearly distinguished.
03 / FIRST ENGAGEMENTA FOCUSED START
Start narrow. Learn fast. Expand deliberately.
STEP 01
Define the crown jewels.
Choose one critical asset or business workflow and establish the success criteria.
STEP 02
Run a bounded mission.
Execute the approved test, review the findings and publish a concise evidence-based dossier.
STEP 03
Retest and expand.
Confirm prioritized fixes, then extend coverage as the organization is ready.
The timeline, controls and exact automation available must be confirmed during scoping; this is a proposal, not a product SLA.
04 / SAMPLE ENGAGEMENTFROM QUESTION TO EVIDENCE
What would a
first mission look like?
Start with one authorized, business-critical workflow. A deliberately constrained engagement can surface useful evidence without an enterprise-wide rollout.
MISSION S0-001 / EXAMPLE ONLYSTATUS: SCOPING
01AGREED
Business objective
Determine whether an external actor could reach an approved administrative workflow through a lower-trust application route.
02DOCUMENTED
Rules of engagement
Define target URLs, test windows, approved identities, exclusions, data-handling rules, approvals and immediate stop triggers.
03REVIEWED
Controlled validation
Evaluate attack hypotheses, collect limited technical evidence and stop before material disruption or unapproved data access.
04DELIVERED
Business-risk report
Deliver a plain-English pathway summary, technical detail, evidence quality, remediation ownership and a validation plan.
05VERIFIED
Remediation retest
Repeat the agreed scenario to determine if the risky path is actually closed; document any residual exposure.
No automated guarantees.
We will not invent a coverage percentage, claim every attack path is discovered, or imply AI agents can safely take any action without permission.
Evidence that stands up.
Validated findings, severity rationale, remediation acceptance, retest closure rate and time from report to decision - once real engagement measurements exist.
FIRST MISSION
Start the conversation ↗