---
name: post-exploitation
description: Assess impact, test lateral movement, evaluate data exposure, and document access chains
hats: [post-exploit-analyst, impact-assessor, verifier]
fix_hats: [classifier, impact-assessor, feedback-assessor]
review: ask
elaboration: autonomous
inputs:
  - stage: exploitation
    discovery: access-log
outputs:
  - discovery: impact-assessment
    hat: impact-assessor
---

# Post-Exploitation

Assess impact, test lateral movement, evaluate data exposure, and document access chains. Exploitation proved a vulnerability is reachable; post-exploitation answers "so what?" — what would a real attacker do with this foothold, and how bad would that be in business terms? Units are **impact assessments** (per ARCHITECTURE.md §2.2): one per access chain rooted in an exploitation finding.

## Per-unit baton

The three hats execute in `plan → do → verify` order:

- **`post-exploit-analyst`** (plan): from the established foothold, maps the reachable surface — what lateral targets are visible, what privilege-escalation paths exist, what data is accessible — without exfiltrating or modifying. Produces the access-graph.
- **`impact-assessor`** (do): translates the technical access-graph into business impact — data sensitivity, regulatory exposure, blast radius — and rates severity with the engagement's chosen rubric.
- **`verifier`** (verify): validates the impact assessment's substance, evidence trail, and consistency with the access-log. Body-only per architecture §3.4.

The baton: access foothold → access-graph → business-impact rating → validated assessment.

## Inputs and outputs

Consumes `exploitation/access-log`. Produces `IMPACT-ASSESSMENT.md` per unit, which feeds reporting.

## Fix loop and gate

`fix_hats: [classifier, impact-assessor, feedback-assessor]` — most findings here are impact-rating disputes, missing evidence at a step in the access chain, or business-context errors; `impact-assessor` is the implementer. Gate is `ask` because severity calls drive the report's executive summary and the remediation prioritization, and human review of those calls is load-bearing.
