// About this glossary
55 penetration testing and offensive-security terms, grouped into six categories: core concepts, web & application, network & Active Directory, cloud, AI/LLM, and compliance. Each definition is written to stand alone. Jump to a category below.
// 01 Core concepts
- Penetration Testing
- An authorised, simulated cyber attack on a system, carried out by security professionals to find and prove exploitable vulnerabilities before a real attacker does.
- Vulnerability Assessment
- A breadth-first review that identifies, validates and prioritises security weaknesses across systems, without exploiting them, to guide remediation.
- VAPT
- Vulnerability Assessment and Penetration Testing — the combined term, common in the Gulf and South Asia, for breadth-plus-depth security testing.
- Red Teaming
- A full-scope, objective-based adversarial simulation that tests an organisation's detection and response against a realistic attacker, not just its control design.
- Blue Team
- The internal defenders responsible for detecting and responding to attacks — the counterpart the red team tests.
- Purple Teaming
- A collaborative exercise where offensive (red) and defensive (blue) teams work together to improve detection and response in real time.
- Black Box Testing
- Penetration testing performed with no prior knowledge of the target, simulating an external attacker starting from zero.
- Grey Box Testing
- Penetration testing with partial knowledge, such as user credentials, simulating an insider or authenticated user — usually the best value for applications.
- White Box Testing
- Penetration testing with full knowledge including source code and architecture, giving the most thorough coverage.
- Rules of Engagement
- The agreed boundaries of a penetration test — targets, timing, methods, off-limits systems and stop conditions — documented before testing begins.
- Attack Surface
- The total set of points where an attacker could try to enter or extract data from a system — applications, services, endpoints and interfaces.
- Threat Modeling
- A structured process for identifying likely attackers, their goals, and the paths they might take, used to focus testing and defences.
- OSINT
- Open-Source Intelligence — information gathered from publicly available sources during reconnaissance to support an attack or assessment.
- CVSS
- Common Vulnerability Scoring System — a standardised 0 to 10 score expressing the technical severity of a vulnerability.
- CVE
- Common Vulnerabilities and Exposures — a public catalogue that assigns a unique identifier to each publicly known security vulnerability.
- Proof of Concept
- Evidence in a report that a vulnerability is real and exploitable, such as a request, screenshot or reproduction steps.
- Remediation
- The action taken to fix a vulnerability, and the guidance a penetration test report provides to do so.
- Retesting
- A follow-up assessment that verifies reported vulnerabilities have been successfully fixed, providing evidence of closure.
- Attestation Letter
- A concise, shareable summary confirming a penetration test was performed, by whom, when, over what scope, and its remediation status — given to customers or auditors.
// 02 Web & application
- OWASP Top 10
- The Open Web Application Security Project's regularly updated list of the ten most critical web application security risks.
- Broken Access Control
- A flaw where users can act outside their intended permissions, such as viewing another user's data — consistently the most common serious web finding.
- BOLA Broken Object Level Authorization
- An API flaw where the server authenticates the user but fails to verify that the requested object belongs to them.
- IDOR Insecure Direct Object Reference
- Accessing another user's resource by changing an identifier, because the application does not check ownership.
- SQL Injection
- Injecting malicious SQL through application input to read, modify or destroy database data, when input is not properly separated from queries.
- Cross-Site Scripting XSS
- Injecting malicious scripts into a web page viewed by other users, enabling session theft, defacement or actions on their behalf.
- CSRF Cross-Site Request Forgery
- Tricking a logged-in user's browser into making an unwanted authenticated request to a site they trust.
- SSRF Server-Side Request Forgery
- Tricking a server into making requests to internal systems, a key path to cloud credential theft via metadata services.
- XXE XML External Entity
- Abusing XML parsing to read local files, reach internal systems, or cause denial of service.
- Insecure Deserialization
- Exploiting how an application reconstructs data objects to execute code or manipulate application logic.
- Business Logic Vulnerability
- A flaw in how an application's rules and workflows can be abused — such as bypassing a payment step — that automated scanners cannot detect.
- Authentication Bypass
- Gaining access to protected functionality without valid credentials, by exploiting flaws in the authentication mechanism.
- Clickjacking
- Tricking a user into clicking something different from what they perceive, by overlaying invisible framed content.
- Mass Assignment
- An API flaw where an attacker sets object properties they should not control, by adding extra fields to a request.
