Cyber 101
AI Penetration Testing
AI penetration testing uses autonomous AI agents to run a penetration test. They map a target, probe it the way an attacker would, and confirm which weaknesses chain into an exploitable attack path, then hand each finding to your team to fix.
Read Full Definition →Alert Fatigue
Alert fatigue is the desensitization that occurs when security teams are overwhelmed by a high volume of alerts, many of which are false positives, low priority, or duplicative. It leads to slower response times, missed critical threats, and analyst burnout, effectively making your security tools less effective the more noise they produce.
Read Full Definition →Application Security Posture Management (ASPM)
Application security posture management (ASPM) unifies the findings from your application security tools (SAST, DAST, SCA, secrets, and container scanning) into one prioritized view of application risk, with consistent scoring and remediation, instead of a separate dashboard per tool.
Read Full Definition →Architecture mapping
Architecture mapping is the practice of creating a visual and data-driven representation of your organization's technology infrastructure, including applications, services, data flows, cloud resources, network connections, and their interdependencies. In a security context, architecture maps reveal how components connect, where data flows, which services are exposed, and how a compromise in one area could propagate to others.
Read Full Definition →Attack path analysis
Attack path analysis is the practice of mapping the chains of steps an attacker could follow through an environment, from an initial foothold, through privilege escalation and lateral movement, to a valuable target, so defenders can find and break the specific routes that lead to impact rather than treating every vulnerability as equally urgent.
Read Full Definition →Attack surface
An attack surface is the total set of points where an attacker can try to enter, extract data from, or cause damage to your systems. It includes every internet-facing application, API endpoint, cloud resource, user account, open port, third-party integration, and piece of infrastructure that is exposed to potential threats. The larger your attack surface, the more opportunities an attacker has to find a way in.
Read Full Definition →Attack Vector
An attack vector is the path or method an attacker uses to gain unauthorized access to a system, network, or application. Attack vectors describe how an attack enters your environment, whether through a phishing email, an unpatched vulnerability, a misconfigured cloud service, a compromised credential, or a malicious software dependency.
Read Full Definition →Breach and attack simulation (BAS)
Breach and attack simulation (BAS) is an automated, continuous way to test whether an organization's security controls actually work, by safely simulating the techniques real attackers use and checking whether the defenses detect or block each one.
Read Full Definition →Bug bounty
A bug bounty is a program in which an organization invites external security researchers to find and report vulnerabilities in its systems, and pays them a reward for each valid, previously unknown issue. Researchers only earn when they find something real, and the organization only pays for genuine findings.
Read Full Definition →CNAPP (Cloud-Native Application Protection Platform)
A Cloud-Native Application Protection Platform (CNAPP) is an integrated security platform that combines cloud security posture management (CSPM), cloud workload protection (CWPP), cloud infrastructure entitlement management (CIEM), and application security capabilities into a single, unified solution. Gartner, which coined the term, describes CNAPPs as "a unified and tightly integrated set of security and compliance capabilities designed to protect cloud-native infrastructure and applications" across their full lifecycle from development through runtime.
Read Full Definition →Code-to-Cloud
Code-to-cloud is a security approach that provides continuous visibility and protection across the entire software lifecycle, from the code a developer writes through the cloud infrastructure where it runs. It connects findings at each layer so you can trace a vulnerability from its origin in source code to its real-world exposure in production.
Read Full Definition →Compliance mandates
Compliance mandates are the regulatory requirements, industry standards, and contractual obligations that dictate how organizations must protect data, manage risk, and demonstrate security controls. For startups, compliance mandates typically include frameworks like SOC 2, ISO 27001, GDPR, and HIPAA, each with specific requirements that must be met to operate in certain markets, sell to certain customers, or handle certain types of data.
Read Full Definition →Container security
Container security is the practice of securing containerized applications across their lifecycle, the image, the registry, the orchestrator (like Kubernetes), the running container, and the host, so a vulnerability or misconfiguration in any layer cannot be used to compromise the workload or the systems around it.
Read Full Definition →Continuous penetration testing
Continuous penetration testing is penetration testing run as an ongoing service rather than a once-a-year event, so an application and its infrastructure are tested repeatedly, often triggered by changes, and newly introduced weaknesses are found in days rather than at the next annual assessment.
