Product Security Glossary

Agentic AI security is the practice of protecting AI agents, systems where a language model plans and takes actions using tools, data and other systems, and protecting everything those agents can touch. It covers permissions, prompt injection, data access, action approval and auditability.

Application security posture management (ASPM) is an approach that pulls findings from many application security tools into one place, removes duplicates, correlates them to applications and owners, prioritizes them and tracks remediation across the software development lifecycle.

Cloud security posture management (CSPM) continuously checks cloud accounts and services for misconfigurations and risky permissions, such as public storage, overly broad IAM roles or disabled logging, and compares them against security benchmarks and compliance frameworks.

The Common Vulnerability Scoring System (CVSS) is an open standard maintained by FIRST that rates the technical severity of a software vulnerability on a scale from 0.0 to 10.0. It describes how bad a vulnerability could be, not how likely it is to be exploited.

Common Weakness Enumeration (CWE) is a community-developed catalog of software and hardware weakness types, maintained by MITRE. Each entry, such as CWE-79 for cross-site scripting, describes a kind of mistake that can lead to vulnerabilities.

Dynamic application security testing (DAST) tests a running application from the outside, sending crafted requests and analyzing the responses for signs of vulnerabilities. It needs no access to source code and sees the application the way an attacker does.

The Exploit Prediction Scoring System (EPSS) is a data-driven model from FIRST that estimates the probability a published CVE will be exploited in the wild within the next 30 days. It publishes a score from 0 to 1 for every CVE, updated daily.

An insecure direct object reference (IDOR) is an access control flaw where an application uses an identifier supplied by the user, such as an account or order ID, to fetch a record without checking that the user is allowed to access it. Changing the ID exposes someone else's data.

The Known Exploited Vulnerabilities (KEV) catalog is a list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities with reliable evidence of exploitation in the wild. It is one of the strongest signals for deciding what to patch first.

The OWASP Top 10 is an awareness document from the Open Worldwide Application Security Project that ranks the most critical security risk categories for web applications. It is updated every few years from contributed data and community input, and the current edition is OWASP Top 10:2025.

Penetration testing is an authorized, simulated attack on an application, network or system to find vulnerabilities and prove they can be exploited before a real attacker does. Testers chain weaknesses together and report what they reached, with evidence.

Prompt injection is an attack where instructions hidden in text that a large language model reads cause it to ignore its intended instructions, leak data or misuse the tools it has access to. It is ranked first in the OWASP Top 10 for LLM Applications.

Reachability analysis determines whether a vulnerable function in your code or its dependencies can actually be executed from a real entry point in your application. It separates findings an attacker could trigger from ones that are only present on disk.

A software bill of materials (SBOM) is a machine-readable inventory of the components that make up a piece of software, including open source libraries, their versions and their dependency relationships. It lets teams see quickly whether they are affected when a component is found to be vulnerable.

Software composition analysis (SCA) identifies the open source and third-party components in an application, including transitive dependencies, and flags those with known vulnerabilities, license problems or signs of abandonment.

Static application security testing (SAST) analyzes source code, bytecode or binaries without running the application, looking for code patterns and data flows that indicate security vulnerabilities. It runs early in development, often on every pull request.

A software supply chain attack compromises an application by targeting something it trusts, such as an open source dependency, a build system, a CI pipeline or a vendor update, instead of attacking the application directly. One compromised component can reach every organization that uses it.

Vulnerability management is the continuous process of finding security weaknesses across code, dependencies, infrastructure and cloud, deciding which ones matter most, fixing them and confirming the fixes worked. It is a program, not a single scan.