Your team has won a contract to infiltrate an organization. The company wants to have the attack be as realistic as possible; therefore, they did not provide any information besides the company name.

Reconnaissance is the foundational first phase of the penetration testing lifecycle, where testers collect open-source and passive information about the target such as domain registrations, IP ranges, employee names, and technology stacks. Without this phase, subsequent steps like scanning and enumeration have no defined scope or targets to work with.

Privilege escalation occurs deep into the attack chain, after initial access has already been established, making it impossible as a first step.

Scanning actively probes systems for open ports and services using tools like Nmap, but requires target IP addresses or hostnames that are only identified during prior reconnaissance.

Enumeration extracts detailed resource information from already-discovered services and requires active hosts and open ports to have been identified first through scanning.