Client, engagement, asset

Create the client

Start from Clients and add the company you are testing for: a display name (how it appears in the interface) and a legal name. While you are here, add its contacts, and mark the ones who signed off on the test window as authorizers, since authorizers appear on the report cover. You can come back to contacts later; they are managed on the client.

Create the engagement

Create an engagement for that client. It gets a code (YEAR-SEQ) assigned by the server, and you give it a title and a test window (start and end). Set the lead, and add the members who will work it: access to the engagement is scoped to its members, so an account that is not a member simply will not see it. Choose the report locale here too, matching the client who will read the report.

Add assets

Add the assets in scope, each with its kind (web, REST API, and so on). Assets are what the methodology is worked against and what coverage and findings are recorded on. With at least one asset in place, the engagement is ready to work.

Adopt a methodology

Adopt one or more methodology frameworks for the engagement. This is what fills the cockpit with the steps and techniques to work through, in execution order. Next: the cockpit.