Discuss an engagement
MenuClose

How every engagement runs.

Five stages, in the same order every time, under written rules that name who can stop the work.

Oil painting of a stone canal lock at dusk, water spilling over a closed timber gate beside a keeper's cottage with one lit window.

The stages in order.

Each stage ends with something you keep. The next stage does not begin until you have it.

  1. Authorize

    Before anyone touches a system, both sides sign the scope and the rules of engagement, and you issue a letter of authorization from a person who holds the authority to grant it.

    Where a system is hosted by a supplier or a cloud provider, we confirm that their terms allow the test, or we obtain their permission in writing.

    • Scope names the systems, sites and people in play, and everything excluded
    • Objectives are set in business terms, such as reaching payment approval rights
    • The control group is named, with direct phone numbers
    • Testing windows and blackout dates are fixed

    You receiveSigned scope, rules of engagement and letter of authorization

  2. Observe

    We study your organization from the outside using public and commercially available sources. That covers domains and certificates, exposed services, credentials in published breach data, staff roles listed online and supplier relationships.

    At this stage we interact with your systems only as far as the rules of engagement allow.

    • An exposure brief ranked by what an attacker would likely try first
    • A working session with you to choose which paths to pursue
    • Anything that needs action now is raised at once, not held for the report

    You receiveExposure brief

  3. Operate

    The team works toward the agreed objective inside the approved windows. Every action is logged with a time, an operator, a source and a target.

    When we reach sensitive data, we record proof of access and go no further with it.

    • Check-ins with the control group at an interval you choose
    • Serious issues reported to the control group as soon as they are confirmed
    • Signs of a real intruder stop the test and go straight to you

    You receiveTimestamped activity log

  4. Report

    Two reports for two audiences, both delivered as drafts first. Your technical leads check them for factual accuracy before we issue final versions.

    Every severity rating states the method behind it, so your risk team can defend it.

    • Draft review with your technical leads
    • A readout for executives, in person or by call
    • Findings mapped to your control framework on request

    You receiveExecutive and technical reports

  5. Retest

    Once your team has fixed the findings, we test each one again against the original evidence.

    The retest letter records the status of every finding on a stated date, so an auditor can see what closed and when.

    • Retest of each reported finding
    • Updated status for every finding in the technical report
    • New issues found during retesting reported separately

    You receiveRetest letter

Who can stop the work.

The rules of engagement are the working contract for the test. They set what may be tested, how, when and by whom, and what happens when something unexpected occurs. Both sides sign them before testing starts, and any change is agreed in writing.

Pause and stop

Any member of the control group can pause testing by calling our engagement lead. Every operator stops active work, and we confirm in writing what was running, on which systems and at what time.

Testing resumes only when the sponsor agrees in writing. A stop ends the engagement at that point, and we report on the work completed.

Engagement sponsorYour side
Signs the letter of authorization. Approves any change to scope, and decides whether a paused test resumes.
Control groupYour side
The few people who know the test is running, often the sponsor, the security lead and one operations lead. They receive our updates and deconflict with your security operations team without revealing the test.
Engagement leadBendings
Runs our team day to day and is the single point of contact for the control group. Holds the authority to halt our own operators.
Out-of-hours contactsBoth sides
Named for every testing window and reachable for as long as it is open.

Testing windows and safety limits.

These limits apply on every engagement. Your rules of engagement can tighten them.

Testing windows
Active testing runs only on the days and hours in the rules of engagement. Blackout periods such as month-end close, market open, settlement runs and change freezes are written in.
Out of bounds
Systems, sites and people outside the scope are never tested, even when a path to them opens. We record the path and report it.
Availability
We do not attempt denial of service or load testing unless it is scoped separately, with its own window.
Changes to systems
We avoid destructive actions. Anything we place on a system, such as an account or a file, is logged when it is created and removed or handed to you for removal at the end.
Data
We prove access with the smallest sample that shows it, such as a record count, a redacted field or a screenshot. We do not copy data sets in bulk.
Physical entry
Operators carry the letter of authorization and a control group number. If challenged by staff or police, they stop and identify themselves.
People
Social engineering uses pretexts you approve in advance. We do not target personal accounts, family members or anyone outside the named population.
Real incidents
If we see evidence of another intruder, we stop, preserve what we saw and tell the control group directly.

How we handle your data.

Testing produces sensitive material, including credentials, screenshots, network maps and notes on your weaknesses. We treat it as yours throughout.

Collect the minimum
We keep only the evidence needed to support a finding. Personal data is redacted in reports unless you ask otherwise.
Hold it apart
Engagement data is stored encrypted on systems Bendings controls, separated by client, and open only to the people working on your engagement.
Move it on your terms
Reports and evidence travel through a channel you approve. Nothing sensitive goes by ordinary email.
Return or destroy it
At close we return the evidence you want to keep and destroy the rest within the period set in your contract. We confirm destruction in writing.

The executive and technical reports.

The outlines below show the usual structure. Sections change with the scope, and your template can replace ours.

Executive report

For the board, the executive committee and your regulator. Short enough to read in one sitting.

Outline

  1. Engagement summary and the objective agreed
  2. How far we got, and by which route
  3. Business impact in plain language
  4. Controls that held
  5. Priority actions, each with a suggested owner
  6. Change since previous tests, where they exist

Technical report

For the engineers who fix the findings and the auditors who check the fixes.

Outline

  1. Scope, dates and rules of engagement
  2. Approach and the published guidance it follows
  3. Attack narrative with timeline
  4. Findings, each with affected assets, severity and rating method, evidence, reproduction notes and a recommended fix
  5. Detection review, covering what your monitoring saw and what it missed
  6. Control mapping, on request
  7. Appendices with the activity log and the artifacts placed and removed

A finding closes when a retest says so.

A fix reported by a ticket is a claim. We check each one against the evidence in the original report, from the same position an attacker would use.

The retest letter lists every finding with one of four states and the date it was checked. Auditors can rely on it without reading the full technical report.

Closed
The retest could not reproduce the finding, and the fix addresses its cause rather than the single example we used.
Partly closed
The example is fixed but the same weakness remains elsewhere, or the fix reduces the risk without removing it.
Open
The finding reproduces as originally reported.
Accepted by you
Your organization has decided to carry the risk. We record who accepted it and when, and we do not mark it closed.

Ask for a sample rules of engagement.

Write from your organization's email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.

Email engage@bendings.com What happens next