Cybersecurity Glossary: EASM, CTEM, Penetration Testing & Compliance Terms
Plain-language definitions of the terms security teams encounter across external attack surface management, continuous threat exposure management, penetration testing, managed web security, and compliance — written for practitioners, not marketers.
External Attack Surface Management
Discovering and monitoring what an attacker can see from outside your network.
External Attack Surface Management (EASM)
The continuous practice of discovering, inventorying, and monitoring an organization’s externally facing digital assets — domains, subdomains, cloud services, APIs, and certificates — from the same outside-in vantage point an attacker uses.
See how Teisoft’s EASM worksAttack Surface
The complete set of points where an unauthorized user could attempt to enter or extract data from an environment — every exposed domain, service, port, application, and credential an organization operates externally.
Related: External Attack Surface ManagementShadow IT
Technology assets — servers, cloud instances, SaaS subscriptions, or domains — that exist outside the visibility or approval of an organization’s IT and security teams, often created during rapid growth or decentralized purchasing.
Related: External Attack Surface ManagementDigital Footprint
The total collection of an organization’s online presence — owned domains, subdomains, social profiles, cloud infrastructure, and any other externally discoverable digital assets tied to its brand or infrastructure.
Related: External Attack Surface ManagementAsset Discovery
The process of identifying every digital asset an organization owns or operates — typically the first stage of an EASM or CTEM program — using techniques such as DNS enumeration, certificate log analysis, and cloud API queries.
Related: External Attack Surface ManagementSubdomain Enumeration
A discovery technique that identifies all subdomains associated with a primary domain, often revealing forgotten staging environments, legacy applications, or unmanaged infrastructure that expands an organization’s attack surface.
Related: Asset DiscoveryCertificate Transparency Log
A public, append-only record of all SSL/TLS certificates issued for a domain, used by security teams and attackers alike to discover subdomains and infrastructure that might otherwise remain hidden.
Related: Asset DiscoveryAttack Surface Reduction
The practice of systematically decommissioning, consolidating, or hardening externally facing assets to shrink the total number of exploitable entry points into an organization’s environment.
Related: External Attack Surface ManagementContinuous Threat Exposure Management
Prioritizing and validating which exposures actually matter.
Continuous Threat Exposure Management (CTEM)
A structured, five-stage security program — scoping, discovery, prioritization, validation, and mobilization — designed to continuously assess and reduce an organization’s exploitable exposure, rather than relying on periodic, point-in-time assessments.
See the Teisoft Exposure PlatformRisk-Based Vulnerability Management (RBVM)
An approach to vulnerability management that prioritizes remediation based on real-world exploitability and business impact — rather than severity score alone — combining threat intelligence, asset criticality, and exposure context.
See risk-based vulnerability managementAutomated Exposure Validation (AEV)
The use of safe, automated techniques to confirm whether a discovered vulnerability or exposure is actually exploitable in its real environment — distinguishing theoretical risk from validated, actionable risk.
See automated exposure validationRemediation Governance
The processes, ownership assignments, and service-level agreements that track a vulnerability from validated finding through to confirmed fix, ensuring exposures don’t remain open indefinitely after detection.
See remediation governanceCVSS (Common Vulnerability Scoring System)
An industry-standard framework that scores the technical severity of a vulnerability on a 0–10 scale based on factors like attack complexity and impact — without accounting for whether it is actively being exploited.
Related: Risk-Based Vulnerability ManagementEPSS (Exploit Prediction Scoring System)
A data-driven scoring model that estimates the probability a given vulnerability will be exploited in the wild within the next 30 days, used to complement CVSS for smarter prioritization.
Related: CVSSCISA KEV Catalog
The Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency, listing CVEs with confirmed evidence of active exploitation — often used as a mandatory remediation priority list.
Related: EPSSZero-Day Vulnerability
A software flaw that is unknown to the vendor and has no available patch at the time it is discovered or exploited, leaving defenders with no official fix to apply.
Related: CVSSPenetration Testing
Authorized, hands-on attacks that prove what’s actually exploitable.
Penetration Testing
An authorized, simulated cyberattack against a system, application, or network conducted by security professionals to identify and safely exploit vulnerabilities before real attackers do.
See Teisoft’s penetration testing servicesPTaaS (Penetration Testing as a Service)
A delivery model that replaces the traditional annual pentest with an ongoing subscription-based engagement, combining continuous automated scanning with periodic manual testing and a live reporting portal.
Read: PTaaS and compliance evidenceOWASP
The Open Worldwide Application Security Project, a nonprofit foundation that produces free, community-driven standards, tools, and documentation — including the widely referenced OWASP Top 10 — to improve software security.
Related: WSTGWSTG (Web Security Testing Guide)
OWASP’s comprehensive testing methodology that defines specific test cases and techniques for assessing the security of web applications, commonly used as a baseline scope for professional penetration tests.
See web application penetration testingBusiness Logic Vulnerability
A flaw in an application’s intended workflow — such as bypassing a payment step or manipulating a discount rule — that automated scanners typically cannot detect because the request itself appears technically valid.
