Six steps. You are needed for the first one.
An engagement runs as six steps, and a human is only present for the first. You define what may be touched; the agent works inside that until the surface is exhausted, then writes what it found and how it proved it.
What happens, in order
- 01
You set the envelope
Paste the targets, sign the authorization, set the testing window, name an emergency contact, and choose which classes of action are permitted. Seccuti refuses to start an engagement that is missing any of these.
- 02
It maps the surface
Hosts, services, endpoints, parameters, technologies, and the files nobody meant to leave reachable. Everything learned is recorded against the asset it came from, so a later finding can be traced to how it was discovered.
- 03
It gets authenticated
Most real issues sit behind the login. The agent uses credentials you supplied, and where a site allows sign-up it registers its own clearly marked test account so it can compare what one identity can reach against another.
- 04
It hunts
Injection, broken access control, authentication flaws, exposed data, security misconfiguration and known vulnerable components, worked as a methodology rather than a checklist, adapting to what the surface actually is.
- 05
It proves it, or drops it
Each candidate is re-tested against the live target. What reproduces gets its evidence attached. What does not is marked refuted, so the list you read is not padded with things nobody confirmed.
- 06
It writes the report
A finished deliverable in Turkish or English with severity, evidence, business impact and remediation. When you fix something, ask for a retest rather than booking a new engagement.
What you have to decide before it starts
These five are the whole of the human job, and none of them can be skipped.
- Targets
- The hosts, domains, URLs or ranges that may be tested. Anything not listed is refused.
- Authorization
- A recorded statement that you may authorize testing of these systems.
- Testing window
- The hours during which actions may run. Outside them, nothing executes.
- Action policy
- Which classes are permitted. Reconnaissance and enumeration are on; exploitation and anything destructive are off unless a named person enables them.
- Emergency contact
- Who is notified if a breaker trips, and who can trigger the kill switch.
Set an envelope and let it run.
The first five minutes are yours. The rest is not.