The cybersecurity glossary, defined clearly.

Dynamic Application Security Testing

Tests a running application from the outside, like an attacker, without access to source code.

Static Application Security Testing

Analyzes source code or bytecode for vulnerabilities without running the application.

Interactive Application Security Testing

Instruments a running application to observe code behavior during tests.

Runtime Application Self-Protection

Runtime instrumentation that detects and blocks attacks against a live application.

Software Composition Analysis

Identifies open-source dependencies and their known vulnerabilities and licenses.

A simulated attack against a system to find and demonstrate exploitable vulnerabilities.

Vulnerability Assessment and Penetration Testing

A combined approach: broad vulnerability assessment plus deeper penetration testing.

Systematic identification and prioritization of vulnerabilities across a target.

AI agents that investigate, chain, and exploit vulnerabilities without human intervention.

Ongoing, automated penetration testing that runs as the application changes.

Web Application Firewall

Filters and monitors HTTP traffic to block common web attacks at the network edge.

Attack Surface Management

Continuous discovery, inventory, and monitoring of an organization's attack surface.

Application Security Posture Management

Aggregates and correlates application security findings to manage overall posture.

Cloud-Native Application Protection Platform

A consolidated platform combining cloud posture, workload, entitlement, and more.

Cloud Security Posture Management

Detects misconfigurations and compliance gaps across cloud environments.

Cloud Workload Protection Platform

Secures workloads - VMs, containers, and serverless - across their lifecycle.

Cloud Infrastructure Entitlement Management

Manages and least-privileges identities and permissions in cloud environments.

Cyber Asset Attack Surface Management

Builds a unified asset inventory by integrating with existing tools via APIs.

The full set of points where an attacker could attempt to enter or extract data.

A sequence of steps an attacker links together to move from entry to impact.

Open Worldwide Application Security Project

A nonprofit community producing free application-security resources and standards.

Common Vulnerabilities and Exposures

A public catalog of identifiers for specific known vulnerabilities.

Common Weakness Enumeration

A categorized list of software and hardware weakness types.

Common Attack Pattern Enumeration and Classification

A catalog of common attack patterns used to exploit weaknesses.

A knowledge base of real-world adversary tactics and techniques.

Common Vulnerability Scoring System

A standard for scoring the severity of vulnerabilities from 0 to 10.

Offensive security group that emulates real adversaries to test detection and response.

Defensive security group responsible for detection, response, and hardening.

A collaborative exercise where red and blue teams work together to improve defenses.

A program that rewards independent researchers for responsibly reporting vulnerabilities.

Integrates security into every stage of the software development lifecycle.

Moving security testing earlier in the development lifecycle.

Secure Software Development Lifecycle

Embedding security activities into each phase of software development.

Systematically identifying threats and weaknesses in a system's design.

A model that trusts no request by default and verifies every access explicitly.