Cybersecurity, VAPT & Compliance Glossary
This glossary defines the security testing, application security, compliance and audit terms used across our services and guides — from VAPT and SBOM to ISMS, SOC 2 and ITGC.
A
- Active Directory penetration testing
- Testing of a Microsoft Active Directory environment for misconfigurations and privilege-escalation paths that let an attacker move from a normal account to domain administrator. Learn more about Active Directory penetration testing
- Application security (AppSec)
- The practice of finding, fixing and preventing security weaknesses in software through secure design, code review, testing (SAST, DAST, SCA, penetration testing) and secure development processes. Learn more about Application security
- Attack surface
- The total set of points — applications, APIs, services, devices and people — where an attacker could try to enter or extract data from an environment.
B
- Black box penetration testing
- Penetration testing with no prior knowledge of the target, simulating an external attacker. Learn more about Black box penetration testing
- Breach and attack simulation (BAS)
- Automated tooling that continuously replays known attacker techniques against an environment to check whether security controls detect and block them.
C
- CIS Benchmarks
- Consensus secure-configuration guidelines published by the Center for Internet Security for operating systems, cloud platforms and software.
- CMMC
- Cybersecurity Maturity Model Certification — the U.S. Department of Defense programme that verifies contractors protect federal contract information and controlled unclassified information. Learn more about CMMC
- Compliance gap assessment
- A review that compares current policies, controls and evidence with the requirements of a standard or regulation and produces a prioritised remediation plan. Learn more about Compliance gap assessment
- Continuous security testing
- An ongoing programme of automated scanning and periodic manual testing that assesses new releases and assets throughout the year rather than once.
- CVE
- Common Vulnerabilities and Exposures — the public catalogue that assigns a unique identifier to each publicly disclosed security vulnerability.
- CVSS
- Common Vulnerability Scoring System — an open standard maintained by FIRST that scores vulnerability severity from 0.0 to 10.0. Learn more about CVSS
- CWE
- Common Weakness Enumeration — a catalogue of software and hardware weakness types, such as CWE-79 (cross-site scripting).
- Cyber Essentials
- A UK government-backed certification scheme that verifies five basic technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Learn more about Cyber Essentials
D
- DAST
- Dynamic application security testing — automated testing of a running application from the outside to find vulnerabilities such as injection and misconfiguration. Learn more about DAST
- DevSecOps
- The integration of security practices and automated security testing into DevOps pipelines so security is built into every stage of software delivery. Learn more about DevSecOps
- DPIA
- Data protection impact assessment — a GDPR process for identifying and minimising the privacy risks of processing that is likely to be high risk. Learn more about DPIA
E
- Essential Eight
- Eight prioritised mitigation strategies from the Australian Signals Directorate, measured against a maturity model from Level Zero to Level Three. Learn more about Essential Eight
- External penetration testing
- Penetration testing of internet-facing systems such as websites, VPNs, email and exposed services, from an outside attacker’s perspective. Learn more about External penetration testing
G
- GRC
- Governance, risk and compliance — a coordinated approach to setting security direction, managing risk and meeting regulatory and contractual obligations. Learn more about GRC
- Grey box penetration testing
- Penetration testing with partial knowledge, typically user credentials and some documentation, balancing realism, depth and cost.
I
- IDOR
- Insecure direct object reference — an access-control flaw where changing an identifier in a request exposes another user’s data.
- Internal audit
- An independent review, commissioned by the organisation itself, that tests whether controls are designed and operating effectively before an external audit. Learn more about Internal audit
- Internal penetration testing
- Penetration testing from inside the network, simulating an attacker or malicious insider who already has a foothold. Learn more about Internal penetration testing
- ISMS
- Information security management system — the policies, processes, roles and controls an organisation uses to manage information security risk, as defined by ISO 27001. Learn more about ISMS
- ISO/IEC 27001
- The international standard for an information security management system, with 93 reference controls in Annex A; it can be independently certified. Learn more about ISO/IEC 27001
- ITGC
- IT general controls — controls over access to programs and data, program changes, program development and computer operations that support reliable systems. Learn more about ITGC
M
- MITRE ATT&CK
- A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used for threat modelling and red teaming.
N
- NIST Cybersecurity Framework (NIST CSF)
- A framework of cybersecurity outcomes organised into six functions in version 2.0: Govern, Identify, Protect, Detect, Respond and Recover. Learn more about NIST Cybersecurity Framework
O
- OWASP Top 10
- The Open Worldwide Application Security Project’s list of the ten most critical web application security risks. Learn more about OWASP Top 10
P
- PCI DSS
- The Payment Card Industry Data Security Standard, which sets security requirements — including penetration testing — for organisations that handle payment card data. Learn more about PCI DSS
- Penetration testing
- An authorised, simulated cyber attack in which security testers attempt to exploit vulnerabilities to prove real-world impact and recommend fixes. Learn more about Penetration testing
- Purple teaming
- A collaborative exercise in which attackers (red team) and defenders (blue team) work together to test and improve detection and response. Learn more about Purple teaming
R
- Red teaming
- Goal-based adversary emulation that tests an organisation’s ability to detect and respond to a realistic, stealthy attacker across people, process and technology. Learn more about Red teaming
- Risk assessment
- The process of identifying assets, threats and vulnerabilities and estimating likelihood and impact to prioritise security controls. Learn more about Risk assessment
S
- SAST
- Static application security testing — analysis of source code for insecure coding patterns without running the application. Learn more about SAST
- SBOM
- Software bill of materials — a machine-readable inventory of every component, version and licence in a piece of software. Learn more about SBOM
- Security controls assessment
- An evaluation of whether security controls are correctly designed, implemented and operating effectively. Learn more about Security controls assessment
- SOC 2
- An AICPA attestation report on a service organisation’s controls against the Trust Services Criteria; Type 1 covers design, Type 2 covers operating effectiveness over a period. Learn more about SOC 2
- Software composition analysis (SCA)
- The practice of identifying open-source and third-party components in software and checking them for known vulnerabilities and licence risks. Learn more about Software composition analysis
- SSL pinning
- A mobile app technique that only trusts specific certificates or keys, making interception harder; testers check whether it is implemented and can be bypassed. Learn more about SSL pinning
- SSRF
- Server-side request forgery — a flaw where an attacker makes the server send requests to internal systems or cloud metadata services.
- Statement of Applicability (SoA)
- The ISO 27001 document that lists each Annex A control, whether it applies, and the justification for including or excluding it. Learn more about Statement of Applicability
T
- Third-party risk assessment
- An evaluation of the security and compliance risk that vendors and suppliers introduce to an organisation. Learn more about Third-party risk assessment
V
- VAPT
- Vulnerability assessment and penetration testing — a combined security test that finds weaknesses and safely exploits them to prove impact. Learn more about VAPT
- Vulnerability assessment
- A systematic review that identifies, classifies and prioritises security weaknesses, largely with automated scanning validated by experts. Learn more about Vulnerability assessment
- Vulnerability management
- The continuous cycle of discovering assets, scanning, prioritising, remediating and verifying vulnerabilities. Learn more about Vulnerability management
W
- White box penetration testing
- Penetration testing with full knowledge of the target, including source code and architecture, for maximum depth.
X
- XSS
- Cross-site scripting — an injection flaw that lets attackers run malicious scripts in other users’ browsers.
Let’s find the gaps before someone else does.
Tell us what you need tested for a fixed-scope quote, or talk it through with an Aesparrow practitioner — no obligation, no sales script.