External engagements are the most common starting point for security testing in SpartanX. This guide walks through both the basic wizard and the advanced wizard, covering asset selection, guardrail configuration, scheduling, secrets management, and the deep intensity option.
Starting with the Basic Wizard: Full Scope Adaptive Intensity
To launch an external engagement, navigate to Engagements in the left-hand menu and select the external engagement option. Choose "Full Scope Operation with Adaptive Intensity" and click to launch.
Step 1: Select Assets
Choose the assets you want to include in the engagement. Assets can be filtered by type (web-based, network-based) or by reachability. Select one or more assets — these should already be in a collection if you followed the previous steps. Click Next.
Step 2: Configure Guardrails
Guardrails control how aggressively the AI agents operate. Three options are available:
No Guardrails — simulates a real adversary with no restrictions. May spawn reverse shells, crash daemons, or perform other high-impact actions. Recommended only for isolated dev or test environments, never production.
Standard Guardrails (Default) — enforces runtime safety controls. Agents will confirm findings without performing destructive actions. May result in slightly fewer findings but is appropriate for most environments.
Maximum Safety (Egress Gateway) — adds a non-AI egress gateway that evaluates outbound calls and blocks harmful actions at the network level. The strongest safety option, suitable for sensitive production environments.
Choose the guardrail level appropriate for your target environment. When in doubt, use Standard.
Step 3: Name, Schedule, and Launch
Give the engagement a descriptive name. You can:
Start immediately
Schedule for a specific date and time (useful for off-hours or weekend testing)
Set a recurrence (daily, weekly, monthly, quarterly, or custom)
Use "Save Only" to defer launch and add credentials first
Managing Secrets
Selecting "Save Only" takes you to the Secrets tab, where you can provide credentials for authenticated testing. Secrets can include:
Login credentials (username/password)
Session cookies
Authorization headers and API keys
Secrets can be scoped to specific assets within the engagement. As the engagement runs, agents may also discover and add secrets automatically — modeling how a real attacker would find and chain credentials.
The Advanced Wizard
For more control, launch the advanced wizard. The core steps — asset selection, guardrails, naming, and scheduling — are the same. The advanced wizard adds:
Deep Intensity Mode — agents reason more thoroughly, challenge assumptions, and explore novel attack paths. This mode takes longer and consumes more tokens, but significantly increases the likelihood of finding zero-day vulnerabilities.
Knowledge Settings — define engagement-specific restrictions and terms (covered in detail in a later section).
Safe Checks — enabled by default. Prevents destructive actions like database deletions. Disabling is not recommended.
The advanced wizard is the preferred option for teams that want full control over engagement scope, intensity, and guardrails.
What's Next
With external engagements covered, the next section walks through Remediation Verification — how to retest specific vulnerabilities after developers have applied fixes.