# Enumeration Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Vulnerability catalog lists each finding with CVE reference, CVSS score, affected service, and verification status"
- "Service enumeration identifies software versions for at least 90% of discovered services"
- "Attack surface map categorizes entry points by protocol, authentication requirement, and exposure level"

### Bad criteria — vague (no clear check)

- "Services are enumerated"
- "Vulnerabilities are found"
- "Attack surface is documented"

