{
  "id": "workflow:penetration-testing",
  "_kind": "Workflow",
  "_file": "workflows/workflows/workflows-expanded.yaml",
  "_cluster": "workflows",
  "attributes": {
    "displayName": "Penetration Testing Engagement",
    "workflowKind": "governance",
    "triggerType": "scheduled",
    "typicalCadence": "quarterly",
    "complexity": "cross-team",
    "description": "Plans and executes penetration testing engagements -- scoping target\nsystems and attack surfaces, conducting reconnaissance and\nvulnerability exploitation, testing authentication and authorization\nboundaries, assessing data exfiltration risks, documenting findings\nwith severity ratings, and coordinating remediation with engineering\nteams. Produces pen-test report and remediation priority list.\nExcludes ongoing vulnerability scanning.\n"
  },
  "outgoingEdges": [
    {
      "from": "workflow:penetration-testing",
      "to": "role:security-engineer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "role:chief-security-officer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "role:backend-engineer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "skill-area:vulnerability-scanning",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "skill-area:threat-modeling",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "skill-area:application-security",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "domain:security",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "domain:cybersecurity",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "responsibility:security-audit",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:penetration-testing",
      "to": "responsibility:risk-assessment",
      "kind": "triggers_responsibility",
      "attributes": {}
    }
  ],
  "incomingEdges": []
}