The black box problem in security is real, and it exists on both sides of the table. Attackers operate in darkness. But so — surprisingly — do the platforms you hire to simulate them.
You receive a scope agreement, sign an NDA, wait several weeks, and then receive a PDF. What happened in between? What did they actually look at? Which techniques were tried? Why did it take six weeks? Most vendors don't answer these questions because they can't — the answer is "a lot of manual work, some intuition, and a significant amount of time spent writing the report."
Arxiis was built to invert this. Every engagement is deterministic, auditable, and transparent. This article walks you through every stage of what happens when you commission an Arxiis red team engagement — from the moment you grant scope to the moment you receive your report.
Before the Engagement: Scoping, Authorisation, and Rules of Engagement
No agent touches your infrastructure without explicit, documented authorisation. Before anything runs, you define the engagement surface through the Arxiis console: in-scope domains, IP ranges, cloud account identifiers, and any exclusion zones — production databases, regulated endpoints, business-critical uptime windows.
You also set the rules of engagement. Social engineering? Phishing simulations? Physical boundaries? Denial-of-service testing? All configurable. The system generates a cryptographically-signed engagement manifest — a tamper-evident record of everything the agents are permitted to do. This manifest travels with every action taken during the engagement, creating a full legal paper trail.
Once you countersign and activate the engagement, the pipeline begins.
Stage 1 — Reconnaissance (0:00 – 0:45)
Reconnaissance is the stage most traditional engagements spend too little time on. It's also the stage that most directly determines what an attacker would know about you before the first exploit attempt. Arxiis dedicates specialised OSINT agents to this phase — agents that run continuously and in parallel rather than sequentially.
Subdomain enumeration agents query over forty passive sources: certificate transparency logs, DNS datasets, search engine indexed subdomains, historical crawl data, and third-party security databases. Port scanning agents fingerprint the resulting IP space for open services, versioned daemons, and unexpected exposure. Technology fingerprinting agents identify frameworks, WAFs, CDNs, and backend infrastructure from HTTP response characteristics.
Within the first 45 minutes, Arxiis has a complete, structured map of your external attack surface — the same one a skilled attacker would spend days or weeks building manually.
Stage 2 — Intelligence Gathering (0:45 – 1:30)
Recon tells you what is exposed. Intelligence gathering tells you what's actionable. This is where Arxiis agents shift from passive observation to active analysis of exposure depth.
Credential hunting agents scan breach databases, paste sites, and dark web forums for email-password pairs, API tokens, and session cookies associated with your organisation's domains. Configuration exposure agents look for publicly accessible environment files, backup archives, Git repositories, and cloud storage buckets that have been inadvertently made public. Third-party risk agents assess the security posture of every SaaS integration and third-party script your applications load.
This stage also includes supply chain analysis — understanding which components of your stack have known CVEs, recently disclosed vulnerabilities, or dependency confusion risks that could be weaponised during active exploitation.
Stage 3 — Active Exploitation (1:30 – 3:00)
Armed with the intelligence map from stages one and two, exploitation agents begin attempting to translate exposure into access. This is the stage that requires the most careful guardrailing — and the stage where Arxiis's engagement manifest proves its value.
Agents attempt SQL injection across all discovered input surfaces, testing both error-based and blind techniques. Authentication bypass agents probe login flows for logic flaws, token predictability, and session fixation vulnerabilities. Where Active Directory environments are in scope, AD-specific agents test for Kerberoasting, AS-REP roasting, NTLM relay, and DCSync privilege abuse. In containerised environments, agents test for escape vectors including privileged container abuse, exposed Docker sockets, and pod-to-pod network paths that violate security policy.
Every exploitation attempt is logged in real time. You can watch the engagement unfold in the Arxiis console, with a running tally of attempted vectors, blocked attempts, and successful access.
Stage 4 — Chaining and Validation (3:00 – 4:15)
Individual vulnerabilities rarely tell the complete story. A reflected XSS finding alone might be medium severity. That same reflected XSS, chained with a session fixation vulnerability and a misconfigured CORS policy, becomes a full account takeover — critical severity with a clear kill chain.
Chaining agents take every successful exploitation outcome and attempt to extend it: lateral movement to adjacent systems, privilege escalation within compromised environments, and the construction of end-to-end attack narratives that demonstrate real business impact. An agent that gains initial access to a low-privilege web application account will automatically attempt to pivot to internal network resources, escalate to administrative access, and reach sensitive data stores.
The output of this stage is a set of validated, reproducible kill chains — not a list of theoretical vulnerabilities, but demonstrated paths from attacker to your most sensitive assets.
Stage 5 — The Report (4:15 – 5:00)
Reporting is where traditional engagements lose 40% of the total engagement time to manual, error-prone work. A consultant must translate their notes into a structured document, assign severity scores, map to frameworks, and cross-reference against compliance requirements — all by hand.
Arxiis reporting agents do this automatically. Every finding is CVSS 3.1 scored using the same structured methodology across every engagement. Every finding is mapped to the relevant MITRE ATT&CK techniques and sub-techniques. For regulated environments, findings are automatically overlaid against RBI IT Risk Framework controls, CERT-In guidelines, and DPDP obligations. The report is generated within minutes of the final validation step completing.
What You Receive at the End
The engagement closes with a complete deliverable package, available in the Arxiis console and exportable in multiple formats:
- Executive Summary — Risk posture narrative, critical findings, and board-ready business impact language with no jargon.
- Technical Finding Register — Every vulnerability with CVSS scores, proof-of-concept evidence, and step-by-step reproduction instructions.
- Kill Chain Maps — Visualised attack paths showing how individual findings chain to critical impact, from initial access to data exfiltration.
- MITRE ATT&CK Coverage Map — Which techniques were tested, which succeeded, and where your defences held, mapped to the ATT&CK matrix.
- Compliance Overlay Report — Findings cross-referenced to RBI IT Risk Framework, CERT-In Directions, DPDP, ISO 27001, and SOC 2 controls.
- Remediation Guidance — Prioritised fix recommendations ordered by risk reduction per unit of engineering effort, not just severity.
- Raw Evidence Archive — Every request, response, screenshot, and log that proves each finding, retained in your tenant and never transmitted externally.
Retesting and Continuous Cadence
A point-in-time assessment has an expiry date. The day after you receive your report, your engineering team begins deploying changes. New features ship. Dependencies update. The attack surface evolves. Traditional engagements can't keep pace with this — another engagement means another six weeks and another significant budget line.
Arxiis is designed for continuous cadence. Once your initial engagement is complete and you've remediated, you can trigger a targeted retest directly from the finding record. Agents re-run only the relevant test cases, verify the fix, and update the finding status — in hours, not weeks.
For organisations with active development pipelines, Arxiis also offers always-on engagement mode: agents continuously monitor your attack surface for new exposure introduced by code deployments, infrastructure changes, or newly disclosed CVEs affecting your stack. You receive an alert when risk changes, not a quarterly PDF.
The organisations that get compromised aren't always the ones with the worst security posture on day one. They're often the ones who did a pentest, remediated, and assumed they were done. Security is a continuous state, not a certification moment.
