Overview
PENOPS uses a small set of terms consistently across the app. Use this page as a reference while you read the rest of the documentation.
Testing
| Term | Meaning | Read more |
|---|
| Engagement | One configured, recurring security test of one thing you own: a web application (one domain and the hosts beneath it), one cloud provider's accounts, a set of LLM endpoints from one provider, or a secrets source. It holds scope, coverage, scan window, rate limits and schedule. | Create an engagement |
| Target | One asset inside an engagement's scope, such as a domain, subdomain, cloud account, repository, container image or LLM endpoint. | Targets and missions |
| Scan (run) | One execution of an engagement. A run always covers the whole engagement, and an engagement has only one run at a time. Runs start on the schedule or when you click Run scan. | Run and schedule scans |
| Mission | One thing an agent set out to prove on a target (for example, an access control flaw on an order lookup), or one red-team attack on an LLM endpoint. A mission records every step, test script and output. | Targets and missions |
| Approval | A pause where the agent asks a person before running a test that trips a guardrail. You choose Approve, Approve + session or Reject. | Human-in-the-loop approvals |
| Guardrail | A rule for what the agent must not do on a target without asking. Two are built in: Destructive change and Service disruption. You can add your own per target. | Agent profile |
Findings and delivery
| Term | Meaning | Read more |
|---|
| Finding (card) | A confirmed weakness. Each finding is a card with an id such as ID001 that moves across the delivery boards. | Delivery boards |
| Treatment | Your decision about a risk: Mitigate, Transfer, Avoid or Accept. Workflow policy decides which treatments go to engineering and which go to the Risk Register. Accept needs a written business justification. | Treatments and workflow policy |
| SLA | The days allowed to resolve a finding, set per severity in workflow policy and counted from detection. SLAs flag a card as at risk or overdue; they never block a move. | Treatments and workflow policy |
| Fix validation | A re-test PENOPS runs against a fixed finding to confirm the fix holds. | Fix validation |
Attack surface and workspace
| Term | Meaning | Read more |
|---|
| Surface asset | A domain or subdomain your web app engagements discovered that is not in any engagement's scope. Its status is Untracked, Monitored (a daily recon check of its own) or Suppressed. | Surface Intelligence |
| Integration | A saved connection that engagements scan through: cloud credentials, LLM endpoints, web app logins, and code or registry sources. One integration can serve many engagements. | Integrations |
| Organization | A grouping inside your workspace that holds engagements. Every workspace starts with a default organization. An engagement's organization cannot be changed after creation. | Organizations |
| Workspace | Your company's PENOPS account, identified by its Workspace ID, which you also enter to sign in. | Sign up and onboarding |
Engagement statuses
| Status | Meaning |
|---|
| Draft | Saved but not activated. It does not run until you activate it. |
| Active | Runs on its schedule and accepts Run scan. |
| Paused | Scheduled scans are stopped. A run already in progress continues. |
| Queued / Running | A run is waiting to start or in progress. |
| Held | A run is paused, for example while it waits for your approval. The status tooltip gives the reason. |
| Warnings / Error | The last run finished with warnings, or failed. |