01
Start with the security concern
A vulnerability, sensitive-data exposure, suspicious activity or an AI action you need to control. Bring the relevant code, configuration and information your team is permitted to use, along with an owner and a clear outcome to test.