How Engagements Run

How Engagements Run — Subscriptions & the Attack Engine

In build This is the execution model the build is heading toward. Today the portal tracks engagements and one methodology — AI-assisted vishing — runs live; the shared attack engine — Mangonel — with its methodology registry, Authorization Gate, and the external-recon plugin are now built and passing an internal self-test (passive S0–S1 recon against our own domain) and are now wired into the client portal — a recon run's discovered assets and findings land on the engagement record. Nothing here touches your systems until it is built, registered, approved, and subscribed on a signed engagement.

Two tiers: the catalog and your subscription

The platform keeps a registry — the catalog of every methodology it is approved to run. Your engagement is a subscription: the subset of that catalog you select, bound to your surfaces, targets, and depth. The engine that executes it all — Mangonel — runs only the intersection of three gates, so your selection is both what you bought and the boundary you consented to.

REGISTRY Approved catalog — all it CAN run SUBSCRIPTION What the engagement bought CEILING Authorized depth per surface ∩ RUNNABLE SET Mangonel ATTACK ENGINE + GATE METHODOLOGY PLUGINS recon · web · social · …

If a methodology isn't registered, the engine can't see it. If your engagement didn't subscribe to it, the engine won't run it — even when it's approved. And nothing runs deeper than your ceiling.

What you select

Didn't subscribe to social engineering? Your employees cannot be vished on that engagement. Selection is consent, per surface.

A worked path: external recon at S1

The full path from a selection on the contract to results on your engagement record:

1 · ENGAGEMENT SUBSCRIBES external-network → external-recon · ceiling S1 2 · MANGONEL RESOLVES registry ∩ subscription ∩ ceiling → execution plan 3 · AUTHORIZATION GATE every technique rung ≤ S1 & in-scope → passive → auto-approved 4 · RECON EXECUTES passive DNS · cert transparency · subdomain enum · exposure · fingerprint 5 · NORMALIZED OUTPUT Assets (domains, hosts, services) + Findings (S0 reachable, S1 susceptible) 6 · ON THE ENGAGEMENT asset map + findings on the record → visible in the portal
  1. You subscribe the external-network surface to the external-recon methodology, ceiling S1.
  2. Mangonel resolves the runnable set (registry ∩ subscription ∩ ceiling) and builds the plan.
  3. The Authorization Gate checks each technique: recon runs at S0–S1 against in-scope targets only, and is passive — so it clears automatically, no human approval needed.
  4. Recon techniques execute: passive DNS, certificate transparency, subdomain enumeration, service-exposure mapping, technology fingerprinting.
  5. Each emits normalized output — Assets and Findings in the same shape every methodology produces, so results interoperate.
  6. Assets and findings land on the engagement record, become visible in the portal, and feed any deeper surfaces you subscribed (recon is the input to everything else).
Why recon is first. It is entirely S0–S1 and non-destructive, so it is safe to fully automate with no human gate — and it produces the attack-surface map every other methodology depends on. Invasive rungs stay gated: anything at S3 or above requires an explicit, named approval before Mangonel will dispatch it.