Platform
Vulnerability Management
Scan, prioritize, remediate
AI Security Automation
Act faster
Attack Surface Management
Detect changes and hidden assets
Integrations
Compliance and workflow management
Cloud Security
Daily config checks
Solutions
External Scanning
Infrastructure security
Attack Surface Monitoring
Respond to changes
DAST
Secure web apps
Website Security
140k+ checks
Risk Based Prioritization
No more alert fatigue
API Security
Test your APIs
Asset Discovery
Reveal unknown targets
Emerging Threat Detection
Check and act fast
CSPM
Daily cloud config checks
Compliance
SOC 2, ISO, HIPAA, DORA
Cyber Hygiene Reporting
Demonstrate progress
Internal Scanning
Secure employee devices
Case Studies
Pricing
Resources
Free Tools
cvemon
Vulnerability intel
Autoswagger
Check for API auth flaws
Security
Security Research
Insights from our experts
Cyber Resource Hub
Guides & videos
Cyber Glossary
Learn the lingo
Customers
Help Center
FAQs & tutorials
Developer Hub
APIs & integrations
Trust Center
Security & compliance
Company
About Intruder
History and mission
Press
News and interviews
Partner Program
Become a reseller
Careers
Work with us
Contact
Get in touch
Try free
Log in
Log in
Try for free
Cybersecurity Glossary
a
b
c
d
e
f
g
h
i
j
k
l
m
n
o
p
q
r
s
t
u
v
w
x
y
z
a
a
a
advanced persistent threat (APT)
advanced persistent threat (APT)
A sophisticated, targeted cyberattack in which an attacker gains unauthorized access to a network and remains undetected for an extended period.
application security
application security
Application security is the set of processes, tools, and controls used to keep software safe from attack.
asset discovery
asset discovery
The process of identifying unknown external assets within your environment.
attack surface
attack surface
An attack surface is the sum total of all possible paths that can be used to exploit a computer system or network.
attack surface reduction (ASR)
attack surface reduction (ASR)
The practice of minimizing the number of potential entry points that attackers could use to compromise your systems.
authenticated scanning
authenticated scanning
A type of external vulnerability scan that tests the security of web applications and APIs behind logins. Also known as credentialed scanning.
automated security testing
automated security testing
Automated security testing is the use of software tools to run repeatable security checks
b
b
b
brute force attack
brute force attack
A hacking method that uses trial and error to guess possible passwords or encryption keys until the correct one is found.
c
c
c
cloud security posture management (CSPM)
cloud security posture management (CSPM)
CSPM stands for Cloud Security Posture Management. It’s a type of tool that helps keep cloud environments safe by checking how they’re set up.
cloud-native application protection platform (CNAPP)
cloud-native application protection platform (CNAPP)
A unified security solution that protects cloud-native applications across their entire lifecycle.
common vulnerabilities and exposures (CVE)
common vulnerabilities and exposures (CVE)
A system that gives a unique name to publicly known cyber security issues.
common vulnerability scoring system (CVSS)
common vulnerability scoring system (CVSS)
A standardized framework used to measure the severity of security vulnerabilities.
common weakness enumeration (CWE)
common weakness enumeration (CWE)
A community-developed list of common software and hardware security weaknesses.
container security
container security
Container security is the set of controls and processes used to protect containerized applications and their infrastructure throughout the software lifecycle.
continuous threat exposure management (CTEM)
continuous threat exposure management (CTEM)
A cyber security framework focused on continuously identifying, assessing, and reducing your organization's exposure to real-world threats.
credentialed scanning
credentialed scanning
A type of external vulnerability scan that tests the security of web applications and APIs behind logins. Also known as authenticated scanning.
cross-site request forgery (CSRF)
cross-site request forgery (CSRF)
A type of web application vulnerability that allows attackers to trick users into performing actions they didn’t intend.
cyber configuration management
cyber configuration management
Cyber configuration management is the practice of setting, tracking, and enforcing secure configuration settings across IT assets to keep them consistent and resilient against attack.
cyber hygiene
cyber hygiene
Cyber hygiene is the ongoing set of routine actions that keep your IT environment secure, resilient, and harder to compromise.
cybersecurity maturity
cybersecurity maturity
Cybersecurity maturity describes how well an organization’s security capabilities are defined, implemented, measured, and continuously improved over time.
cybersecurity posture
cybersecurity posture
Cybersecurity posture is the real-world snapshot of how prepared an organization is to defend its systems, data, and users from threats.
d
d
d
dynamic application security testing (DAST)
dynamic application security testing (DAST)
A method of cyber security testing in which a running application is actively tested and probed using real traffic and requests.
e
e
e
endpoint security
endpoint security
The process of protecting user devices (e.g. laptops and mobile devices) from threats such as malware, ransomware, and zero-days.
ethical hacking
ethical hacking
An authorized attempt to gain unauthorized access to a computer system, application, or data.
