How an engagement runs

The order matters and it is not a graphic device: it is the real sequence of an engagement. Nothing starts until phase 01 is signed, and nothing is considered closed until phase 05 is verified.

Phases

Five phases, in this order

Every phase has a deliverable and an explicit exit criterion. If a phase does not close, the next one does not begin, however hard the calendar pushes.

Scoping and ROE

In-scope and out-of-scope assets, execution windows, stop criteria and signed authorisation.

Reconnaissance

OSINT, enumeration and a comparison of documented surface against real surface.

Exploitation

Manually verified access. Without exploitation there is no confirmed finding.

Post-exploitation

Escalation, lateral movement, persistence and maximum demonstrable reach.

Report and retest

Delivery, technical session, board session and verification of remediations.

Rules of engagement

What gets signed before anything is touched

The rules of engagement document is what separates an assessment from a computer crime. It is always signed, even on small engagements, and even when the client says it is not necessary.

In-scope and out-of-scope assets, identified unambiguously by address, domain or range.
Execution windows, with business-critical periods explicitly excluded.
Techniques excluded by default: denial of service, large-scale brute force and any action carrying availability risk.
Stop criteria and an emergency contact available on both sides throughout the window.
Escalation procedure for a critical finding or any indication of prior third-party compromise.
Handling of collected material, retention period and commitment to certified destruction.

Evidence

What reproducible actually means

A finding your team cannot repeat is not a finding: it is an assertion. The difference becomes obvious the day a vendor denies the problem.

Logging

Everything is timestamped

Every offensive action is logged with a timestamp, source system and exact command. That table is handed to the SOC to reconcile detections.

Proof

Screenshot and conditions

Every finding includes a capture from the moment of exploitation and the exact conditions — user, network, version — under which it works.

Limits

What was not exploited is stated

If a finding is probable but unconfirmed, it is labelled potential. I do not inflate severities and I do not soften them.

Reference framework

MITRE ATT&CK as a shared language

Every technique in the report is referenced by its ATT&CK identifier, so your defenders can map control coverage directly. The highlighted ones are those that appear most often in the engagements I run.

Initial access

SpearphishingExploit public appTrusted relationshipExternal remote serviceRemovable media

Execution

Command interpreterScheduled taskWMIUser execution

Persistence

Valid accountsNew serviceAccount manipulationBoot autostart

Privilege esc.

ADCS abuseKerberos delegationAccess tokenUAC bypass

Defense evasion

Signed binaryIndicator removalObfuscationImpair defenses

Credential access

LSASS dumpingKerberoastingNTLM captureBrute force

Lateral movement

SMB / admin sharesPass-the-hashRDPWinRM

Impact

Objective reachedSimulated exfiltrationEncryptionDestruction

Would you like to see a sample report?

I can send you a real anonymised report so you can judge the format and level of detail before deciding. It is the fastest way to find out whether we fit.

Request a sample report