A click is not always a person, an integration is not a product entitlement, and a security exercise is not authorized merely because the technology can run it. These briefs keep those boundaries visible.
Email-security gateways, reputation systems, link scanners, and prefetch behavior can touch campaign infrastructure before an employee does. Attribution rules should be documented before scores are compared.
The source note examines how gateway processing, feature extraction, and reputation systems can change what a campaign event means. Treat machine-generated touches as an observation to classify—not automatic evidence of human behavior.
The source note considers scanner and prefetch identification. Network fingerprints can support classification, but should not be presented as infallible proof of a person or a particular product.
A defensible program preserves the underlying event types, the confidence of attribution, the exercise context, and the time window. A composite score can help prioritize follow-up, but should not erase uncertainty or be used as the sole basis for employment action.
An adversary-in-the-middle exercise can interact with authentication flows and sensitive data. The source note focuses on written authorization, contract and governance scope, data handling, stop conditions, and the distinction between demonstrating exposure and collecting unnecessary secrets.
Read the AiTM and MFA source note (zh-CN) →
Channel design, tool discovery, server configuration, licensing, and external-platform approval are separate layers. An evaluation should name which layer supplies each capability.
The source note examines sequencing across email and instant messaging. Channel availability, identity mapping, timing, consent, and reporting should be treated as operational dependencies—not assumed from a single campaign label.
An MCP client may display a tool description while the server still enforces authentication, version, license, and policy. The source note separates client visibility from the authority to execute an operation.
The commercial-license note separates deployment location from license entitlement, modules, service obligations, and infrastructure ownership. The signed order and version-specific support matrix remain the governing sources for a delivery.
Tell us what you need to measure, your delivery channels, deployment boundary, and governance constraints. We will scope the relevant product and documentation path.
