Glossary
Security glossary
The terms this product lives in, defined plainly. Each definition is written to be true on its own — what RedStrike does about it is kept separate, further down each page.
11 terms
Browse every term
- PTaaSPenetration Testing as a Service
- PTaaS, or Penetration Testing as a Service, is a delivery model in which penetration testing runs continuously through a platform rather than as a one-off consulting engagement, with findings surfaced in software as they are discovered instead of in a report at the end.
- CSPMCloud Security Posture Management
- CSPM, or Cloud Security Posture Management, is the continuous assessment of cloud accounts against configuration baselines to find misconfigurations — public storage, over-broad permissions, missing encryption, disabled logging — and track them as they drift over time.
- BOLABroken Object Level Authorization
- BOLA, or Broken Object Level Authorization, is a flaw in which an API accepts a request for a specific object without checking that the caller is entitled to that object — letting an authenticated user read or modify another user's data by changing an identifier.
- SBOMSoftware Bill of Materials
- An SBOM, or Software Bill of Materials, is a formal, machine-readable inventory of the components and dependencies that make up a piece of software, including their versions and the relationships between them.
- VEXVulnerability Exploitability eXchange
- VEX, or Vulnerability Exploitability eXchange, is a machine-readable statement about whether a specific vulnerability actually affects a specific product — allowing a vendor to say that a CVE present in a dependency is not exploitable in their build, and why.
- OSCALOpen Security Controls Assessment Language
- OSCAL, or Open Security Controls Assessment Language, is a NIST-maintained set of machine-readable formats for security control catalogues, system security plans, assessment plans, and assessment results — designed so that control information can move between systems without being retyped.
- CIS Benchmarks
- CIS Benchmarks are consensus-developed secure configuration baselines published by the Center for Internet Security, covering cloud providers, operating systems, and platforms with specific, checkable settings and recommended values.
- EPSSExploit Prediction Scoring System
- EPSS, or Exploit Prediction Scoring System, is a FIRST-maintained model that estimates the probability a given vulnerability will be exploited in the wild within the next 30 days, expressed as a score between 0 and 1.
- Posture Drift
- Posture drift is the gradual divergence of a cloud environment's actual configuration from its intended secure state, caused by ordinary changes — a permission widened for a deploy, a rule opened for debugging, a resource created outside the usual process — that are never reverted.
- Verified Finding
- A verified finding is a reported vulnerability that has been confirmed to be real in the target environment through collected evidence, rather than inferred from a version number, a response header, or a signature match.
- Continuous Penetration Testing
- Continuous penetration testing is the practice of running offensive security testing on an ongoing schedule rather than as a periodic project, so that newly introduced weaknesses are found within days of shipping rather than at the next annual assessment.
See these ideas running against your own estate
Continuous, verified testing across applications, APIs, networks, and cloud accounts.