What problem does it solve?
It helps you turn mid-engagement changes in a target’s behavior into defensible, deliverable security findings instead of mistakenly treating recheck failures as false positives.
Core Features & Use Cases
- Pre/post state fingerprinting: Capture timing, response size, headers, cookies, and lockout indicators before active testing, then compute deltas after the session or upon first failed recheck.
- SOC-patch and control-depth interpretation: Distinguish whether behavior changes are consistent with WAF rule deployment versus code-layer fixes, using structured rechecks and variant probes.
- Operational IR evidence packaging: Convert observed state changes (including detection-induced rate limiting and concurrent attacker activity) into report-ready findings with evidence discipline and templates.
- Use Case: During an authorized red-team exercise, you confirm an SQLi and later notice response timing and headers changing; use this Skill to document both the confirmed vulnerability window and the client’s real-time mitigation behavior as separate findings.
Quick Start
Use this Skill when running an active, monitored engagement and response patterns shift during your test so the AI captures a pre-patch fingerprint, detects state changes, validates what changed with targeted rechecks, and writes an audit-grade report with a timeline.
