// GLOSSARY

Escalation

Starting an information flow through a predefined channel to named owners when the previously agreed scope is exceeded during testing, an unexpected critical finding is encountered, or operational-impact risk arises. It is kept in writing within the Rules of Engagement (RoE) and is an inseparable part of controlled execution. The most fragile moments of a penetration test or red team engagement are the moments of departure from plan; if the decision on what to do then is improvised, the test loses its defensibility. The escalation line brings this decision forward: when a critical finding is reached, who is informed, in what order and with what authority is written in advance. Its function is not to slow things down but to make the surprise manageable; a well-designed escalation both protects the customer's operation and lets the test proceed without spoiling its evidential value. What makes a test 'controlled' is exactly this pre-decided reflex.