Imagine you are a penetration tester. An email arrives from Northbridge Health Plan, a US health insurer with 900 employees. Attached is a signed scope document. It names the client, the systems you may test, the rules of engagement, and the legal authority that lets you touch those systems at all. You have not run a single tool yet, and you should not until you have read every line.
A scope document lists what you may test and when. Rules of engagement describe how you may test, and which actions are off limits. Written authorization is the signed permission that makes the work legal. Without all three, the same activity is an attack, not a test.
Every engagement follows one path, from scope to testing to reporting, with stops along the way. Let’s look at where those stops sit for the Northbridge test:
This course teaches exploit reasoning. That is the skill of judging whether a weakness can be used to cause harm, how likely that is, and what the impact would be. It does not teach weaponization, which means building working attack tools. You will not see working exploits, payloads, or operational commands in any lesson.
Exploit reasoning only has value inside authorized testing. The scope excerpt below shows why. Read it as a tester would, and notice which phrases limit your actions or shape your evidence: