Rules of Engagement
Feisty Fox Security Pty Ltd - PO Box 1214, Gungahlin ACT 2912, Australia - Last reviewed November 2026
The operating discipline every Feisty Fox engagement runs under: authorisation, bounded scope, safety controls, and evidence handling that survives procurement and legal review.
1. Written authorisation first
No testing begins without a signed Rules of Engagement and a written authorisation letter naming the target scope, the testing window, and the client officer who can suspend activity. Verbal approval is never sufficient.
2. Defined scope and boundaries
Scope is defined at the asset level: domains, IP ranges, applications, identities and physical sites. Anything not listed is out of scope by default. Changes to scope require a signed variation before activity continues.
3. Safety of production systems
Operational technology engagements use passive telemetry and digital-twin validation, with documented de-confliction protocols and a nominated site contact. Destructive or availability-impacting techniques are excluded unless separately authorised in writing.
4. De-confliction and stop conditions
Testing is de-conflicted against known change windows, live incidents and third-party activity. Our operators halt immediately on any sign of production impact, safety consequence, or detection by a genuine adversary, and notify the nominated contact.
5. Data handling and evidence
Evidence is stored encrypted in Australian infrastructure, access limited to named principals, and retained only for the contracted period. Client telemetry is never reused, resold, or used to train external models, and is destroyed on request.
6. Communication and escalation
A named principal is reachable throughout the engagement window. Critical findings are reported verbally within the same business day, followed by written detail. A full technical and executive debrief closes every engagement.
Rules of Engagement templates and the pre-engagement due-diligence pack are issued under NDA before contracting.