Read Full Definition →Cross-Site Scripting (XSS)
Cross-site scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users. When a victim's browser executes the injected script, the attacker can steal session tokens, redirect users to malicious sites, deface web content, or perform actions on behalf of the victim. XSS exploits the trust a user's browser places in the content delivered by your application.
Read Full Definition →CSPM (Cloud Security Posture Management)
Cloud Security Posture Management (CSPM) is a category of security tooling that continuously monitors your cloud infrastructure for misconfigurations, compliance violations, and security risks. CSPM tools scan environments like AWS, GCP, and Azure against security best practices and flag deviations before they become breaches.
Read Full Definition →CVE (Common Vulnerabilities and Exposures)
A CVE (Common Vulnerabilities and Exposures) is a unique identifier assigned to a publicly disclosed security vulnerability, following the format CVE-YEAR-NUMBER. The CVE Program, maintained by MITRE with funding from CISA and the U.S. Department of Homeland Security, provides a standardized naming system so that security teams, vendors, and tools can all refer to the same vulnerability unambiguously. Each CVE entry includes an ID, a description, and at least one public reference.
Read Full Definition →CVSS (Common Vulnerability Scoring System)
The Common Vulnerability Scoring System (CVSS) is a standardized framework for rating the severity of software vulnerabilities on a scale from 0.0 to 10.0. Maintained by the Forum of Incident Response and Security Teams (FIRST), CVSS provides a consistent language for communicating how severe a vulnerability is based on its technical characteristics, regardless of the specific product or environment affected.
Read Full Definition →DAST
Dynamic Application Security Testing (DAST) is a security testing method that analyzes a running application from the outside, simulating how an attacker would probe it for vulnerabilities. Unlike SAST, which examines source code, DAST tests the application in its deployed state by sending requests and analyzing responses to find issues like injection flaws, authentication weaknesses, and misconfigurations.
Read Full Definition →DevSecOps
DevSecOps is the practice of integrating security into every phase of the software development lifecycle rather than treating it as a separate step at the end. It extends the DevOps model of continuous integration and delivery by embedding automated security testing, vulnerability scanning, and compliance checks directly into development workflows and CI/CD pipelines, so security issues are caught and fixed during development instead of after release.
Read Full Definition →EASM
External Attack Surface Management (EASM) is the continuous process of discovering, inventorying, and monitoring all internet-facing assets that belong to your organization. EASM tools find what attackers can see from the outside, including domains, subdomains, APIs, cloud services, and exposed credentials, whether your team knows about them or not.
Read Full Definition →EPSS (Exploit Prediction Scoring System)
The Exploit Prediction Scoring System (EPSS) is a machine learning model that estimates the probability a published vulnerability will be exploited in the wild within the next 30 days. Maintained by FIRST, EPSS produces a daily score between 0 and 1 (expressed as a percentage) for every known CVE, helping security teams focus remediation on the vulnerabilities most likely to be used in real attacks rather than treating every high-severity finding as equally urgent.
Read Full Definition →Exploit
An exploit is a piece of code, a technique, or a sequence of commands that takes advantage of a vulnerability to cause unintended behavior in a system. Exploits are the mechanism through which vulnerabilities become actual security incidents, allowing attackers to gain unauthorized access, execute arbitrary code, escalate privileges, or steal data.
Read Full Definition →GDPR (General Data Protection Regulation)
The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union that governs how organizations collect, process, store, and protect the personal data of individuals in the EU and European Economic Area. GDPR applies to any organization worldwide that processes EU residents' data, regardless of where the organization is based.
Read Full Definition →GRC Tools
GRC tools are software platforms that help organizations manage their governance, risk, and compliance programs in a centralized system. For startups, GRC tools like Vanta, Drata, and Sprinto automate the evidence collection, policy management, and audit preparation required for frameworks like SOC 2 and ISO 27001.
Read Full Definition →HIPAA (Health Insurance Portability and Accountability Act)
HIPAA is a U.S. federal law that establishes national standards for protecting the privacy and security of individually identifiable health information. For technology companies, HIPAA's Security Rule and Privacy Rule define how protected health information (PHI) must be handled, requiring specific administrative, physical, and technical safeguards whenever a company creates, receives, maintains, or transmits health data.
