Security Glossary: Pentest & Cybersecurity Terms Explained

Testing & engagement

These terms describe what a penetration test is, what it produces, and how the process works from scoping to re-test.

• Penetration test — An authorized, simulated attack against a system to find and safely prove exploitable weaknesses before real attackers do.
• Vulnerability — A flaw in code, configuration, or design that can be abused to break confidentiality, integrity, or availability.
• Exploit — A specific technique or piece of code that turns a vulnerability into a real, working attack.
• Attack surface — The sum of all points where an attacker could get in: exposed URLs, APIs, ports, forms, and third-party integrations.
• Threat model — A structured map of what you protect, who might attack it, and how — used to prioritize testing and defenses.
• False positive — A finding flagged as a vulnerability that is not actually exploitable; manual verification separates these from real risk.
• Re-test — A follow-up test after fixes are applied to confirm vulnerabilities are genuinely closed, not just hidden.
• Hardening — Reducing attack surface by disabling unused features, tightening configuration, and applying secure defaults.
• Pentest report — The deliverable: an evidence-backed list of findings with severity, reproduction steps, business impact, and concrete remediation.

Common vulnerabilities

The vulnerability classes you will see most often in web and API testing, mostly drawn from the OWASP Top 10 and OWASP API Security Top 10.

• XSS (Cross-Site Scripting) — Injecting attacker-controlled JavaScript into a page so it runs in other users' browsers, stealing sessions or data.
• SQL injection — Manipulating a database query through unsanitized input to read, alter, or destroy data (OWASP A03: Injection).
• IDOR / BOLA — Broken Object-Level Authorization: changing an ID in a request to access another user's data (OWASP API1).
• CSRF (Cross-Site Request Forgery) — Tricking a logged-in user's browser into sending an unwanted authenticated action.
• SSRF (Server-Side Request Forgery) — Forcing the server to make requests to internal systems or cloud metadata an attacker can't reach directly (OWASP A10).
• RCE (Remote Code Execution) — The most severe class: running arbitrary commands on the target server.
• Zero-day — A vulnerability exploited before the vendor has a patch, leaving defenders zero days to prepare.

Standards & scoring

How the industry names, rates, and methodically tests vulnerabilities. These references make findings comparable across vendors and tools.

• CVE — Common Vulnerabilities and Exposures: a unique public identifier (e.g. CVE-2021-44228, Log4Shell) for a specific known vulnerability.
• CVSS — Common Vulnerability Scoring System: a 0.0–10.0 severity score mapped to None/Low/Medium/High/Critical.
• OWASP Top 10 — The industry-standard list of the ten most critical web application security risks, updated periodically.
• OWASP WSTG / ASVS — Web Security Testing Guide (the how-to methodology) and Application Security Verification Standard (the requirements checklist).
• PTES — Penetration Testing Execution Standard: a phased methodology from pre-engagement and intelligence gathering through to reporting.
• NIST — U.S. standards body; its SP 800-115 (testing) and Cybersecurity Framework (risk) are common industry references.
• ISO 27001 — International standard for an Information Security Management System (ISMS); certification signals audited security governance.

Infrastructure & defenses

The controls that protect data in transit and at the perimeter. Note that most are mitigations that reduce risk — they do not replace fixing the underlying vulnerability.

• WAF (Web Application Firewall) — A filter in front of a web app that blocks common malicious requests; a mitigation, not a fix.
• TLS/SSL — Encryption protecting data in transit (HTTPS); TLS is the modern protocol, SSL its deprecated predecessor.
• HSTS — HTTP Strict Transport Security: a response header forcing browsers to use HTTPS only, preventing downgrade attacks.
• MFA — Multi-Factor Authentication: requiring a second proof (app code, hardware key) beyond a password.

Compliance & regulation

The EU rules that increasingly drive why organizations commission a pentest in the first place — data protection and incident-reporting obligations.

• GDPR / RODO — EU General Data Protection Regulation (RODO in Polish); governs personal-data handling and imposes breach-notification duties.
• NIS2 — EU directive raising cybersecurity and incident-reporting obligations for essential and important entities across many sectors.

FAQ