Engagement settings

Overview

Every engagement has a settings page where you change what it tests and how. Open it from Manage > Engagements with the row menu (⋮) > Settings, or click a row to open its Configuration Summary and click Edit Settings →.

Make your changes on any tab, then click Save Changes. A confirmation reads "Settings saved: <name>".

Settings tabs

The Mission Focus is a free-text objective of up to 2,000 characters that steers the agents, for example which flows matter most to you.

Draft, Active and Paused

• A draft becomes active only through Activate engagement on its settings page. An active engagement never returns to draft.
• Pause stops schedules but does not cancel a run already in progress. Resume restarts them.
• While a scan runs, the list may also show Running, Queued, Held, Warnings or Error.

Domain verification and authentication

A web app engagement scans one domain and the hosts beneath it. You prove you own the domain with a DNS TXT record.

1. On the Scope tab, expand the domain and click Generate TXT Record.
2. Copy the record with Copy Record and publish it in your DNS.
3. Click Verify TXT Record. The status changes to Verified once PENOPS finds the record.

• Verification gates the run, not the save. An unverified domain stays in scope, but the engagement cannot run until you verify it, and scheduled runs are skipped.
• The TXT value is shown only when it is issued. Generating a record again replaces the previous one.
• A subdomain inherits the verification of its registrable domain.
• An engagement uses one authentication method: form login or headers, not both.
• An auth session must be on the engagement's domain, and a login can belong to only one engagement. A login used elsewhere shows "Already in scope of <name>".
• Subdomain inclusions must use the same login as the main domain.

Rate limits and rules

Rate limits cap how hard PENOPS hits your targets. A limit applies per host and is shared by every tool probing that host at once. Values outside the range are refused, not adjusted.

• A web app engagement accepts up to 50 targets in one change.
• A cloud engagement needs at least one integration. To stop scanning it, pause or delete the engagement instead of unticking the last one.
• Request Identity sets the User-Agent: Platform default, PENOPS Scanner, Chrome (Windows), Firefox (Linux) or Safari (macOS).
• Type and organization cannot be changed after creation.

Delete an engagement

1. Open the row menu (⋮) or the settings page header and click Delete.
2. Confirm in the Delete engagement dialog. Deleting removes the engagement's board and stops any scans using it. If a scan is running, it is cancelled.

Permissions

Engagement permissions are granted per type (Web App, Cloud, LLM, Secret) for an organization, on the Team screen.