Engagement lifecycle

An engagement is one penetration test of an agreed scope. It moves through a fixed set of states, shown as a stepper on the engagement page.

State	What happens	Advanced by
Scoping	Targets, exclusions, rules of engagement and test credentials are agreed	Engagement manager
Scheduled	Dates and team are set	Engagement manager
In progress	Testing; findings are drafted	Engagement manager or pentester
Reporting	Pentester writes the summaries	Pentester or engagement manager
QA review	QA checks findings and the report	Engagement manager
Delivered	Findings are released to you; the report is published	Engagement manager
Completed	Engagement closed	Engagement manager

Two more states sit outside the main path: On hold and Cancelled.

Gates

The platform refuses a move until its conditions are met.

• Scoping to Scheduled: at least one asset in scope, scope approved, start and end dates, and an engagement manager on the team.
• Scheduled to In progress: a pentester on the team, and no more than a day before the scheduled start.
• Reporting to QA review: executive and technical summaries of at least 20 characters each. A test with no findings needs explicit confirmation. Draft findings are submitted to QA automatically.
• QA review to Delivered: every finding triaged by QA and a QA-approved report in place.
• Delivered to Completed: every critical and high finding verified, risk accepted or rejected.

Rework paths exist: Scheduled back to Scoping, Reporting back to In progress, and QA review back to Reporting (a reason of at least 10 characters is required).

Hold and cancel

Putting an engagement on hold or cancelling it needs a written reason of at least 10 characters. A hold pauses remediation SLA clocks and returns to the previous state when lifted. Cancelling is final: open remediations are closed as risk accepted and open retests are cancelled.

What you can see

• Client Administrators see every engagement for their company. Client Users see engagements they belong to. Client Developers see engagements where a remediation is assigned to them.
• Findings stay hidden until the engagement is Delivered, and each report only appears once it is published.
• You can request retests from Delivered onward (remediations and retests).
• During Scoping, a Client Administrator approves the scope (engagement guide).

You are notified when an engagement is delivered. Next, read how findings are classified.