Scope and authorization
Create an engagement with explicit targets, an authorization reference, time limits, and request budgets before active work begins.
OPERATOR ROOM
An authorized, evidence-first workspace for planning, running, and reviewing security assessments.
AUTHORIZED USE ONLY
Use Operator Room only for systems you own or are explicitly authorized to assess. Scope, authorization, rate limits, retention, and operator identity remain part of the engagement record.
What Operator Room does
Operator Room brings scope management, recon, provider health, evidence, and assessment readiness into one authenticated workspace. It is designed to make the next operator action clear while preserving the facts needed to reproduce and review a result.
The platform does not treat a missing tool, a timeout, or an empty result as a successful scan. Operators see coverage, warnings, partial failures, and the exact session that produced a finding.
Assessment workflow
Build the inventory
Collect scoped OSINT, network, service, web, and content results. Each result should retain provenance, timestamps, confidence, and warnings.
Review before assessment
Vulnerability checks consume an approved inventory. Incomplete, expired, or unauthorized scope is visible as a blocked or partial state rather than a false success.
Export evidence and findings
Use the session report to review coverage, tool runs, evidence, findings, remediation context, and partial failures for the engagement record.
Execution modes
Public or cloud targets
The hosted web application sends approved public-safe work to configured backend providers. Provider health, plan limits, and the deployment configuration determine which capabilities are available.
Private or local targets
Private networks and lab services require an enrolled local connector such as ganga-agent. The connector must be paired to the user and engagement; it is not a shared anonymous tunnel and it must not be used to bypass scope.
Availability and safety boundaries
- Recon is read-only and rate-limited by policy. Active vulnerability assessment is gated on an approved, complete inventory.
- ARES is a provider in the application architecture. Its health state is shown by the application; a deployed service is not evidence that every scanner capability is enabled.
- C2, interception, exploit execution, credential capture, and post-exploitation are not part of the default public workflow. They require an explicitly authorized lab context and separate entitlement controls.
- AI assistance is advisory. Operators review scope, evidence, tool output, and remediation context before relying on a report.