Full chain

• Governance → Threat Modeling → Recon → Surface Mapping → Vulnerabilities → Exploitation → Post-Exploitation (Escalate, Credentials, Lateral, Persistence, Evasion) → Impact → Detection → Risk → Remediation → Reporting → Cleanup → Retest → Improve

0. Governance / Authorization (often skipped but critical)

• Legal permission. Only test what you’re explicitly authorized to test
• Scope definition (what systems, what techniques allowed)
• Rules of engagement (no DoS, no social engineering, etc.)

1. Threat Modeling

• Identifying what matters (assets), who might attack, and how. Focus on likely attack paths
• Human-focused attack vectors (phishing, pretexting). Tests user awareness and processes
• Identify: Assets (data, systems), Actors (insider, external attacker), Attack paths (how compromise could happen)
• Output: prioritized targets and likely attack scenarios

2. Reconnaissance

• Collect domains, IPs, employees, tech stack
• Passive: OSINT, DNS, public leaks
• Active: probing target systems
• Output: Raw intelligence. Target map (domains, subdomains, services)

3. Attack Surface Mapping