How an engagement works

An engagement is one pentest, from scoping to the final report. Here's what to expect at each stage and what's yours to do.

Scoping

You set up the applications you want tested, and the Trace team agrees the rest with you: which applications are in scope, whether the test is whitebox, greybox, or blackbox, and when it runs. Trace never starts a pentest without that agreement.

Testing

Trace tests the applications in scope. As findings are confirmed and reviewed by a security engineer, they appear on the pentest's page in your dashboard, and your team hears about critical ones through Slack or email.

When testing is done, Trace issues the pentest report and the letter of attestation. Both are under Deliverables on the pentest's page.

Fixing findings

Each finding starts as Open. Move it to In progress while your team works on it, and to Remediated once the fix is deployed. For a mobile app, upload the fixed build first.

Marking a finding Remediated asks Trace to retest it. The finding then shows one of three results:

• Fixed: the attack no longer works.
• Partially fixed: the original attack is closed, but a variation of it still works.
• Verified open: the attack still works.

A partially fixed finding keeps the severity it was found at, and Trace adds a Residual severity for the part that still works.

If a fix didn't hold, change the code and mark the finding Remediated again. There's no limit on retests.

You can also update a finding's status from the terminal with tracecli pentest findings status-update.

When you disagree with a finding

You have two options from the finding's status menu.

Accept it when you've decided to live with the risk, for example because another control already covers it. You give a reason, and the finding closes as Accepted with controls. Your reason appears in the finding's history and in the report.

On a partially fixed finding, the same option reads Accept residual. You accept the part that still works, and the finding closes as Residual accepted.

Dispute it when you think the finding is wrong, such as a false positive or something outside the agreed scope. The finding moves to Contested, and the Trace team reviews it with you. It's then dismissed, accepted, or kept open.

Questions and comments

To ask the Trace team something about a finding, or leave context for your own team, open the finding's History tab and choose Add to history, then Comment. The comment appears in the history with your name, and Trace replies in the same place. The same menu offers the status moves you have at that point, so you can mark progress, accept, or dispute without leaving the history.

Every change to a finding is recorded with who made it and when, so you have a full history for your auditors.