Engagement case catalog
When you build a mission you pick the engagement cases you want covered. Each case is a well-defined slice of testing with a typical depth. The Principal uses your selection to focus the sub-agents on what matters for this target.
Cases are organized into eight domains:
Depth legend: Light = quick, non-intrusive · Standard = normal test depth · Deep = thorough, higher-impact (weighted toward Attacker mode).
Network
| Case | What it covers | Depth |
|---|---|---|
| LAN host discovery | Map live hosts, open ports, and service banners on the authorized LAN. | Light |
| Network vulnerability sweep | Outdated services, weak configs, and known CVEs on authorized hosts. | Standard |
| External perimeter | Internet-facing IPs and domains: recon, TLS, mail, VPN portals, exposed admin panels. | Standard |
| Internal pivot paths | After a foothold: lateral-movement paths, trust relationships, jump hosts. | Deep |
| VPN / remote access portals | SSL-VPN, RDP gateways, and VDI portals: versions, auth flaws, MFA gaps. | Standard |
| Email & DNS security | SPF/DKIM/DMARC, zone transfers, and subdomain-takeover candidates. | Light |
| TLS / crypto posture | Weak ciphers, expired certs, HSTS, and mixed content on in-scope HTTPS. | Light |
| Segmentation / zero-trust gaps | Whether unauthorized lateral paths exist across VLANs and microsegments. | Deep |
| IoT / OT light recon | Discover ICS/IoT banners and default services (non-destructive). | Light |
Web / API
| Case | What it covers | Depth |
|---|---|---|
| Web application (OWASP) | Auth, injection, XSS, SSRF, access control, and business-logic checks. | Standard |
| API / GraphQL assessment | Schema discovery, authorization gaps, mass assignment, rate limits, injection. | Standard |
| Mobile app / backend API | Certificate-pinning gaps, API authorization, deep links, backend abuse. | Deep |
Identity / AD
| Case | What it covers | Depth |
|---|---|---|
| SMB / Active Directory surface | Shares, null sessions, LDAP, and Kerberos/NTLM exposure. | Deep |
| Credential & secret hygiene | Default/weak credentials, leaked secrets, and reuse patterns. | Standard |
| Password spray (authorized) | Low-and-slow, lockout-aware spray against an authorized directory only. | Deep |
Cloud
| Case | What it covers | Depth |
|---|---|---|
| Cloud misconfiguration | Public buckets, over-permissive IAM, metadata SSRF, exposed keys. | Standard |
| Container / Kubernetes | Escape paths, RBAC, secrets mounts, and exposed dashboards. | Deep |
Endpoint
| Case | What it covers | Depth |
|---|---|---|
| Linux privilege escalation | Misconfigs, SUID, sudo, kernels, cron, and container escapes. | Deep |
| Windows privilege escalation | Token abuse, services, UAC, and GPO gaps. | Deep |
| CI/CD & supply chain | Pipeline secrets, dependency-confusion risk, artifact integrity. | Standard |
| Printers & MFD | SNMP strings, open admin panels, stored jobs and address books. | Light |
Wireless
| Case | What it covers | Depth |
|---|---|---|
| Wireless assessment | Encryption strength, rogue APs, captive portals, client isolation. | Standard |
People / awareness
| Case | What it covers | Depth |
|---|---|---|
| Phishing resilience (controlled) | A controlled awareness campaign or mailbox/header analysis — never real-user harm without mandate. | Light |
Data exposure
| Case | What it covers | Depth |
|---|---|---|
| Sensitive data exposure paths | Reachable PII/secret backups, open shares, and exfiltration channels. | Deep |
| Database exposure | Open Redis/Mongo/Postgres/MySQL/Elastic with weak auth or no TLS. | Standard |
| Backup & recovery exposure | Accessible backups, snapshots, and NAS shares that leak credentials or PII. | Standard |
Defaults per mode
Auditor mode pre-selects the light and standard cases; Attacker mode pre-selects everything, including the deep cases. You can always adjust the selection before launching a mission.