- External shadowing introduction
- Internal shadowing introduction
- Web Application shadowing introduction
Purpose
This guideline formalises a pre-engagement meeting to prepare a trainee for shadowing an engagement.
Pre-Engagement Meeting
- Timing: 1-2 days before the engagement starts
- Owner: the consultant leading the engagement
- Format: a short, planned sit-down or call
What to cover:
- Scope: The type of pentest and how to access the application/infrastructure (where the proposal lives)
- Where the trainee is joining: e.g. "we've already done the kick-off, you're joining at the testing phase and will be helping with reporting too"
- Client context: who they are, anything relevant to how testing will run
- What shadowing means on this specific job (engagement style)
Agree on an engagement style (per job, not a fixed default):
- Checklist-led: Consultant provides a list to work through, trainee checks in at set points
- Side-by-side: Trainee and consultant test together in real time
- Independent with flagging: Trainee works solo, flags the consultant on findings or when stuck
Pick one and go. Trainees are encouraged to switch it up on future jobs to figure out what actually works for them.
Optional pre-read / warm-up:
Consultant sends a short, informal primer beforehand - e.g. "you're jumping on a web app test, here are some cool things to look at, some tips for getting started, go find your favourite vuln to warm up. Some basic templates have already been created that can be utilised.
Why this matters
- Removes ambiguity trainees might have to navigate alone (role, approach, learning style)
- Puts responsibility for context-setting on the consultant at the start of an engagement, not on the trainee to chase it down
- Doesn't reduce independence - trainees still choose their preferred approach per engagement
- Builds familiarity with engagement phases over time, so every new job doesn't feel like starting from scratch
Quick Reference - Consultants
- Schedule pre-engagement meeting 1-2 days out
- Cover scope, access, phase context, pentest type, client background
- Agree on an engagement style for this job
- Send optional pre-read/warm-up material