PENOPS
Docs menu
[ Get started ]

Your first engagement

Walk through PENOPS from sign-in to your first findings using a web app engagement.

Overview

This walkthrough uses a Web App Engagement, because it needs no integration to get started. Cloud, LLM and secrets engagements follow the same shape but scan through an integration you connect first. See Integrations.

You need Engagements > Web App: Write to create the engagement and Pentest > Targets: Write to answer approvals. A workspace owner has every permission.

1. Sign in

  1. Go to the PENOPS sign-in page and click Continue.
  2. Enter your Workspace ID. You see only the sign-in methods your workspace uses.
  3. New to PENOPS? Create a workspace first. See Sign up and onboarding.

2. Create the engagement

  1. Go to Manage > Engagements, click Add Engagement and choose Web App Engagement.
  2. Set Up the Basics: pick an organization, enter an Engagement Name (3 to 100 characters, unique) and choose an Instance Region for where the scan runners execute.
  3. Add & Verify Your Domains: enter the Main domain and click Add. Expand it, click Generate TXT Record, publish the record in your DNS, then click Verify TXT Record.
  4. Authentication: tick a saved login to test signed-in areas, or click Continue without auth to test only public areas.
  5. Choose Coverage Type: pick Agentic Pentest, Agentic Vulnerability Scan or Surface Intel. Optionally write a Mission Focus to steer the agents.
  6. Scan Window & Settings: set Schedule & Cadence and a Scan Window with its Timezone.
  7. Discover & Quote: review the resources listed and the quote. Both are in preview, and unticking a resource here does not remove it from scans.
  8. Activate Engagement: review the summary and click Activate engagement, or Save as draft to finish later.
Verify your domain before the first run

You can save an engagement with an unverified domain, but it cannot run until the TXT record is verified. Scheduled runs on an unverified domain are skipped without notice.

Each step is covered in detail in Create an engagement.

3. Start the first scan

With a 24 / 7 scan window, the first scheduled scan starts as soon as you activate. With Business hours or Outside work hours, it waits for the next window.

  1. To start now instead, open the engagement's row menu on Manage > Engagements and click Run scan.
  2. Review the saved configuration in the dialog and click Reserve and run.
  3. The status changes to Queued, then Running, and refreshes while the scan runs.

See Run and schedule scans for cadence, windows and retries.

4. Watch the agents and answer approvals

  1. Go to Pentests > Targets. Your domain appears under the engagement.
  2. A blue dot on a target means an agent is waiting for you. The Need action tile counts these targets.
  3. Select the target and open a mission from the Missions tab to read each step, the test script and its output.
  4. On an approval card, click Approve, Approve + session or Reject.
Note

To see targets you also need Pentest > Exposure: Read. With Targets permission alone the page loads but stays empty.

See Targets and missions and Human-in-the-loop approvals.

5. Work your first findings

  1. Go to Operations > Risk Treatment. New findings arrive in Intake.
  2. Open a card, move it to Triage & Decide and set its Risk Treatment.
  3. Click Push to Remediation for findings to fix, or Move to Risk Register for risks you accept, transfer or avoid.
  4. Engineers pick up cards on Remediation Delivery, complete the remediation steps and click Validate fix before moving the card to Done.

Continue with Delivery boards and Fix validation.