Planning and scoping

- Attack objectives mapped to MITRE ATT&CK techniques - Detection hypothesis per technique - Success criteria (attack success + detection success) - Rules of engagement and safety constraints