Phase 6
Exit
Exit is the controlled end of the operation. The team leaves cleanly, removes temporary artifacts, recovers equipment, and closes active access without creating new problems.
Purpose
A sloppy exit can damage the client more than the finding itself. The engagement should end with the environment stable, evidence preserved, and urgent issues flagged quickly.
In Practice
Exit includes equipment accountability, credential handling, cleanup of temporary access, and immediate notification if the team found something that cannot wait for the final report.