# How an engagement works (/docs/pentest/engagement)



An engagement is one pentest, from scoping to the final report. Here's what to expect at each stage and what's yours to do.

Scoping [#scoping]

You [set up the applications](/docs/pentest/applications) you want tested, and the Trace team agrees the rest with you: which applications are in scope, whether the test is whitebox, greybox, or blackbox, and when it runs. Trace never starts a pentest without that agreement.

Testing [#testing]

Trace tests the applications in scope. As findings are confirmed and reviewed by a security engineer, they appear on the pentest's page in your dashboard, and your team hears about critical ones through Slack or email.

When testing is done, Trace issues the pentest report and the letter of attestation. Both are under **Deliverables** on the pentest's page.

Fixing findings [#fixing-findings]

Each finding starts as **Open**. Move it to **In progress** while your team works on it, and to **Remediated** once the fix is deployed. For a mobile app, upload the fixed build first.

Marking a finding Remediated asks Trace to retest it. The finding then shows one of three results:

* **Fixed**: the attack no longer works.
* **Partially fixed**: the original attack is closed, but a variation of it still works.
* **Verified open**: the attack still works.

A partially fixed finding keeps the severity it was found at, and Trace adds a **Residual** severity for the part that still works.

If a fix didn't hold, change the code and mark the finding Remediated again. There's no limit on retests.

You can also update a finding's status from the terminal with [`tracecli pentest findings status-update`](/docs/cli/overview#tracecli-pentest-findings-status-update).

When you disagree with a finding [#when-you-disagree-with-a-finding]

You have two options from the finding's status menu.

**Accept** it when you've decided to live with the risk, for example because another control already covers it. You give a reason, and the finding closes as **Accepted with controls**. Your reason appears in the finding's history and in the report.

On a partially fixed finding, the same option reads **Accept residual**. You accept the part that still works, and the finding closes as **Residual accepted**.

**Dispute** it when you think the finding is wrong, such as a false positive or something outside the agreed scope. The finding moves to **Contested**, and the Trace team reviews it with you. It's then dismissed, accepted, or kept open.

Questions and comments [#questions-and-comments]

To ask the Trace team something about a finding, or leave context for your own team, open the finding's **History** tab and choose **Add to history**, then **Comment**. The comment appears in the history with your name, and Trace replies in the same place. The same menu offers the status moves you have at that point, so you can mark progress, accept, or dispute without leaving the history.

Every change to a finding is recorded with who made it and when, so you have a full history for your auditors.