Read Full Definition →IAM (Identity and Access Management)
Identity and access management (IAM) is a framework of policies, processes, and technologies that governs who can access what resources within an organization's systems and under what conditions. It covers the full identity lifecycle: creating accounts, assigning permissions, authenticating users, and revoking access when roles change or employees leave. Per NIST, IAM broadly refers to "the administration of individual identities within a system" to ensure that the right people have the right access to the right resources at the right time.
Read Full Definition →Incident Response
Incident response is the organized approach to preparing for, detecting, containing, and recovering from cybersecurity incidents. An incident response plan defines the people, processes, and tools needed to handle security events, from initial detection through post-incident analysis, minimizing damage and reducing recovery time.
Read Full Definition →Infrastructure as code (IaC) security
Infrastructure as code (IaC) security is the practice of finding and fixing security misconfigurations in the templates that define your cloud infrastructure, Terraform, CloudFormation, and Kubernetes manifests, before they are deployed, so a mistake is caught in a pull request rather than discovered live.
Read Full Definition →ISO 27001
ISO 27001 is the international standard for information security management systems (ISMS). Published by the International Organization for Standardization, it provides a framework for establishing, implementing, maintaining, and continuously improving how an organization manages security risks. Certification demonstrates to customers and partners that your security practices meet a globally recognized benchmark.
Read Full Definition →KEV (Known Exploited Vulnerabilities)
The Known Exploited Vulnerabilities catalog, commonly called KEV, is a curated list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) of software vulnerabilities with confirmed evidence of active exploitation in the wild. Unlike databases that list all known vulnerabilities, KEV only includes entries where exploitation has been verified, making it a high-signal source for prioritizing the vulnerabilities that attackers are actually using right now.
Read Full Definition →Lateral Movement
Lateral movement is the set of techniques attackers use to move through a network after gaining initial access, pivoting from one compromised system to another to reach higher-value targets. Rather than attacking their ultimate objective directly, attackers use lateral movement to escalate privileges, discover sensitive assets, and expand their foothold before executing their primary goal.
Read Full Definition →Malware
Malware is any software intentionally designed to cause harm to a computer, server, network, or user. Short for "malicious software," malware encompasses a broad category of threats including viruses, worms, trojans, ransomware, spyware, and adware, each with different infection methods, behaviors, and objectives ranging from data theft to system destruction.
Read Full Definition →MFA (Multi-factor Authentication)
Multi-factor authentication (MFA) is an authentication method that requires a user to verify their identity using two or more distinct types of authentication factors before gaining access to a system, application, or account. Per NIST SP 800-63B, the three recognized factor types are something you know (a password or PIN), something you have (a hardware token or mobile device), and something you are (a fingerprint or biometric); MFA requires at least two of these from different categories.
Read Full Definition →Misconfiguration
A misconfiguration is a security weakness caused by incorrect or suboptimal settings in your systems, applications, or cloud infrastructure. Misconfigurations are one of the most common and preventable causes of data breaches, often resulting from default settings left unchanged, overly permissive access controls, or human error during setup.
Read Full Definition →MITRE ATT&CK Framework
The MITRE ATT&CK framework is a publicly accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on documented real-world cyberattacks. Maintained by MITRE, a not-for-profit research organization, ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) provides a structured language for describing how attackers behave at each stage of a compromise, from initial access through impact.
Read Full Definition →Non-Human Identity (NHI)
A non-human identity (NHI) is any digital credential or authentication entity that operates without direct human control, including service accounts, API keys, OAuth tokens, machine certificates, and the credentials used by automated systems, bots, and AI agents to authenticate to other services. Managing and securing NHIs has become a critical and often overlooked dimension of identity security as the ratio of machine-to-human identities in modern software environments has grown dramatically.
Read Full Definition →Pen Testing
Penetration testing (pen testing) is a controlled, authorized attack against your systems conducted by security professionals to find exploitable vulnerabilities before real attackers do. Unlike automated scanning, pen testing involves human expertise to chain together weaknesses, test business logic, and simulate realistic attack scenarios against your applications, infrastructure, and processes.
