Testing Activities

Manual Testing: Human-driven testing of your systems
Social Engineering: Phishing or pretext calling campaigns. Purchased separately.
Automated Testing: Scheduled Attack Narrative tasks
Agentic Testing: AI agent-driven testing of your systems
Attack Surface Monitoring: Automated scanning, monitoring, and discovery

Each type shows one of these statuses:

Active: Testing is running
Scheduled: Testing will start soon
Inactive: Purchased but not running
Not Purchased: Not part of your plan

Tip: The Testing Status page can be bookmarked or shared with your IT team to provide a real-time view of Sprocket testing activity without requiring a login.

</aside>

Activity Feed

The Activity page is a chronological history of testing activity across your organization. To access Activity, select Activity from the left navigation under Reporting [1].

Activity Feed_7.20.2026.png

The heat map at the top of the page displays a rolling 12-month view of account activity. Each cell represents a day, brighter red cells indicate higher activity volume. Hover over any cell to see the exact date and activity count. [2]

Below the heat map, the activity feed displays a detailed timeline of events. Entries are linked where relevant, allowing you to navigate directly to the associated Finding or Attack Narrative. [3] A CSV of all activity or filtered activity can be exported from this view. [4]

Using Activity to stay in the know

Review the Activity feed regularly to stay informed on new findings and completed testing tasks. Use the heat map to understand your testing cadence. Finding and Attack Narrative entries link directly to the relevant detail pages, so you can drill down for more details. The Activity timeline also serves as a useful audit trail during compliance reviews or incident response.

Attack Activity

Attack Activity provides a unified view of all automated attacks running in your environment. It also includes any AI agent attacks you have triggered using the Launch Attack feature. To access Attack Activity, select Attack Activity from the left navigation under Attacks.

The page is organized into three tabs:

Recent Attacks: A chronological log of all attacks that have run against your environment, including automated scheduled attacks and AI agent attacks.
Running Attacks: Attacks currently in progress. Use this tab to see what is actively being tested at any given time.
Scheduled Attacks: Upcoming attacks scheduled to run against your environment. This view is read-only.

Each attack entry displays:

Date/Time: When the attack ran or is scheduled to run
Type: Whether the attack is Scheduled or Event-driven
Project: The project the attack is associated with
Name/Description: The name of the attack and a short explanation about the attack
Attack Phase: The stage of the attack chain this attack belongs to, such as Reconnaissance, Initial Foothold, Vulnerability Analysis, or Exploitation. Attack phases correspond to the categories used in Attack Narratives. See Attack Narratives for more details.
Matched: The number of assets found to be vulnerable as a result of the attack. A value of 0 indicates nothing vulnerable was found. A red number indicates vulnerable assets were identified.

Clicking any attack opens a slide-out showing the full list of targets, the outcome for each asset, and a link to the associated Attack Narrative for more detail.

Stop All Attacks

The Stop All Attacks button on Attack Activity, works the same way as the **Stop Testing** button on the Dashboard.

Table of Contents

Quick Links

Testing Status

Activity Feed

Using Activity to stay in the know

Attack Activity

Stop All Attacks

Launch Attack

Attack Narratives

Attack Narratives and Findings

Notification Triggers

Stop Testing

Blackout Windows

Sprocket IP Addresses