Testing Activities

Stay informed on testing activity, interpret results, and manage testing across your organization.

Quick Links

• Testing Status
• Activity Feed
• Attack Activity
• Launch Attack
• Attack Narratives
• Attack Narratives & Findings
• Notification Triggers
• Stop Testing
• Blackout Windows
• Sprocket IP Addresses

Testing Status

The Testing Status page provides a real-time view of all active, scheduled, and purchased testing across your organization.

To access Testing Status, click Testing Status in the top-right navigation. [1]

The page shows the status of each testing type:

• Manual Testing: Human-driven testing of your systems
• Social Engineering: Phishing or pretext calling campaigns. Purchased separately.
• Automated Testing: Scheduled Attack Narrative tasks
• Agentic Testing: AI agent-driven testing of your systems
• Attack Surface Monitoring: Automated scanning, monitoring, and discovery

Each type shows one of these statuses:

• Active: Testing is running
• Scheduled: Testing will start soon
• Inactive: Purchased but not running
• Not Purchased: Not part of your plan

Activity Feed

The Activity page is a chronological history of testing activity across your organization. To access Activity, select Activity from the left navigation under Reporting [1].

The heat map at the top of the page displays a rolling 12-month view of account activity. Each cell represents a day, brighter red cells indicate higher activity volume. Hover over any cell to see the exact date and activity count. [2]

Below the heat map, the activity feed displays a detailed timeline of events. Entries are linked where relevant, allowing you to navigate directly to the associated Finding or Attack Narrative. [3] A CSV of all activity or filtered activity can be exported from this view. [4]

Using Activity to stay in the know

Review the Activity feed regularly to stay informed on new findings and completed testing tasks. Use the heat map to understand your testing cadence. Finding and Attack Narrative entries link directly to the relevant detail pages, so you can drill down for more details. The Activity timeline also serves as a useful audit trail during compliance reviews or incident response.

Attack Activity

Attack Activity provides a unified view of all automated attacks running in your environment. It also includes any AI agent attacks you have triggered using the Launch Attack feature. To access Attack Activity, select Attack Activity from the left navigation under Attacks.

The page is organized into three tabs:

• Recent Attacks: A chronological log of all attacks that have run against your environment, including automated scheduled attacks and AI agent attacks.
• Running Attacks: Attacks currently in progress. Use this tab to see what is actively being tested at any given time.
• Scheduled Attacks: Upcoming attacks scheduled to run against your environment. This view is read-only.

Each attack entry displays:

• Date/Time: When the attack ran or is scheduled to run
• Type: Whether the attack is Scheduled or Event-driven
• Project: The project the attack is associated with
• Name/Description: The name of the attack and a short explanation about the attack
• Attack Phase: The stage of the attack chain this attack belongs to, such as Reconnaissance, Initial Foothold, Vulnerability Analysis, or Exploitation. Attack phases correspond to the categories used in Attack Narratives. See Attack Narratives for more details.
• Matched: The number of assets found to be vulnerable as a result of the attack. A value of 0 indicates nothing vulnerable was found. A red number indicates vulnerable assets were identified.

Clicking any attack opens a slide-out showing the full list of targets, the outcome for each asset, and a link to the associated Attack Narrative for more detail.

Stop All Attacks

The Stop All Attacks button on Attack Activity, works the same way as the Stop Testing button on the Dashboard.

A modal will appear for you to select projects to stop attacks for.

The following will happen after you click Stop Testing:

1. Testing stops immediately for the selected projects
2. An alert will go to the Sprocket Testing team
3. An alert will go to any users listed under Points of Contact for the selected projects
4. A banner will appear at the top of all screens. This is where you can resume testing at any time.

Launch Attack

Launch an on-demand AI agent attack against one website, such as after you ship a change. Launched attacks run once and do not affect scheduled testing.

To launch an attack:

1. In Attack Activity, click Launch Attack.
   
   

2. Agents: Select Apex or Link.
   
   

   Note: Link requires a website with valid credentials. See Web Application Credentials.

3. Targets: Select one website. Filter by custom tag or search.

   

4. Context (optional): Add instructions or reference files (.txt, .md, .json, .yaml, .yml, .csv) to focus the attack. For example: "We added a shopping cart last release, focus testing there."

   

   Note: Context applies only to the attack you launch with it.

5. Confirm: Click Launch Attack.

   

Track progress in the Running Attacks tab and view Live Traces in the attack slideout.

Findings are published after your Sprocket tester reviews them.

Requesting Authenticated Testing

If your organization has External Pentest without Web Application Testing, you can request authenticated testing from Launch Attack.

To request authenticated testing:

1. On the Agents step, click Request Authenticated Testing.
2. Optional. Select the web apps you want covered.
3. Submit your request.

Your Sprocket team will follow up.

Attack Narratives

Attack Narratives document the routes your Sprocket testing team, automated tasks, or AI agents use to emulate breaches. Each narrative, or attack, records one testing activity, whether or not it resulted in a finding.

