> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.method.security/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.method.security/_mcp/server. # Targets > What a Target is, how it moves through the Targeting funnel, and the components that configure the pipeline. This module covers what a [Target](/platform/core-platform/targeting) is, the pipeline that produces a Compromised Target, and the components that configure and govern that pipeline (Packages, Triggers, Agents, and Rules of Engagement). By the end of this module, you should be able to describe what a Target is, how it moves through the funnel, and what role each component plays in the Targeting system. ## What is a Target? Targeting is Method's mechanism for identifying and pursuing real attack vectors, the assets the platform believes an adversary could exploit. Where [Findings](/platform/core-platform/findings) answer "what is wrong," Targets answer "what an adversary can exploit." Method's Agents work a Target from initial selection through Research, Pentest, Compromise, and Remediation, with controls you define over how far automation proceeds at each stage. ## How Targeting works Method's Targeting engine moves discovered [Objects](/platform/core-platform/objects) through a pipeline. Each phase narrows the population and increases confidence that what remains represents a real attack path. ![Diagram of how Targeting works, showing the full pipeline: Identifiers, Map, Objects, Research, Researched Targets, Pentest, Vulnerable Targets, Compromise, Compromised Targets, Remediate, Remediated Targets](/_fern-files/methodsecurity.docs.buildwithfern.com/447f019067120e2bf0cf4e6132be76b0e3daa786369294aa6ee42421433c4a3a/pages/training/targeting-fundamentals/targeting-pipeline.svg) #### Map You provide seed data (FQDNs and CIDRs) and connect integrations. Method scans each identifier continuously, models discoveries into 200-plus typed Object types in its cyber [Ontology](/platform/architecture/data), and hydrates the Ontology as new data arrives. #### Objects While Objects are not a distinct Agent phase, they are the filtering step between discovery and Research: you deploy Targeting [Packages](/training/targeting/targeting-foundations/packages), and their [Triggers](/training/targeting/targeting-foundations/triggers) apply criteria across the Objects that Map discovered to select which ones advance to Research. This turns a large universe of Objects into a prioritized subset of Targets worth pursuing. #### Research A Research Agent pulls in all related Findings on the Target's base Object, decides which are worth chaining together, and stores its research learnings directly on the Target. Targets that hold up move to Researched; those that do not are marked Invalidated and removed from the active pipeline. This phase filters false positives at scale before any offensive action runs. #### Pentest A Pentest Agent chains the Findings surfaced during Research and discovers new ones by trying a slate of attack vectors against the Target, operating with a human in the loop and under the Rules of Engagement you set. The result is the Target's objective risk: a Finding now exists on the Target, confirmed and reproducible. Targets that clear this phase move to Vulnerable. #### Compromise A Compromise Agent uses the Findings teed up by earlier phases to compromise the Target, moving from objective risk to demonstrated, subjective impact: proof that the Target's Confidentiality, Integrity, or Availability has actually been compromised, within a bounded blast radius and always within your defined Rules of Engagement. Targets that are successfully compromised move to Compromised, and Method produces a Report with evidence for remediation. #### Remediate Once a Target's risk is addressed, it moves to Remediated and is closed out. Remediated Targets remain tracked but are no longer actively worked. Remediated is a terminal state: a Remediated Target is not re-opened. Each stage only runs if the previous one succeeds. A Target that the Research Agent determines is not real never reaches the Pentest stage. A Target where the Pentest Agent cannot confirm a vulnerability never reaches the Compromise stage. And at any stage, the Rules of Engagement can require human approval before the next stage begins. ## The funnel ![The Targeting funnel showing columns for Potential Targets, Targeted, Researched Targets, Vulnerable Targets, Compromised Targets, and Remediated Targets.](/_fern-img/45fa46165bb4a470dfe0a7dacad16923e87f2811749ad8e902ae93a9d6862e26.webp) The funnel tracks where each Target is in the pipeline. Each Target holds one status at a time and advances as Agent work progresses. | Status | What it means | | -------------------- | ------------------------------------------------------------------------------------------------------- | | **Potential Target** | An Object that matches a Trigger's criteria and is queued for Agent action, with no