See web application penetration testingBOLA (Broken Object Level Authorization)
An API vulnerability, ranked the top risk in the OWASP API Security Top 10, where a user can access or modify another user’s data by manipulating an object identifier in a request.
See API penetration testingRed Team
A group of security professionals who simulate real-world adversary tactics, techniques, and procedures against an organization — typically without prior knowledge of the target’s defenses — to test detection and response capabilities.
See penetration testing servicesPurple Team
A collaborative exercise where offensive (red team) and defensive (blue team) practitioners work together in real time, sharing findings as they occur to improve detection and response faster than a traditional engagement alone.
Related: Red TeamManaged Web Security
Ongoing protection and response for live web applications.
WAF (Web Application Firewall)
A security control that filters, monitors, and blocks HTTP traffic to and from a web application, defending against common attack patterns such as SQL injection and cross-site scripting.
See managed WAF & DDoS protectionDDoS (Distributed Denial-of-Service Attack)
An attack that overwhelms a target’s servers, network, or application with traffic from multiple sources simultaneously, aiming to disrupt availability rather than steal data.
See managed WAF & DDoS protectionBot Management
The practice of identifying and controlling automated traffic — distinguishing legitimate bots like search crawlers from malicious ones like scrapers and credential-stuffing tools — without disrupting real users.
See managed bot protectionSIEM (Security Information and Event Management)
A platform that aggregates and analyzes log and event data from across an organization’s infrastructure in real time, correlating signals to detect potential security incidents.
See security monitoring & alertingMTTR (Mean Time to Remediate)
A key security metric measuring the average time between when a vulnerability or incident is identified and when it is fully resolved, commonly used to gauge program maturity.
Related: Remediation GovernanceIncident Response (IR)
The organized process an organization follows to detect, contain, investigate, and recover from a security incident, typically guided by a documented plan and a defined response team.
See web application incident responseRate Limiting
A control that restricts the number of requests a user or system can make to an application within a given time window, commonly used to prevent abuse, brute-force attempts, and bot-driven traffic spikes.
See managed WAF & DDoS protectionFalse Positive (Security Monitoring)
An alert that flags legitimate, benign activity as a potential threat, requiring analyst time to investigate and dismiss — a major driver of alert fatigue in under-tuned monitoring programs.
See security monitoring & alertingCompliance
Frameworks and evidence auditors and underwriters actually ask for.
SOC 2
An auditing framework developed by the AICPA that evaluates a service organization’s controls related to security, availability, processing integrity, confidentiality, and privacy, resulting in a formal report used to demonstrate trust to customers.
Read Teisoft’s SOC 2 articlesPCI DSS
The Payment Card Industry Data Security Standard — a set of technical and operational requirements that organizations handling cardholder data must follow to protect payment information and reduce fraud.
Read Teisoft’s PCI DSS articlesQSA (Qualified Security Assessor)
An individual certified by the PCI Security Standards Council to formally assess and validate an organization’s compliance with PCI DSS requirements.
Read Teisoft’s PCI DSS articlesCyber Insurance
A policy that helps offset the financial impact of a cybersecurity incident — covering costs such as breach response, legal fees, and business interruption — typically requiring proof of specific security controls as a condition of coverage.
Read Teisoft’s cyber insurance articlesISO 27001
An international standard that specifies the requirements for establishing, implementing, and continually improving an information security management system (ISMS), often pursued as a formal certification.
See compliance penetration testingCDE (Cardholder Data Environment)
The people, processes, and technology that store, process, or transmit payment cardholder data, defining the specific scope that must be secured and tested under PCI DSS.
Read: reducing PCI DSS pentest scopeTrust Services Criteria
The set of principles — security, availability, processing integrity, confidentiality, and privacy — that auditors use to evaluate an organization’s controls during a SOC 2 examination.
Read Teisoft’s SOC 2 articlesAudit-Ready Evidence
Documentation and reporting — such as scan results, remediation logs, and validation reports — maintained continuously so it can be presented to an auditor or assessor without a scramble to reconstruct it after the fact.
Read: the one-team model for audit evidenceFrequently Asked Questions
What’s the difference between EASM and vulnerability scanning?
Vulnerability scanning checks a known list of assets for known flaws. EASM starts a step earlier — it discovers assets you may not know you have, continuously, from an attacker’s outside vantage point, before any scan can even begin.
What’s the difference between CVSS and EPSS?
CVSS scores how severe a vulnerability could theoretically be. EPSS estimates how likely it is to actually be exploited in the next 30 days. Used together, they separate “dangerous in theory” from “urgent in practice.”
What’s the difference between a penetration test and a red team engagement?
A penetration test looks for as many exploitable vulnerabilities as possible within a defined scope. A red team engagement simulates a specific real-world adversary, often testing detection and response rather than just finding flaws.
What’s the difference between SOC 2 and PCI DSS?
SOC 2 is a flexible trust-based framework covering security, availability, and related criteria for service organizations generally. PCI DSS is a prescriptive standard specifically for any organization that stores, processes, or transmits payment card data.
What’s the difference between CTEM and traditional vulnerability management?
Traditional vulnerability management scans and patches on a periodic cycle. CTEM is continuous and adds two steps most programs skip: validating that a finding is actually exploitable, and governing remediation through to completion.