Attack Narratives serve your organization in several ways:

• Proof of testing: They demonstrate the level of effort and methodology applied by your Sprocket team, even when no finding is discovered
• Security insight: They show how an attacker might move through your environment, giving your team visibility into gaps in detection and response
• Deconfliction: They provide visibility into Sprocket's testing actions, helping your defensive tools and security team distinguish testing activity from real threats.
• Threat coverage: They show when your environment has been tested against the latest known threats, even when exploitation was not possible.

To access Attack Narratives, select Attack Narratives under Attacks in the left navigation.

The summary cards show Active attacks, attacks Completed in the selected time period, and attacks that Resulted in Findings.

Search by name or ID, or click a row to open its details. Each narrative links to its run in Attack Activity.

Attacks are grouped into categories that reflect the stages of an attack chain:

• Reconnaissance: Information gathering about your environment
• Vulnerability Analysis: Identification of weaknesses in your systems and configurations
• Initial Foothold: Attempts to gain an initial point of entry into your environment
• Credential Abuse: Attempts to obtain or misuse credentials
• Exploitation: Active attempts to exploit vulnerabilities
• Post Exploitation: Actions taken after a successful compromise

Filters

Reviewing Attack Narrative Details

Click a row to open an attack. The page shows the attack's status and project, MITRE ATT&CK tags, and three tabs:

• Method: Attack phase, task, start date, and what was tested
• Findings: Findings the attack resulted in
• Attack Activity: The attack's run

Attack Status

The badge at the top of an attack shows its status.

Logging an Actual Result

Each completed attack includes an Expected result, your Sprocket team's assessment of what your security controls should have detected. You can log what actually happened by reviewing your logs and EDR solution and updating the Actual Result field on the attack.

Keeping results up to date gives you an accurate picture of your detection and response coverage, and directly impacts your MITRE ATT&CK heat map. See more about the MITRE ATT&CK heat map under Security Metrics & Analysis.

To log an actual result:

1. Open an attack. On the Method tab, select the Edit icon next to Expected. [1]
   
2. Click the chevron to see the Result option menu. [2]
   
3. Select the result that best reflects what your security controls detected. [3]
   
4. Click Save.

Result Options

• Undefined Result: No result has been logged yet.
• No Result: Nothing was detected.
• Logged: The attack left a log somewhere in your environment.
• Detected: A security control identified the attack.
• Alerted: Your team was alerted to the attack.
• Prevented: The attack was blocked entirely.

Attack Narratives and Findings

Attack Narratives and Findings are linked. When an attack results in a finding, you can navigate directly between the two.

• From an attack, open the Findings tab to see associated findings.
  
• From a Finding, select View Associated Attack Narratives to open a slide panel with the linked narrative.
  

Notification Triggers

Notifications keep you informed on testing activity and findings without requiring you to check the platform. You can configure your notification preferences to match how your team works.

You will receive notifications for the following activity for the projects you are a Point of Contact on:

• A new finding is published
• A testing task is completed
• A new Attack Narrative is published

All users can manage their own notification settings. Notification channels include email, Slack, and Microsoft Teams. For more information see Notifications under Account Management.

Stop Testing

If you need to halt testing immediately, use the Stop Testing button on the Dashboard. This stops all manual and automated testing for the selected projects instantly and notifies your Sprocket team.

To stop testing:

1. Navigate to the Dashboard.
2. Click Stop Testing in the upper right corner. [1]
3. Select the project types to stop. [Modal]
4. Click Stop Testing to confirm

Testing stops immediately. A banner is displayed to all users in your organization confirming that testing has been paused, with a Resume Testing button to restart at any time. [1]

Sharing Additional Context

If you have specific information to share with your Sprocket team about the stop, send a follow-up email to support@sprocketsecurity.com.

Blackout Windows

Blackout windows allow you to schedule a future period during which testing for a specific project is automatically paused and resumed. Use this when you know testing needs to stop at a future time and you may not be available to trigger it manually.

Blackout windows can be scheduled for External, Internal, and Web Application Testing projects.

To schedule a blackout window:

1. Navigate to the project page for the relevant project.
2. Select the Engagement Details tab.
3. Locate the Blackout Windows section and click Add.
4. Set a required start date and time and end date and time.
5. Save the blackout window.

When scheduling a blackout window, keep the following in mind:

• The start date and time must be in the future
• The end date and time must be later than the start
• Blackout windows cannot overlap with another scheduled window for the same project
• Windows must be at least 1 day and no longer than 4 weeks

Viewing Blackout Windows

You can view a list of all scheduled blackout windows for a project at any time, including upcoming, active, and past windows. Each entry shows the start and end date and time and current status.

You can edit or cancel any window with a status of Upcoming or Active. Cancelled windows are removed from the schedule.

What Happens During a Blackout Window

When a blackout window starts, testing is automatically stopped, a banner will appear at the top of the platform for all users when testing is paused. Testing resumes automatically when the window ends. For windows longer than 4 days, you will receive a notification 3 days before the window ends as a reminder of when testing will resume.

Sprocket IP Addresses

If your internal security team needs to allowlist or investigate Sprocket testing activity, a list of Sprocket IP addresses is available in your External Pentest and Web Application Tests project pages, scroll down to the bottom of the Scope tab, where you can download the list for easy sharing.