# Reconnaissance Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Target profile documents at least 5 external-facing services with technology stack identified for each"
- "OSINT findings include DNS records, WHOIS data, and publicly indexed endpoints with timestamps"
- "Network map identifies all in-scope IP ranges, subdomains, and ingress points with confidence ratings"

### Bad criteria — vague (no clear check)

- "Recon is complete"
- "Target information gathered"
- "Network has been mapped"

