// GLOSSARY

Controlled Testing

The principle that no attack simulation is performed without written authority, explicit scope, Rules of Engagement (RoE), a test window, approval gates, human oversight, side-effect control and an escalation line being visible. This is the ground on which Red in Pulse produces defensible assurance and the precondition of every offensive service. What separates an offensive engagement from a real attack is not a difference in the techniques used; the techniques are often the same. What separates them is the frame: the same action, done within written authority and an agreed scope, is a legitimate assurance engagement, and done outside it, a crime. So soft phrases like 'ethical hacking' or 'safe testing' do not stand in for controlled testing; because what makes a test legitimate is not good intent but a frame that is written and auditable. Good intent is not evidence in a court or an audit; a signed scope, a test window and an escalation record are. NIST SP 800-115 and PTES are the methodological frameworks of this discipline; controlled testing is their applied form in the field.