Determine and set up attack vectors 2 1 Set up infrastructure and support 20 2 Attacking and reporting 5 3 Travel and hotel 50 Optional: presentation of findings 02 100