Read Full Definition →Penetration Testing as a Service (PTaaS)
Penetration testing as a service (PTaaS) delivers penetration testing through a platform instead of a one-off annual engagement, so you scope, launch, retest, and report on tests in one place. It can be AI-led, human-led, or a combination.
Read Full Definition →Phishing
Phishing is a social engineering attack where adversaries impersonate trusted entities through email, text messages, phone calls, or fake websites to trick people into revealing sensitive information, clicking malicious links, or transferring money. It remains the most common initial attack vector for data breaches, bypassing technical security controls by targeting human judgment instead.
Read Full Definition →Proof of Exploit
Proof of exploit is concrete, reproducible evidence that a vulnerability is exploitable: the steps, the access or data it reaches, and the impact. It separates a confirmed risk from a theoretical one.
Read Full Definition →Ransomware
Ransomware is a type of malware that encrypts a victim's files, systems, or entire network and demands a ransom payment (typically in cryptocurrency) in exchange for the decryption key. Modern ransomware operations often employ "double extortion," stealing sensitive data before encryption and threatening to publish it if the ransom isn't paid.
Read Full Definition →Red teaming
Red teaming is a goal-based adversarial security exercise in which a team of ethical attackers attempts to achieve a specific objective against an organization's live defenses, to test not just whether vulnerabilities exist but whether the organization can detect and respond to a real attacker.
Read Full Definition →Risk-Based Vulnerability Management (RBVM)
Risk-based vulnerability management (RBVM) prioritizes vulnerabilities by the real-world risk they pose, using asset value, internet exposure, and exploit likelihood, rather than ranking by raw severity score. It turns thousands of findings into the short list that actually reduces risk.
Read Full Definition →SAST (Static Application Security Testing)
Static Application Security Testing (SAST) is a method of analyzing application source code, bytecode, or binaries for security vulnerabilities without executing the program. SAST tools scan your codebase for patterns that match known weaknesses like SQL injection, cross-site scripting (XSS), and hardcoded secrets.
Read Full Definition →SBOM (Software Bill of Materials)
A Software Bill of Materials (SBOM) is a machine-readable inventory of every software component, library, and dependency in your application, including their versions, suppliers, and relationships. Like an ingredients list for software, an SBOM provides transparency into what your application is actually built from, enabling faster vulnerability response, supply chain risk management, and compliance with emerging regulatory requirements.
Read Full Definition →SCA
Software Composition Analysis (SCA) is a security practice that identifies and manages the open-source and third-party components in your codebase. SCA tools inventory your dependencies, flag known vulnerabilities (CVEs) in those packages, surface licensing risks, and monitor for newly disclosed threats across your entire software supply chain.
Read Full Definition →Secrets Management
Secrets management is the practice of securely storing, accessing, distributing, and rotating sensitive credentials like API keys, database passwords, encryption keys, and access tokens. It replaces hardcoded credentials in source code and configuration files with centralized, auditable systems that control who and what can access each secret.
Read Full Definition →Security Questionnaire
A security questionnaire is a standardized set of questions that enterprise buyers use to evaluate the security posture of software vendors and service providers before entering a business relationship. Answering these questionnaires accurately and efficiently has become a recurring operational requirement for any startup selling into enterprise or regulated markets.
Read Full Definition →Security Silo
A security silo is a condition where security tools, teams, or data operate in isolation from each other, preventing the holistic visibility needed to understand and manage risk effectively. Siloed security means vulnerability data lives in one tool, cloud configuration findings in another, and compliance evidence in a third, with no unified view of how they connect or which risks matter most.
Read Full Definition →SIEM (Security Information and Event Management)
Security Information and Event Management (SIEM) is a category of security technology that collects, aggregates, and analyzes log data from across an organization's infrastructure to detect threats, support incident response, and meet compliance requirements. SIEM combines two older disciplines, security information management (SIM) and security event management (SEM), into a single platform that provides real-time monitoring, alerting, and historical log analysis.
Read Full Definition →SOC 2 Type 1
SOC 2 Type 1 is an audit that evaluates whether a service organization has designed and implemented security controls that meet the AICPA Trust Services Criteria at a specific point in time. Unlike SOC 2 Type 2, which tests whether controls operated effectively over a period (typically 6 to 12 months), Type 1 only assesses whether the right controls are in place on the audit date.
