01 / RECOVER
Start with what the finding yields.
Identify supported credentials, tokens, signing keys, object identifiers, or internal reachability that can inform the next test.
READ THE PATH
The diagram below is an illustrative PARTIAL path, not a customer result. Findings are the nodes. Evidence about what passes between them forms the links.
FINDING A
A response discloses a session token.
OBSERVED CONNECTION
Recorded evidence shows that token used at a protected endpoint with a distinct finding.
FINDING B
A separate weakness is identified at the protected endpoint.
UNOBSERVED CONNECTION
A possible connection to a further finding needs confirmation. It is not treated as demonstrated.
FINDING C
A further distinct finding remains linked by inference.
Report label
What the label means
What to review
PROVEN
Every connection in the displayed path has observed evidence.
The capability, its use, and the supporting observation for each link.
PARTIAL
At least one connection is observed and at least one is unobserved.
The identified evidence gap before treating the complete path as demonstrated.
Observed use is not necessarily proof of necessity. A recording of a credential in a request does not, on its own, establish that the request depended on that credential.
ILLUSTRATIVE PATTERNS
These patterns describe supported kinds of follow-on investigation, not guaranteed outcomes. Each path depends on scope, access, enabled capabilities, and the evidence collected.
Initial exposure
What it yields
Follow-on investigation
Sensitive information in a response
A credential or session token
Can it be used at a protected endpoint associated with another weakness?
Request forgery reaching an internal service
Internal reachability or a disclosed secret
Does the recovered capability enable a further authorized action?
Exposed token-signing material
Material that can inform token-related testing
Does the application accept a derived token at a vulnerable privileged function?
Broken object-level access control
Another user’s resource identifier
Does a different function improperly trust the same identifier?
A credential embedded in a mobile build
A value available to someone inspecting the package
Is that value observed at an endpoint with a qualifying runtime finding?
MOBILE EVIDENCE
Supported mobile chains bring static and runtime evidence into a common investigation. Suitable first-party traffic and qualifying destination findings are required.
Evidence available
Connection Ares can record
Important limit
SAST finding plus device-session traffic
A credential identified in the build is observed in use at an endpoint with a qualifying runtime finding.
Presence in traffic does not prove the credential was necessary.
Captured first-party responses and later requests
A disclosed value appears in a later request associated with another qualifying finding.
Only supported captured relationships establish the link.
Static analysis only
Package findings can identify exposures for further investigation.
No capture-derived mobile chain is established.
INVESTIGATE AND REMEDIATE
Review severity alongside a weakness’s role in the demonstrated sequence, business impact, remediation effort, and operational constraints.
Step
Your team’s next action
01 / Authorize
Define targets, test identities, and enabled capabilities. A discovery does not expand permission.
02 / Investigate
Let supported tests examine the target and verify candidate findings.
03 / Follow
Carry supported recovered capabilities into relevant follow-on work.
04 / Review
Inspect linked findings, observed and inferred connections, and supporting exchanges where available.
05 / Reassess
Fix relevant weaknesses, repeat the assessment, and check whether the demonstrated behavior remains reproducible.
Interrupting one displayed sequence does not eliminate alternative paths or independent vulnerabilities. The absence of a chain does not make individual findings harmless.
TALK TO ASSAIL
Understand the exposure between the findings.
See what an initial weakness enables and give your team a clearer basis for deciding what to fix first.
Your environment. Your objectives. A mission built around both.