Resources
Glossary
Offensive security terminology, defined plainly and without the vendor gloss.
- Attack surface
- Everything about a system that an attacker could interact with, including the parts nobody documented. It is almost always larger than the asset register suggests.
- Attack path
- The sequence of steps that carries an attacker from initial access to something worth reaching. Individual weaknesses matter mainly because of the paths they enable.
- Autonomous penetration testing
- Testing carried out by software that decides its own approach: forming a strategy, adapting when it fails, and chaining weaknesses, rather than executing a fixed checklist.
- Business logic flaw
- A weakness in how an application is supposed to work rather than how it was coded. Accepting a negative quantity at checkout is a logic flaw, and no signature database contains it.
- CVE
- Common Vulnerabilities and Exposures. A public identifier for a specific known vulnerability in a specific product.
- CVSS
- A scoring system that rates a vulnerability in the abstract. It cannot know whether your environment makes the issue unreachable or trivially exploitable.
- Exploit chain
- Several weaknesses combined into a route that reaches something none of them would reach alone. Chaining is the difference between a finding and an incident.
- False positive
- A reported issue that is not actually exploitable. Validating by exploitation removes most of them, because a finding is only reported once it has been demonstrated.
- Lateral movement
- Moving from one compromised system to others inside the same estate. Usually where a contained incident becomes an uncontained one.
- Penetration test
- An authorised simulated attack intended to find and demonstrate real weaknesses, as distinct from a scan that reports possible ones.
- Privilege escalation
- Gaining rights beyond those originally held, either as a higher-privileged user or as an administrator.
- Red team
- An engagement that emulates a real adversary against an organisation as a whole, typically including detection and response, rather than testing a defined system.
- Remediation
- Fixing the underlying cause of a finding, as opposed to suppressing the alert. A retest confirms the fix held.
- Retest
- Re-running a validated finding after remediation to confirm the path is genuinely closed rather than assumed closed.
- Scope
- The systems testing is authorised against, and the actions permitted. Declared before a mission runs, not worked out during it.
- Vulnerability scanner
- A tool that matches known signatures against systems and reports possible issues. It does not attempt exploitation, so it cannot tell you what is actually reachable.