---
name: rt-methodology-selector
description: "Select the appropriate Red Team testing methodology based on engagement context. Compares PTES, NIST SP 800-115, OWASP WSTG, TIBER-EU, CBEST, and CREST IN-THROUGH-OUT. Configures the engagement methodology in config.user.toml."
---

# rt-methodology-selector

# Methodology Selection Workflow

## Step 1 — Understand Context
Ask:
- What industry/sector is the client? (financial, healthcare, government, tech, etc.)
- Is there a regulatory requirement driving this test?
- What is the primary testing domain? (web, infrastructure, mobile, full red team)
- Is this a compliance test or a genuine security assessment?
- What is the skill level of the security team being tested?

## Step 2 — Methodology Comparison

Load comparison data from: ./frameworks.csv

### Quick Decision Guide:

| Scenario | Recommended Methodology |
|----------|------------------------|
| Web application security test | OWASP WSTG |
| General penetration test | PTES (7 phases) |
| Compliance-driven test | NIST SP 800-115 |
| Financial institution (EU) | TIBER-EU |
| UK financial institution | CBEST |
| Enterprise red team | CREST IN-THROUGH-OUT |
| Mobile application | OWASP MASVS |

## Step 3 — Configure Methodology
Update: `_rtexit/config.user.toml`
Set: `methodology = "selected_method"`

## Step 4 — Adapt Phase Structure
Based on methodology, adjust:
- Phase names and sequence
- Required deliverables
- Report format

## Step 5 — Brief Team
All agents should know the selected methodology.
Run: `/rt-party-mode` for a brief war-gaming session on methodology implications.

## Selection Questions

| Question | Why It Matters |
|---|---|
| Is this compliance-driven? | NIST, PCI, ISO, and SOC2 reporting needs differ. |
| Is the target primarily web/API? | OWASP WSTG/API Top 10 gives best coverage. |
| Is this a financial-sector simulation? | TIBER-EU or CBEST may be required. |
| Is adversary emulation expected? | MITRE ATT&CK mapping should be central. |
| Is this a broad penetration test? | PTES provides a general full-lifecycle structure. |

## Output

The skill should produce selected methodology, secondary references, required evidence artifacts, required report sections, and client approvals needed before active testing.

## Example Recommendation

```markdown
Primary methodology: OWASP WSTG
Secondary mapping: MITRE ATT&CK + CVSS 4.0
Reason: Engagement scope is internet-facing web/API testing with executive and technical reporting.
Required evidence: request/response pairs, screenshots, CVSS vectors, remediation roadmap.
```
