June 2026: Playbooks and Retest Rounds Arrive in Neuron

Ask a testing team for its methodology and you will usually get a document. Ask for evidence that it was followed on last month’s engagement and the answer takes longer. June was the month we set out to shorten that answer.

Methodology as something you run

Playbooks were the headline. We previewed them with a Playbooks spotlight (opens in a new tab) early in the month, then published the complete story at the end of June: how Playbooks turn your methodology into something your whole team can run (opens in a new tab).

Without something like this, coverage on any given engagement depends on which steps each tester happens to remember, and confirming a single test after the fact means digging through notes.

A playbook moves that methodology into the Library as structured sections and steps, with guidance written by the team and, where it helps, runnable commands linked from the Command Library so the instruction and the exact syntax sit together. Once approved through the same review process as findings, it is locked. Running it against an engagement turns it into a ledger: each step is pending, covered, raised as a finding, or marked not applicable with a reason that stays on record.

We also wrote a set of starter playbooks so teams do not begin from a blank page, covering well known frameworks such as PTES, NIST SP 800-115 and the OWASP API Security Top 10, as well as several adversary emulation plans.

Small details that matter on a team

Two parts of Playbooks came straight from thinking about several testers on one engagement. A step can be claimed with a single click, and everyone else sees the claim live, so two people do not test the same thing. And skipping a step always requires a reason. That makes coverage honest. A step marked not applicable counts as addressed, but anyone reviewing the engagement later can see why.

Coverage then flows into the engagement overview and into report templates, so the answer to what was tested can be part of the deliverable rather than a follow-up email.

Retest rounds

The other piece of work that landed in June was retest rounds. Last month we described why a retest deserves to be a record of its own. This month that became the working model in Neuron.

Each round now has its own dates, owner and selection of findings, and moves through review and approval before it closes. Teams can set a cosign policy by severity, so a fix to a critical finding needs a second tester to verify it. Once a round is submitted, its results are frozen, and every change along the way is logged. The retests page (opens in a new tab) walks through a round from planning to completion.

Proving the work

Playbooks and retest rounds look like separate features, but they answer the same client question in different moments. During the engagement: did you cover what you said you would? Afterwards: is it actually fixed, and who checked? In both cases the answer is now recorded as the work happens, instead of being assembled at the end.

The full write-ups are on neuron.ws/news (opens in a new tab). To see a playbook run against a real engagement, request a Neuron demo (opens in a new tab).