THE FIELD GUIDE
A more informed first move.
Practical guides, checklists, and examples to help you scope an assessment, interpret the evidence, and put findings to work.
Build a clearer understanding
Prepare the scope
Questions, boundaries, and launch checklists
Interpret findings
Examples, attack paths, and shared terms
Choose next actions
Prioritization and leadership readouts
Check the result
Retest preparation and outcome records
Guides and examples help you prepare the scope, interpret evidence, and follow through.
INSIDE THE DELIVERABLE
What does a useful finding look like?
Follow an illustrative finding from observation to business context, recommended action, and verification.
Read the exampleA finding.
A way forward.
Explore resources.
Open access. Practical detail. Read online, or use your browser to print a guide for your team.
The exposure assessment guide
Understand what an outside-in assessment examines, how evidence becomes a finding, and what a useful handoff should give your team.
Explore resourceAssessment scoping checklist
Prepare the decisions, asset boundaries, permissions, contacts, and deliverable expectations that turn an initial security concern into a focused assessment.
Explore resourceInside an evidence-backed finding
A fictional staging application example shows how to document an observation, explain uncertainty, assign remediation, and define a meaningful retest.
Explore resourceAttack paths, explained
Learn to distinguish a visible asset, a plausible chain of exposure, and a validated path to a defined business impact.
Explore resourcePrioritizing remediation
Turn assessment findings into an ordered action plan using evidence, business impact, exposure conditions, ownership, and a clear verification step.
Explore resourceRemediation retest checklist
Prepare a focused follow-up that compares the original finding with current evidence and records exactly what changed after remediation work.
Explore resourceThe executive readout guide
Translate assessment evidence into the business decisions, accountable owners, remaining uncertainties, and follow-up actions a leadership team needs to understand.
Explore resourceAI-assisted security, with human oversight
Understand where AI can support discovery and research, which decisions need human review, and what to ask about assessment evidence.
Explore resourceExternal exposure launch checklist
Review the public footprint around a launch, identify intended access boundaries, and assign owners for unresolved questions before release decisions.
Explore resourceThe outside-in security glossary
Twelve practical terms for discussing public exposure, assessment evidence, validation, and remediation with security, engineering, and business teams across your organization.
Explore resource