A clear investigation question
Choose a decision your team struggles to make today, such as whether repeated API probing fits authorised scanning or warrants further investigation. Name the analyst, security owner and source owners before agreeing the evaluation.
- One bounded API or application estate
- One agreed observation window
- Success criteria set before reviewing findings
