Technical notebooks and reference material for assessment planning.

Field notes

Useful thinking before the first exercise.

Three complete guides for the decisions around an assessment: what to commission, how to define it and how to make the evidence useful afterwards. Read the guide that matches the question you are working through, then use the linked engagement pages to go deeper.

RIFT / FIELD NOTESDEFINED SCOPE · USEFUL EVIDENCE

Read with a decision in mind

Useful preparation
is part of the work.

A strong technical exercise can still disappoint if the wrong question was commissioned, a critical dependency was excluded without discussion or the final findings reached people who could not act on them. These guides concentrate on those decision points.

They are intended for security leaders, engineering owners and defensive teams preparing a conversation together. Each contains a full explanation, an illustrative scenario, a decision table and practical questions. The examples are invented to explain the reasoning; they are not client case studies or evidence of services delivered.

Read them in sequence if you are planning a new engagement. If you already have a report in hand, start with evidence-to-action. Keep your own constraints alongside the guidance: ownership, access, operating conditions and the organisation’s decision process shape which ideas apply.

Three assessment views comparing attack paths, application boundaries and detection timelines.

01 / Before commissioning

Different tests answer different questions.

Compare penetration testing, red teaming and purple teaming by the evidence each is meant to provide. The guide explains how to distinguish a technical coverage question from an objective-led exercise or a collaborative defensive improvement session.

Use it to write down the uncertainty you want to reduce, identify the people who will use the result and recognise when readiness work should come first.

Read choosing an assessment ↗

A defined scope marked around part of an illustrative network map.

02 / Before starting

Turn a broad concern into a testable objective.

Turn a broad concern into an objective with a defined asset boundary, starting assumptions and evidence threshold. Work through dependencies, operating constraints and the decisions needed when something changes.

Use it with business and technical owners to prepare a scope conversation. It helps reveal unanswered questions; it is not a substitute for a written engagement agreement.

Read scoping an exercise ↗

Security and engineering owners reviewing evidence and assigning follow-up work.

03 / After observation

Make the finding change something.

Follow a finding from the original observation to ownership, prioritisation and verification. Separate what the evidence establishes from what it merely suggests, and keep that distinction visible as the work moves between teams.

Use it when a report needs to become an improvement plan, or when the organisation wants a clearer record of what a retest actually verified.

Read from evidence to action ↗

Make the reading practical.

Choose one question from a guide and write down your organisation’s current answer. If the answer depends on an unnamed owner, an assumed permission or an unverified asset list, record that dependency. Those notes are useful preparation for a scope discussion and help separate confirmed information from assumptions.

The local scope builder provides a simple place to assemble the decision, environment and constraints. It creates a document in your browser, with no submission or security activity. Review it with the people who own the relevant systems before treating it as a basis for any real engagement.

Create a scope-planning document ↗

The next useful question

What do you need
the evidence to tell you?

Start with the decision, the environment and the constraints. Create a scope brief you can download, review with your team and refine before any engagement is considered.

Build your scope brief ↗