What problem does it solve? During an authorized red-team engagement, the target's security state changes in response to your testing — a confirmed vulnerability stops reproducing, lockout counts spike, or new WAF headers appear. Without a disciplined method, testers misread these shifts as false positives and lose both the original finding and the valuable observation about the client's incident response capability. ## Core Features & Use Cases - Baseline fingerprinting and state diffing: Capture pre-test fingerprints (timing, response size, headers, cookies, lockout counts) and diff them against post-test state to surface meaningful changes. - Three IR observation patterns: Detect mid-engagement WAF rule deployment, active concurrent external attackers (e.g., AADSTS50053 Smart Lockout accumulation during M365 testing), and detection-induced rate limiting or IP blocks. - Finding templates and evidence discipline: Convert each observed state change into a reportable finding with pre/post PoC evidence, mitigation-depth assessment (WAF vs code fix), and client-facing recommendations. - Use Case: You confirm a SQL injection at 14:24, and by 14:55 the payload no longer reproduces. Instead of retracting the finding, you capture the new state, test WAF-evasion variants, and report both the original vulnerability and the client's ~30-minute mitigation response as a positive IR capability metric. ## Quick Start Ask the agent to capture a pre-test baseline fingerprint of the target and set up state-change monitoring for the engagement.
