This glossary defines the key terms of enterprise cybersecurity in plain language. It covers core concepts such as penetration testing, vulnerability management, threat intelligence, and compliance frameworks. Designed for security teams, IT managers, and business leaders who need accurate, jargon-free definitions to make informed security decisions.
PTaaS (Pentest as a Service)
PTaaS (Penetration Testing as a Service) is a model of continuous penetration testing delivered through a cloud platform. It combines manual testing performed by experts with on-demand monitoring, instead of a single annual report. It allows vulnerabilities to be detected and fixed on an ongoing basis.
Pentest (Penetration Test)
A pentest or penetration test is a simulated and authorized attack against a system, application or network to identify vulnerabilities before real attackers do. Specialists exploit the flaws they find to measure their real impact and deliver prioritized remediation recommendations.
Red Team
The Red Team is a group of specialists that simulates real, advanced attacks against an organization to assess its detection and response capabilities. Unlike a traditional pentest, it emulates the tactics, techniques and procedures of real adversaries, including social engineering and long-term persistence.
Blue Team / Purple Team
The Blue Team is the defensive team responsible for detecting, containing and responding to attacks, managing monitoring, alerts and security controls. The Purple Team is the collaboration model between the offensive Red Team and the defensive Blue Team, where both share findings to improve the security posture.
AppSec (Application Security)
AppSec or Application Security is the discipline focused on protecting software applications throughout their entire lifecycle, from design to operation. It includes practices such as code review, security testing, dependency management and remediation of vulnerabilities in the developed software.
DevSecOps
DevSecOps is the practice of integrating security in an automated and continuous way within the development and operations (DevOps) lifecycle. Its goal is to embed security controls from the earliest stages of development, instead of checking them only at the end, reducing the cost and time of remediation.
OWASP Top 10
The OWASP Top 10 is a standard awareness document produced by the OWASP organization that lists the ten most critical security risks for web applications. It serves as a baseline reference for developers and security teams when prioritizing the prevention of the most common and dangerous vulnerabilities.
CVE
CVE (Common Vulnerabilities and Exposures) is a public system of unique identifiers for known security vulnerabilities. Each CVE assigns a standard code to a specific flaw, allowing organizations around the world to refer to the same vulnerability consistently and coordinate its remediation.
CVSS
CVSS (Common Vulnerability Scoring System) is an open standard for rating the severity of vulnerabilities on a scale from 0 to 10. It considers factors such as the ease of exploitation and the potential impact, helping teams prioritize which flaws to fix first based on their real criticality.
Vulnerability Management
Vulnerability management is the continuous process of identifying, classifying, prioritizing and remediating security weaknesses in systems and applications. It includes periodic scanning, risk assessment of each finding and tracking its correction through to closure, reducing the attack surface.
Zero-day
A zero-day vulnerability is a security flaw unknown to the software vendor and for which no patch is yet available. Attackers who discover it can exploit it before any defense exists, which makes them one of the most dangerous and hardest to mitigate threats.
Social Engineering
Social engineering is the set of techniques that psychologically manipulate people into revealing confidential information or performing unsafe actions. Phishing, pretexting and vishing are common examples. It exploits human trust rather than technical flaws, so awareness is key to preventing it.
SAST / DAST
SAST (Static Application Security Testing) analyzes source code at rest to detect vulnerabilities without running the application. DAST (Dynamic Application Security Testing) tests the running application, simulating external attacks. Both techniques are complementary and are used together for more complete coverage.
ISO 27001 / PCI-DSS / SOC 2
ISO 27001 is the international standard for information security management systems. PCI-DSS is the standard that protects payment card data. SOC 2 is an audit framework that evaluates the security controls of service providers. All three are key references for compliance and enterprise trust.