Glossary
23 terms we use precisely. Each links to a page that goes deeper.
- Adversarial exposure validation (AEV)
- Continuous testing of whether exposures are actually exploitable and whether controls detect them. Read more →
- Attack path
- A chain of exploitable steps from an entry point to a valuable asset. Read more →
- Attack success rate (ASR)
- Fraction of attack attempts that achieve their objective; meaningful only with an attempt budget and interval. Read more →
- Autonomous penetration testing
- Offensive testing where software agents plan and execute attacks and chain findings without step-by-step human direction. Read more →
- Base rate
- The prevalence of the condition being detected; it caps alert precision. Read more →
- Breach and attack simulation (BAS)
- Replay of scripted attacker techniques to test whether controls detect or block them. Read more →
- Breakout time
- Time from initial compromise to first lateral movement. Read more →
- Canary record
- Planted fake data whose retrieval proves access without touching real data. Read more →
- CTEM
- Continuous Threat Exposure Management: scoping, discovery, prioritization, validation, mobilization. Read more →
- CVSS
- Common Vulnerability Scoring System; a 0–10 severity score for vulnerabilities. Read more →
- EPSS
- Exploit Prediction Scoring System; estimated probability of exploitation activity in the next 30 days. Read more →
- Erlang C
- Queueing formula for the probability an arrival must wait when all servers are busy. Read more →
- Excessive agency
- An LLM application granting a model more permissions or autonomy than its task needs (OWASP LLM06). Read more →
- Exposure window
- Time between a weakness appearing and its verified fix. Read more →
- Indirect prompt injection
- Prompt injection delivered through content the model reads rather than from the user. Read more →
- Kill chain
- The sequence of stages an intrusion moves through, from reconnaissance to objective. Read more →
- NIS2
- EU directive on network and information security with 24h/72h/one-month incident reporting. Read more →
- Prompt injection
- Text that overrides or alters the instructions an LLM application intended the model to follow. Read more →
- Rules of engagement (RoE)
- The signed document defining scope, techniques, limits and contacts for a test. Read more →
- SOAR
- Security orchestration, automation and response; executes predefined playbooks. Read more →
- Threat-led penetration testing (TLPT)
- Intelligence-driven red teaming of live systems, required for designated entities under DORA. Read more →
- Tool poisoning
- Hiding instructions in tool metadata (e.g. MCP descriptions) that an AI agent will follow. Read more →
- Wilson interval
- A binomial confidence interval that remains accurate at small counts and rare events. Read more →
Find out what bad AI finds.
A 30-minute briefing with an operator. We'll scope a first engagement against one real system of yours and show you the findings format before you sign anything.