Read Full Definition →SOC 2 Type 2
SOC 2 Type 2 is an audit report that evaluates how effectively an organization's security controls operate over a period of time, typically 3 to 12 months. Issued by an independent auditor against the AICPA Trust Services Criteria, it provides prospective customers with evidence that your security practices actually work, not just that they exist on paper.
Read Full Definition →SQL Injection
SQL injection is a code injection attack where an attacker inserts malicious SQL statements into input fields or API parameters that get executed by your application's database. A successful SQL injection can allow attackers to read, modify, or delete data, bypass authentication, and in some cases execute commands on the underlying server.
Read Full Definition →Supply Chain Attack
A supply chain attack is a cyberattack that targets an organization indirectly by compromising a trusted vendor, tool, library, or dependency in its software supply chain. Rather than attacking the target directly, adversaries insert malicious code or access into upstream components that the target organization then unknowingly installs and runs. According to NIST, supply chain attacks are "attacks that allow the adversary to utilize implants or other vulnerabilities inserted prior to installation in order to infiltrate data, or manipulate hardware, software, operating systems, peripherals, or services at any point during the lifecycle."
Read Full Definition →Threat
A threat is any circumstance, event, or actor with the potential to cause harm to a system, organization, or data. In cybersecurity, threats encompass the full range of adversaries (nation-states, criminal groups, insiders), their methods (malware, phishing, exploitation), and the conditions (misconfigurations, unpatched systems) that could lead to a security incident.
Read Full Definition →Threat Hunting
Threat hunting is the proactive, analyst-driven practice of searching through systems and data for signs of malicious activity that automated security tools have missed. Unlike reactive monitoring that waits for alerts, threat hunters form hypotheses about potential attacker behavior and actively investigate logs, network traffic, and endpoints to find threats that have evaded existing detection rules.
Read Full Definition →Threat Intelligence
Threat intelligence is curated, contextual information about current and emerging threats, which vulnerabilities are being exploited and what techniques attackers use, so a team can prioritize and defend against what is actually happening, not just what is theoretically possible.
Read Full Definition →Threat Modeling
Threat modeling is a structured, proactive process for identifying and evaluating security risks in a system before attackers find them. It involves mapping how a system is built and how data flows through it, then systematically identifying where an attacker could cause harm and what controls would reduce that risk. According to OWASP, threat modeling "works to identify, communicate, and understand threats and mitigations within the context of protecting something of value."
Read Full Definition →User access review
A user access review is the periodic process of examining who has access to what systems, applications, and data within your organization, verifying that each person's access level is appropriate for their current role, and revoking access that is no longer needed. User access reviews are required by SOC 2, ISO 27001, HIPAA, and other compliance frameworks as a core identity and access management control.
Read Full Definition →Vulnerability
A vulnerability is a weakness or flaw in software, hardware, or a process that an attacker can exploit to gain unauthorized access, disrupt operations, or steal data. Vulnerabilities can exist in application code, system configurations, network architectures, or even organizational procedures, and they range from simple coding errors to complex design flaws.
Read Full Definition →Vulnerability Management
Vulnerability management is the continuous practice of finding security weaknesses across the software and infrastructure you run, prioritizing the ones that actually put you at risk, fixing them, and confirming they are gone.
Read Full Definition →Vulnerability Scanning
Vulnerability scanning is the automated process of probing your systems, networks, and applications to identify known security weaknesses. Scanners compare what they find against databases of known vulnerabilities (like the CVE list) and flag issues that need attention.
Read Full Definition →Zero Trust
Zero trust is a security model based on the principle that no user, device, or network connection should be automatically trusted, even inside the corporate network. Instead of relying on a secure perimeter, zero trust requires continuous verification of identity and authorization for every request to access resources, regardless of where the request originates.
Read Full Definition →Zero-Day Vulnerability
A zero-day vulnerability is a security flaw in software, hardware, or firmware that is unknown to the vendor and therefore has no available patch at the time it is discovered or exploited. The term "zero-day" refers to the zero days defenders have had to remediate it once an exploit begins circulating.
Read Full Definition →Take Fencer for a spin
Start a free trial in minutes, or book a demo for a guided tour.