Define in-scope domains/IPs, Apps, APIs, cloud accounts, and identities. List explicit exclusions and allowed attack classes. Set success criteria: exploitable proof, business impact, reproducible steps.

• Day 0: kickoff & rules of engagement
• Days 1-3: automated recon + targeted exploitation
• Day 5: preliminary readout & fix guidance
• Within 30 business days of signed-off fixes (client team or PWNS team): re-test

Volatile data purged within 7 days. Keys and test accounts revoked. Retained reports are sanitized and used for threat research and persistence. Attestation and board summary provided.

Sometimes, fixing vulnerabilities can introduce new weaknesses. A remediation test also checks that no new vulnerabilities have emerged as a result of the changes made.

All stress testing is reviewed in a QA session prior to report finalization.

The following is include in the remediation report:

• List of recently remediated findings
• List of findings still present
• New findings

• Executive summary: risk themes & early vulnerability insights
• Pen-testing: PoC evidence, CVSS/ATT&CK mapping
• Remediation Report | Egress filtering deficiencies
• Client or PWNS mitigation. 30 days post mitigation: follow-up scan and pen-testing
• Close out

Depending on engagement type, stand-ups or monthly updates with progress, risk, and early signals. High severity issues are escalated within 12 hours with mitigation direction & containment steps.

Clients are encouraged to prepare status-page language and support strategies in case testing triggers alerts.

Findings ship with developer-ready suggestions and re-test cases.

Contact datacenter partners for any infrastructure-related issues.

Coordinate with PWNS-SOC or internal teams to filter false positives.