Security and compliance glossary

ASPM pulls the findings from all your application security tools into one prioritized view, so a small team fixes the risks that matter first.

Attack surface management continuously finds everything you expose to the internet, including what you forgot about, and flags what an attacker could use.

An autonomous CISO is software that runs the day-to-day work of a security program, so startups get continuous security, with compliance following from it.

Compliance automation replaces spreadsheets and screenshots with software that maps controls, collects evidence and tracks readiness for frameworks like SOC 2.

Continuous compliance means checking your controls all the time, not once a year, so you stay audit-ready and catch drift the day it happens.

FAIR is a model for putting cyber risk in dollars, so you can compare security issues with each other and with other business decisions.

MITRE ATT&CK is a free catalog of how real attackers operate, organized by goal, that security teams use as a shared language for threats and defenses.

A penetration test is an authorized, simulated attack that shows how far a real attacker could get into your systems and what they could reach.

An SBOM lists every component inside your software, so you can answer in minutes whether a newly disclosed vulnerability affects you.

A security questionnaire is the list of questions a customer sends to check your security before buying. Answering well and quickly can decide the deal.

Shared controls let one security control satisfy matching requirements in several frameworks at once, so you do the work and collect the evidence only once.

Type 1 checks that your controls are designed well on one date. Type 2 checks that they actually worked over a period, usually several months.

A trust center is a public page where buyers can check your security and compliance posture and request documents, without a week of back-and-forth email.

VAPT combines broad automated vulnerability discovery with targeted attack simulation, so you learn both what is weak and what is actually exploitable.

A vCISO is an experienced security leader you hire part time, so you get CISO-level judgment without a full-time executive salary.

Vulnerability scanning automatically checks your systems and software against known weaknesses, so you find exposed issues before attackers do.