Concepts¶
This section explains the domain PEART models, the vocabulary the rest of the handbook uses, and the state machines that are easy to get wrong if you only read the screens. It is written for someone who wants to understand why the tool is shaped the way it is, not just where the buttons are.
The shape of the domain¶
A client is a company you test for. An engagement is one pentest against that client, over a test window, with a methodology and one or more assets (the systems in scope). As you work the methodology in the cockpit you record coverage per technique, and when you find something you write a finding. Findings carry severity, a disposition, a verification state that follows retests, and links to the techniques that cover them, which is what lets PEART derive mappings and compliance controls. Finished work becomes a report, generated per milestone, frozen and released to the client through the portal.