Extras · 1 of 4

A typical week

An engagement usually runs one or two weeks. Day one is scoping and reconnaissance: mapping what the client actually has exposed. Then scanning, finding a way in, escalating from a normal account to an administrator, and moving sideways through the network to see how far you get. You keep notes and screenshots of everything, because the deliverable is a written report ranking each finding and telling the client how to fix it. Then you present it to people who may not want to hear it.