Rules of Engagement (RoE)

Spell out exactly how testing will run — so nobody's SOC panics and nobody argues about scope afterward.

What It Is

Where a Pentest Authorization Letter proves you have permission to test, a Rules of Engagement document spells out exactly how. It's the reference both sides pull up the moment something looks unexpected during testing: who to call, what IPs to expect traffic from, and what's explicitly off-limits.

Why It Matters

Without it, a client's SOC team may block or even report your testing traffic as an attack, and there's no written reference for which techniques were and weren't authorized if a disagreement comes up after the fact. It's the operational companion to your Authorization Letter — use both together for a real engagement.

What's Included

Testing Hours

Source IP Addresses

In-Scope Assets

Out-of-Scope Assets

Prohibited Techniques

Emergency Contacts

Generate Your Rules of Engagement

Fill in a short form and download a complete RoE as PDF or DOCX.

Generate Rules of Engagement