Security terms

The practice of safely attacking an environment to prove which exposures are genuinely exploitable, replacing severity-score guesswork with direct evidence. It absorbed breach-and-attack simulation and automated pen testing as a category.

A measure of how much an organization depends on a given asset — what breaks and who notices if it's compromised — turning an identical vulnerability into different priorities depending on where it sits.

The sequence of steps an attacker chains together to move from an initial foothold to something valuable. Each step looks minor alone; the real risk lives in the chain.

AI-driven systems that carry a validated exposure through to a fix with little human authoring — diagnosing the change, predicting side effects, and confirming it applied correctly.

Builds an accurate, de-duplicated inventory of everything an organization owns by consolidating data from existing systems like CMDBs, cloud APIs, identity providers and scanners, rather than deploying new agents.

An interim measure — like a WAF virtual patch, IPS block or segmentation — that reduces the likelihood or impact of exploitation while the underlying vulnerability remains unfixed.

A repeating five-phase program for finding, proving, prioritizing and fixing what an attacker could actually exploit, rather than just listing every vulnerability. Scoping and mobilization are where most programs stall.

A unique identifier (CVE-YYYY-NNNNN) assigned to a specific publicly known software weakness, giving every tool and team a shared reference number for the same flaw.

A 0–10 severity score, maintained by FIRST, describing how bad a vulnerability is in the abstract. It reflects a flaw's properties, not any particular organization's actual risk.

Managing detection rules as version-controlled software artifacts — reviewed, tested and deployed through a pipeline — instead of hand-authored in a SIEM console.

A probability score estimating the likelihood a given vulnerability will be exploited in the wild within the next 30 days, offering a forward-looking complement to static severity scores.

A platform that continuously discovers and prioritizes exposures across vulnerabilities, misconfigurations and other weaknesses using threat intel, asset context and existing controls. It's the tooling layer that supports a CTEM program.

The broader practice of proving whether an exposure is genuinely exploitable in a specific environment, combining cheap reachability filtering with adversarial or predictive proof for what survives.

The period during which an exposure is both present and exploitable in an environment, from becoming reachable to being verifiably closed — a measure of risk carried, not response speed.

Determines whether the specific vulnerable function inside a dependency is actually called by an application's code, distinguishing installed risk from exercised risk.

CISA's authoritative public catalog of vulnerabilities confirmed to have been exploited in the wild. Inclusion means exploitation has been observed, not merely predicted.

A publicly maintained knowledge base of real-world adversary tactics and techniques, giving defenders a shared vocabulary for describing and measuring detection coverage.

The fifth and final CTEM phase: getting validated exposures actually remediated by the teams that own them, covering ownership, routing, approval, execution and proof of closure.

Determining who is currently accountable for an asset, repository or service accurately enough to route a fix to them, inferred from behavioral evidence rather than stale declared fields.

Determines whether a vulnerability can actually be reached in a specific environment — over the network, in code, or by attacker-controlled data. It's the filter that makes exposure management tractable by ruling out findings that don't matter.

A structured inventory of the components, versions, suppliers and relationships inside a piece of software — the manifest that documents what's actually shipping in a build.

Inventories the open-source and third-party dependencies inside an application and matches them against known vulnerabilities and license obligations.

Technology in use inside an organization that was never provisioned, recorded or approved through standard process, yet exists and operates outside the systems meant to track it.

An open, vendor-neutral YAML format for writing detection rules that can be compiled into the query language of whichever SIEM an organization runs.