Create an engagement

Overview

An engagement is one configured, recurring security test of one thing you own. It holds what is in scope, which checks run, when they may run, how hard PENOPS may hit the target, and where the scan runners execute. Findings from every run land on your delivery boards.

To start, go to Manage > Engagements, click Add Engagement and pick a type. Your answers survive a page refresh in the same browser tab and are cleared once the engagement is created.

Create a Web App engagement

1. Set Up the Basics. Pick an organization or + New organization, enter an Engagement Name (3 to 100 characters, unique, checked as you type) and choose an Instance Region. Click Continue.
2. Add & Verify Your Domains. Enter the Main domain and click Add. An engagement has one main domain; http:// and www. are removed for you.
3. Expand the domain, click Generate TXT Record, copy the Host, Value and TTL with Copy Record and publish the record in your DNS. Then click Verify TXT Record. The status reads Verified or Not verified.
4. Optionally open Inclusions / Exclusions to add Subdomain Inclusions, Path Exclusions (for example /logout, /admin/healthcheck, *.internal, applied to one host or All in scope) and Subdomain Exclusions. Click Continue, or Continue without verifying to verify later.
5. Authentication. Tick the auth sessions PENOPS should log in with, or Connect new auth session. With none, click Continue without auth; only public, unauthenticated areas are tested.
6. Choose Coverage Type. Pick Agentic Pentest (active AI-driven attack simulation), Agentic Vulnerability Scan (passive component and CVE analysis, no exploitation) or Surface Intel (external reconnaissance only, no application traffic). Optionally write a Mission Focus.
7. Scan Window & Settings. Set the schedule and the scan window. See Run and schedule scans. Expand Advanced for rate limits and request identity.
8. Discover & Quote. Review the resources listed under each domain and the quote, both in preview (see Credits and usage). Continue is available once discovery finishes.
9. Activate Engagement. Review the summary cards (the pencil icon on a card jumps back to its step), then click Activate engagement or Save as draft. You land on the engagement's settings page.

Create a Cloud engagement

1. Complete Set Up the Basics as for a web app.
2. Connect Your Cloud Providers. Pick AWS, Azure or GCP. An engagement covers one provider; create separate engagements for multi-cloud.
3. Tick the accounts under <Provider> Accounts in Scope, or Connect new <Provider> integration. For Azure and GCP a table of subscriptions or projects appears; tick the ones to scan.
4. Optionally add Resource Exclusions by name pattern or tag, for example *-dev-*, *-test-*, tag:Environment=Development.
5. Coverage. Choose a depth: Surface Intelligence (perimeter defense and immediate exposure), Core Posture (infrastructure and environment hardening) or Full Coverage (end-to-end application and supply chain audit). Optionally tick Compliance Frameworks and write a Mission Focus.
6. Finish Scan Window & Settings, Discover & Quote and Activate as for a web app.

A subscription or project your credential cannot scan is shown disabled with the access it is missing. Grant the access, then re-sync the integration. See Cloud permissions.

Create an LLM engagement

1. Complete Set Up the Basics.
2. Add Your Model Endpoints. Tick endpoints and, inside each, the models to test, or Connect new endpoint. You need at least one endpoint and one model. Supported providers are OpenAI, Anthropic, Azure OAI, Bedrock and Vertex.
3. Coverage. Tick at least one red-team framework: OWASP Top 10 for LLMs 2025, OWASP Top 10 for Agentic Apps 2026, NIST AI RMF or MITRE ATLAS, and refine their sub-categories. Optionally write a Mission Focus.
4. Finish Scan Window & Settings, Discover & Quote and Activate.

Create a Secret engagement

1. Complete Set Up the Basics.
2. Choose a Source Provider and Integration. Pick GitHub, GitLab, Amazon S3, Google Cloud Storage or Docker / OCI image, then an integration under Connected <Provider> Integration.
3. Set the scope: all or selected repositories for GitHub and GitLab, include or ignore bucket lists for S3, a project and path patterns for Google Cloud Storage, or an image for Docker.
4. Detection Settings. Choose History Depth (Full history or Recent 90 days) for Git, Max object size (MB) for buckets, and Detector Settings such as Only show verified secrets, Filter unverified results and an entropy threshold (for example 4.5).
5. Finish Scan Window & Settings, Discover & Quote and Activate.

Good to know

• A Cloud, LLM or Secret engagement can be saved as a draft without an integration, but cannot be activated until it has one.
• The engagement type and organization cannot be changed after creation.
• Instance Region is where the scan runners execute. Your data stays in the region chosen during onboarding.
• Compliance Frameworks take effect on Cloud engagements only. The other types show the picker, but the choice is not saved.
• A scan always covers the engagement's whole scope. Unticking a resource in Discover & Quote changes the quote but does not remove it from scans. To keep something out of scans, use the scope exclusions (Path Exclusions, Subdomain Exclusions, Resource Exclusions).
• Credit figures in Discover & Quote and on the Activate step are in preview. See Credits and usage.
• Creating an engagement of a type needs the matching Write permission, for example Engagements > Web App: Write.