This is the second stage of the Offensive Operations maturity ladder.
Operator Augmentation ran the engagement through Overwatch, keeping you in your own terminal with Method’s Agents following the operation and providing suggestions and context. This stage moves the engagement into Operator, Method’s unified offensive workspace, and starts from an assumed-breach foothold: a Jackal already running on a target you would otherwise have had to compromise to reach.
In these engagements, Method provides you, the cyber operator, with an AI Copilot, Tools, C2, the Tool Graph, the Network Map, and automatically drafted Reports inside one workspace.
Running an assume-breach engagement this way will give you:
The Jackal is Method’s lightweight, runtime-configurable C2 implant. It is the access vector the Operation will use to act on the target.
From the Method Platform, open Install a Jackal in the left navigation, give it a name, choose the Environment, the operating system, and execution mode, and click Create Jackal. Method generates the install command and a downloadable binary for your target. For the full walkthrough (configuration options, exfiltration controls, C2 parameters), see Install and configure a Jackal.
Install the Jackal binary onto the in-scope host that represents the conceded foothold. This is the machine you would otherwise have had to compromise to reach: a workstation a phishing target would have opened, a service account host an exposed credential would have unlocked, or any other system whose initial access is being assumed for the engagement.
Once the Jackal is running, it reports back to the Platform and becomes available as an access vector for new Operations. Confirm it appears under Admin > Jackals with a healthy status before moving on.
Open the Operations app, click New in the top-right, and select Operation. Method opens the New Operation form. Fill it out with the assume-breach engagement in mind:
Click Begin Operation to drop into the Operator workspace.
For a step-by-step walkthrough of the Operation form, see Run your first Operation.
A live Operation in Operator gives you a single workspace for C2, data, Tools, and AI. Every action you take and every Tool the Jackal runs lands on the Operation graph. The AI Copilot can interact with the same Operation context you do.
Operator is built around three panels:
The Jackal is wired into Operator as an access vector. When a Tool needs to run against the foothold or anything reachable from it, Method routes execution through the Jackal automatically.
The AI agent in the Chat tab is your reasoning partner in the workspace. It reads the Operation graph, the Ontology, the Environment intelligence, and the RoE, then helps you make sense of what you have and decide what to do next.
Use it to analyze a Tool’s output, ask why a discovered Object matters, get the next Tool suggestion grounded in the current graph state, or step through a hypothesis before you commit to action. Selecting a node first scopes Chat to that step; suggested commands and Tools return formatted to run with a single click.
In Copilot mode, Chat-suggested Tool insertions wait for your approval before execution. In Manual mode, Chat still answers questions and runs analysis, but it does not propose Tool runs. See Operator AI for the agents and sub-agents available.
The Tool Graph is the Operation’s source of truth. Every Tool execution is a node, and the edges between nodes are the data types flowing from one Tool’s output into the next Tool’s input.
The graph builds itself as the Operation progresses. Selecting any node opens its execution details, the Objects it created, the Issues it surfaced, and the path it took into the next step. Tracing a Finding back to the Tool run that produced it is one click; the same is true in reverse for understanding what a single Tool unlocked downstream.
The Network Map is the topology view of the target network. As the Operation discovers hosts, services, and the relationships between them, the Map fills in.
It is the fastest way to see whether discovery is converging on the engagement’s objective. New surfaces appear there the moment a Tool reports them, with the Jackal-backed foothold visible at the center as the anchor for everything that follows.
The Report for an Operation is drafted by AI from the Operation’s activity: the Tool Graph, Object Findings, RoE, and the engagement’s stated Objective. You review the draft, edit what you want, and decide what makes the final version before it ships.
Operation Reports live on the Reports tab of the Operations app alongside Reports drafted from Overwatch sessions, so a multi-surface engagement still produces a single coherent deliverable.
A typical Selective Auto Assume Breach engagement in Operator looks like this:
Step-by-step walkthrough of setting up and running an Operation in Operator, from the New Operation form to picking your first Tools.
The next stage of the Offensive Operations maturity ladder. Hand execution to an Operator AI agent emulating a specific Adversary, with you in the loop at Plan approval and mode switching.