- 01
Scope
Agree assets, objectives, authorization, limits and stop conditions.
- 02
Reconnaissance
Map the approved attack surface and its trust boundaries.
- 03
Discovery
Use appropriate tooling and manual review to identify candidates.
- 04
Validation
Reproduce important issues and distinguish evidence from assumptions.
- 05
Controlled Exploitation
Demonstrate only the impact permitted by the rules of engagement.
- 06
Reporting
Explain risk, evidence, coverage limits and recommended fixes.
- 07
Remediation
Discuss root causes and practical corrective actions with your team.
- 08
Retesting
Check agreed fixes and record resolved, partial or remaining issues.
Boundaries before techniques.
Each engagement defines the approved assets, testing window, access model, prohibited actions, rate limits, emergency contacts and stop conditions. Third-party infrastructure is included only with appropriate permission.
OWASP, PTES, MITRE ATT&CK, CIS and NIST references inform relevant parts of the work. They do not represent certification, endorsement or a universal checklist applied to every environment.
Validation makes the difference.
Tool output is a starting point. Reproducible evidence supports confirmed findings; unverified candidates remain labelled. A blocked or incomplete assessment is reported as a coverage limitation, not a clean bill of health.
Retesting closes the loop.
Agree the findings, test window and expected behavior before retesting. Record whether each fix is effective, partial, unresolved or could not be verified. Material new functionality may require a new scope.