Skip to main content

Glossary

This collects the abbreviations and terms that appear in the guide and the app, all in one place. For how concepts relate to each other, see Core concepts; for the meaning of statuses and badges, see the Status dictionary.

Platform · categories​

ASPMApplication Security Posture Management
An approach to managing application security posture in a unified way. It gathers multiple analysis results into a single organization view to set priorities, the category that Vulinder is aiming for.
OrganizationOrganization
The top-level boundary for all data. Services, members, results, and settings are isolated per organization.
ServiceService
A single analysis target. The type (source / image / web / host / SBOM / binary) determines which analyses can be run.

Analysis types​

SASTStatic Application Security Testing
Static application security testing. Analyzes source code without running it to find code-level vulnerabilities. (SAST)
SCASoftware Composition Analysis
Software composition analysis. Checks open-source dependencies for known vulnerabilities. (SCA)
DASTDynamic Application Security Testing
Dynamic application security testing. Sends requests to a running service to check it. (Web service (DAST))
IaCInfrastructure as Code
Infrastructure defined as code. Checks the security-setting flaws in the definition files. (IaC)
SBOMSoftware Bill of Materials
A component inventory. A specification, in a standard format, of which open-source components are included and at which versions. (SBOM · License)

Vulnerabilities · priority​

findingDiscovered item
A single individual vulnerability that analysis found. It has a severity, location, description, and references (CVE / CWE).
CVECommon Vulnerabilities and Exposures
The standard identifier assigned to a publicly disclosed vulnerability.
CWECommon Weakness Enumeration
A classification system for vulnerability types. Used as the basis for compliance mapping. (Compliance)
KEVKnown Exploited Vulnerabilities
A list of vulnerabilities confirmed to be actively exploited. A separate axis from severity; if it is attached, handle it first.
EPSSExploit Prediction Scoring System
A probability score for how likely a vulnerability is to be exploited in the near future.

Handling · documents​

TriageTriage
The work of reviewing a finding and deciding its handling status. Closed as resolved, false positive or accepted risk. (Vulnerability management)
False positiveFalse Positive
An item that is not a real risk. Once handled, it does not return to open even if a later rescan detects it again.
Accepted riskAccepted Risk
A state where the risk is acknowledged but a decision has been made not to remediate it for now.
VEXVulnerability Exploitability eXchange
A standard document that states "is this vulnerability actually exploitable in our product." (Reports · VEX)

Operations · metrics​

Runtime collector
A lightweight collector installed on a server to detect and transmit runtime security events. It is the event source for runtime monitoring. (Runtime monitoring)
SLAService Level Agreement
An organization-policy deadline that defines by when to remediate, per severity. (SLA settings)
VUScan usage unit
The metering unit for scan usage. It is the basis for per-plan usage limits and billing. (Billing)