exploit
exploit
An exploit is a piece of code, technique, or method that attackers use to take advantage of a security vulnerability in a system, application, or network
exploit prediction scoring system (EPSS)
exploit prediction scoring system (EPSS)
The Exploit Prediction Scoring System is a data-driven model for estimating how likely it is that a given software vulnerability will be exploited in the wild.
external attack surface management (EASM)
external attack surface management (EASM)
The continuous process of detection, evaluation, and mitigation of attack vectors which are accessible from the internet.
f
f
f
g
g
g
h
h
h
i
i
i
identity and access management (IAM)
identity and access management (IAM)
The framework of policies, technologies, and processes that ensures the right individuals in an organization have appropriate access to resources.
j
j
j
k
k
k
kubernetes security
kubernetes security
Kubernetes security is the set of controls and processes that protect a Kubernetes cluster, its workloads, and its supporting infrastructure from misconfiguration, abuse, and attack.
l
l
l
local file inclusion (LFI)
local file inclusion (LFI)
A web application vulnerability that allows attackers to include and access files on a server by manipulating input fields or URL parameters.
m
m
m
malware
malware
Malware refers to any software intentionally designed to harm, exploit, or otherwise compromise a device, system, or network.
multi-factor authentication (MFA)
multi-factor authentication (MFA)
A security process that requires users to provide two or more verification factors to gain access to a system, application, or account.
n
n
n
national institute of standards and technology (NIST)
national institute of standards and technology (NIST)
A U.S. government agency that develops and promotes measurement standards and best practices across science, technology, and industry.
o
o
o
open worldwide application security project (OWASP)
open worldwide application security project (OWASP)
A nonprofit foundation that works to improve software security by providing free, vendor-neutral tools, documentation, and standards for developers and security professionals.
p
p
p
penetration testing
penetration testing
A security process that simulates real-life attacks on your IT systems to find weaknesses that could be exploited by hackers.
personally identifiable information (PII)
personally identifiable information (PII)
Any data that can be used to identify a specific individual.
q
q
q
r
r
r
ransomware
ransomware
A type of malicious software designed to block access to a victim's system or files, usually by encrypting them, until a ransom is paid.
remote code execution (RCE)
remote code execution (RCE)
A type of cyber security vulnerability that allows an attacker to run arbitrary code on a target system from a remote location.
risk-based vulnerability management (RBVM)
risk-based vulnerability management (RBVM)
An approach that prioritizes vulnerabilities based on real-world risk, not just technical severity.
s
s
s
secrets detection
secrets detection
Secrets detection is the process of identifying exposed or insecurely stored credentials in technical environments.
server-side template injection (SSTI)
server-side template injection (SSTI)
A web application vulnerability that occurs when user input is unsafely embedded into templates.
shadow IT
shadow IT
Hardware, software, or cloud services used within an organization without explicit approval or visibility from the IT or security team.
shift left security
shift left security
Shift left security means moving security activities earlier in the development lifecycle - toward planning, design, and coding rather than waiting for late-stage testing or production incidents.
single page application (SPA)
single page application (SPA)
A type of web application that loads a single HTML page and dynamically updates content without requiring a full page reload.
single sign-on (SSO)
single sign-on (SSO)
An authentication process that allows users to log in once and gain access to multiple applications or systems without needing to re-enter their credentials for each one.
sql injection (SQLi)
sql injection (SQLi)
A type of cyberattack where an attacker inserts malicious SQL code into a web application’s input field to interfere with its database.
subdomain takeover
subdomain takeover
When attackers claim an abandoned subdomain and use it to host malicious content or trick users into sharing sensitive information.
t
t
t
tactics, techniques, and procedures (TTPs)
tactics, techniques, and procedures (TTPs)
TTPs are commonly used in threat intelligence and cybersecurity frameworks like MITRE ATT&CK to categorize and track adversary behavior.
u
u
u
udp port scanning
udp port scanning
A type of network scanning that identifies open or closed User Datagram Protocol (UDP) ports on a system.
v
v
v
vulnerability management (VM)
vulnerability management (VM)
The continuous process of identifying, prioritizing, and managing vulnerabilities.
vulnerability scanning
vulnerability scanning
The use of software tools to identify and report on security issues that affect your systems.
w
w
w
web application firewall (WAF)
web application firewall (WAF)
A security tool that protects web applications by filtering and blocking malicious traffic before it reaches your site.
x
x
x
xss (cross-site scripting)
xss (cross-site scripting)
XSS stands for Cross-Site Scripting, a type of cyber attack where a hacker tricks a website into running harmful code in someone else’s browser.
y
y
y
z
z
z
zero-day vulnerability
zero-day vulnerability
A security flaw in software or hardware that the developer doesn't know about yet, so no fix exists at the time it’s discovered.
No results found.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Read our reviews on
G2.com
Sign up for your free 14-day trial
Start today