Your First Engagement

This guide walks through a full engagement from start to finish. By the end, you will have created a client, set up an engagement, logged findings, captured evidence, generated a report, and sent it to the client.

It mirrors what a real engagement looks like in practice.

1. Create the client

Open the sidebar and go to Clients.

Click New client. Fill in:

• Name — the organization name
• Contact — the primary person you'll be working with
• Email — for delivery and billing
• Status — start as Lead, move to Client once the contract is signed

Save. You'll land on the client's detail page.

2. Add a contact

On the client detail page, go to the Contacts tab.

Click Add contact. Enter the person you'll be coordinating with — name, role, email, phone.

Mark the primary contact. This is who gets reports and invoices by default.

3. Create the engagement

Go to Engagements in the sidebar, then click New engagement.

Fill in:

• Client — the one you just created
• Name — something clear like "Q1 External Pentest"
• Type — pentest, forensics, incident response, or one of the other supported types
• Start date and End date

Save. The engagement starts in the Scoping phase.

4. Define scope

Inside the engagement, open the Scope tab.

Add scope items one at a time:

• In-scope — the IPs, domains, or applications you are authorized to test
• Out-of-scope — anything explicitly excluded

The out-of-scope list matters as much as the in-scope list. It documents boundaries.

5. Load a playbook

Go to the Playbooks tab. Click Load playbook.

Pick a methodology — for an external pentest, start with PTES or the Network Pentest playbook. Click Load.

The playbook becomes a checklist attached to this engagement. Every task is tracked, and progress is shown per phase.

6. Work through tasks

Click into the loaded playbook. You'll see its phases and tasks.

For each task:

• Check the box when done
• Click the note icon to add free-text notes
• Click the paperclip to attach a finding or evidence file

Progress updates automatically as you tick tasks off.

7. Log findings

As you discover issues, go to the Findings tab and click New finding.

For each finding:

• Title — short and specific
• Severity — critical, high, medium, low, or informational
• CVSS score — number 0.0 to 10.0
• Description — what the issue is
• Impact — what an attacker could do
• Remediation — how to fix it
• ATT&CK tags — technique IDs like T1190

Save. The finding appears in the list, sorted by severity.

8. Capture evidence

With a finding open, scroll to the Evidence section. Click Upload.

Select a file — screenshot, packet capture, log excerpt. The file is:

• Uploaded to object storage
• Hashed with SHA-256 for integrity
• Linked to this finding

You can attach multiple files per finding.

9. Log time

Go to the Time tab. Click Log time.

Enter hours, a short description, and mark it billable if applicable.

Time entries feed the financial dashboard and the effective hourly rate calculation.

10. Generate the report

Go to the Reports tab. Click Generate report.

Pick a template — for a pentest, use Penetration Test Report. Click Generate.

ATHELOS creates a new report with:

• Cover page
• Executive summary (auto-populated from critical findings)
• Scope section (auto-populated from scope items)
• Methodology section
• Findings section (from the findings you've logged)
• ATT&CK coverage section
• Recommendations

Edit the sections that need your voice. Save.

11. Preview and export

Switch to Preview mode to see the report as the client will.

When it's ready, click Download PDF. ATHELOS renders the report headlessly and downloads the file.

The PDF matches the preview exactly.

12. Deliver to the client

Still in the report, click Create delivery link.

Choose an expiry — 30, 60, or 90 days. Click Create.

The raw URL is shown once. Copy it and send it to the client.

The client opens the URL in their browser — no login required. They see the report exactly as you see it. Every view is logged. You can revoke the link at any time.

13. Invoice

Go to Invoices in the sidebar. Click New invoice.

Select the client and the engagement. Add line items:

• Description
• Quantity
• Unit price (in cents)

Set tax if applicable. Save.

The invoice appears in the list with status Draft. Mark it as sent when you deliver it, and as paid when payment arrives.

14. Close the engagement

Back in the engagement, advance the lifecycle phase:

Reporting → Closed.

The engagement is archived. All findings, evidence, reports, and time entries remain accessible.

Where to go next

• Managing findings — the details of findings
• Generating reports — templates and sections
• Delivering to clients — the delivery portal