Agent assigned yet. | | **Targeted** | Method has assigned an Agent and work is underway. | | **Researched** | The Research Agent has confirmed the Target is real and accessible. | | **Invalidated** | The Research Agent determined the Target is not accessible as initially suspected. This is terminal. | | **Vulnerable** | The Pentest Agent confirmed a vulnerability is present and reachable: objective risk. | | **Compromised** | The Compromise Agent has demonstrated impact: subjective risk. | | **Remediated** | The Target is addressed and closed. | | **Deferred** | The Target is on hold but remains in the funnel. | **Vulnerable versus Compromised** marks a shift in the kind of risk a Target represents. Vulnerable is objective risk: a Finding exists on the Target, confirmed and reproducible by Pentest. Compromised is subjective risk: the Compromise Agent has gone further and demonstrated real consequence, proving that the Target's Confidentiality, Integrity, or Availability was actually compromised. **Blocked** is not a status but a flag that can appear at Researched, Vulnerable, or Compromised. A Blocked Target is waiting on user input before work can continue, whether because the Agent needs direction or a Rules of Engagement gate requires human approval. **Exhausted** is a related flag that can appear at the same stages. An Exhausted Target is one where the Agent has run through the actions available to it at the current stage without advancing the Target and has stopped. ## What configures the pipeline Targets are produced by four components working together: Packages, Agents, Rules of Engagement, and Campaigns. Each one has a dedicated module later in this course: * A **Package** is the top-level configuration object. It bundles Triggers, Agents, and Rules of Engagement into a single unit that can be deployed against an [Environment](/guides/platform-setup/create-a-new-environment), a bounded scope of assets that can represent a business unit, region, or any meaningful grouping. * **[Agents](/platform/core-platform/agents)** are Method's AI workers assigned to each pipeline stage. A Package has three Agent slots: Research Agent, Pentest Agent, and Compromise Agent. * **[Rules of Engagement](/platform/overview/rules-of-engagement)** govern how the work is carried out at multiple levels. At the Environment level, a No-strike list protects assets across all Packages. At the Package level, Stage Policy controls how far Agents proceed autonomously, the Package No-strike list defines what is off-limits, and Risk Axes block specific categories of Agent actions. At the Agent level, Tool Policy controls which Tools an Agent can use regardless of which Package runs it. * A **[Campaign](/platform/core-platform/targeting#campaigns)** launches Targeting by connecting an Environment, scan schedules, and one or more Packages. Once launched, Method starts scanning the Environment and enrolling Targets. The following modules cover each of these in detail, starting with Packages. ## A compromised Target This is `zamunda-industries.com`, a fictional web application that has reached **Compromised** status. This is the result of every component we just described working together: a Trigger selected the Object, a Package defined which Agents and Rules of Engagement applied, and three Agents worked through the pipeline in sequence. The rest of this course walks through each of those components in detail. The end result is a Final Report with the confirmed vulnerability, reasoning, and evidence. ![Final Report detail view showing the Summary, Reasoning with confirmed vector and technique, environment context, and impact ladder with blast-radius class and live evidence.](/_fern-img/588a6d515330271ec7bf8fe9a6b6fcd9fa61b47d09e2352551300c1e1a9d1220.webp) ## Summary In this module we covered what a Target is, how the pipeline works from Map through Compromise and Remediation, and the funnel statuses and flags that track progress. We also introduced the components that configure the pipeline: Packages, Triggers, Agents, Rules of Engagement, and Campaigns. The next module covers Packages in detail. ## Knowledge check **Question:** A scan discovers a web application and the finding engine raises a CVE on it. Is it a Target? #### Check your answer Not yet. A Finding on an Object does not make it a Target. It becomes a Target only when a Trigger selects it. A Trigger can match on that Finding, but the Finding alone is not enough. **Question:** What is the difference between a Vulnerable Target and a Compromised Target? #### Check your answer A Vulnerable Target has a confirmed Finding. The Pentest Agent proved a vulnerability exists with reproducible evidence. A Compromised Target goes further. The Compromise Agent showed what an attacker actually gets from that vulnerability, demonstrating real consequence within the Rules of Engagement. ## Next module Continue to [Packages](/training/targeting/targeting-foundations/packages).