- Race Condition
- Exploiting the timing gap between two operations to produce an unintended result, such as spending the same balance twice.
// 03 Network & Active Directory
- Lateral Movement
- Techniques an attacker uses to move from an initial foothold to other systems inside a network in pursuit of higher-value targets.
- Privilege Escalation
- Gaining higher permissions than initially granted, such as moving from a standard user to administrator or root.
- Pivoting
- Using a compromised system as a stepping stone to reach networks or hosts that were not directly accessible.
- Active Directory
- Microsoft's directory service that governs identity and access in most enterprise Windows networks — a primary target in internal tests.
- Kerberoasting
- An Active Directory attack that requests service tickets and cracks them offline to recover service-account passwords.
- AS-REP Roasting
- An Active Directory attack against accounts without Kerberos pre-authentication, recovering crackable password hashes.
- Pass-the-Hash
- Authenticating to a system using a captured password hash rather than the plaintext password.
- Segmentation Testing
- Verifying that network segmentation actually prevents traffic between zones, such as isolating a cardholder data environment — a PCI DSS requirement.
- Command and Control C2
- The infrastructure and channels an attacker uses to remotely control compromised systems and exfiltrate data.
- Internal vs External Testing
- External testing assesses internet-facing systems from outside; internal testing assesses what an attacker could do from inside the network.
// 04 Cloud
- Shared Responsibility Model
- The cloud principle that the provider secures the underlying infrastructure while the customer secures their own configuration, identities and data.
- IAM Identity and Access Management
- The cloud system that controls who can do what; misconfigured IAM is the leading cause of cloud privilege escalation.
- IMDS Instance Metadata Service
- A cloud endpoint that supplies credentials to virtual machines; older versions are exploitable via SSRF to steal those credentials.
- Service Account
- A non-human identity used by applications and workloads; over-permissioned service accounts are a common cloud escalation path.
- Cloud Misconfiguration
- Insecure settings such as public storage buckets or over-broad permissions — the most common cause of cloud data breaches.
- Container Escape
- Breaking out of a container to access the host or other containers, a key risk in shared container platforms.
// 05 AI / LLM
- LLM Large Language Model
- An AI model trained on vast text to generate and reason over natural language, underlying chatbots and AI assistants.
- Prompt Injection
- Manipulating an LLM's behaviour through crafted input or ingested content — the top risk in the OWASP LLM Top 10 and largely unsolved.
- Jailbreak
- A form of direct prompt injection that breaks an LLM out of its safety or role constraints entirely.
- Indirect Prompt Injection
- Prompt injection delivered through external content the model ingests — a web page, document or email — rather than by the attacker directly.
- RAG Retrieval-Augmented Generation
- An architecture that supplies an LLM with retrieved documents at query time; poisoned or leaky retrieval is a distinct risk class.
- Excessive Agency
- Granting an AI system too much functionality, permission or autonomy, so a manipulated model can take damaging real-world actions.
- Model Poisoning
- Manipulating training, fine-tuning or embedding data to introduce backdoors, bias or malicious behaviour into a model.
// 06 Compliance & delivery
- PCI DSS
- The Payment Card Industry Data Security Standard, which mandates penetration testing of the cardholder data environment under Requirement 11.4.
- SOC 2
- An AICPA audit of a service organisation's controls against the Trust Services Criteria; penetration testing is expected evidence.
- ISO 27001
- The international information-security management standard; penetration testing is the expected evidence for Annex A controls 8.8 and 8.29.
- CDE Cardholder Data Environment
- The systems that store, process or transmit payment card data, and the primary scope of a PCI DSS penetration test.
- 3PAO
- Third-Party Assessment Organization — an accredited firm that conducts the independent assessment required under FedRAMP.
- QSA Qualified Security Assessor
- A PCI-certified professional who assesses an organisation's compliance with PCI DSS.
- PTaaS
- Penetration Testing as a Service — a platform-delivered, often subscription-based model combining testing with a continuous delivery and reporting portal.
- Continuous Penetration Testing
- An ongoing testing model in which assessments run repeatedly through the year rather than as a single annual engagement.
- TLPT Threat-Led Penetration Testing
- Intelligence-led adversarial testing required by regimes such as the EU's DORA and Saudi Arabia's SAMA FEER framework.