Glossary
This collects the abbreviations and terms that appear in the guide and the app, all in one place. For how concepts relate to each other, see Core concepts and terms; for the meaning of statuses and badges, see the Status dictionary.
Platform · categories
- ASPMApplication Security Posture Management
- An approach to managing application security posture in a unified way. It gathers multiple analysis results into a single organization view to set priorities, the category that Vulinder is aiming for.
- OrganizationOrganization
- The top-level boundary for all data. Services, members, results, and settings are isolated per organization.
- ServiceService
- A single analysis target. The type (source / image / web / host / SBOM) determines which analyses can be run.
Analysis types
- SASTStatic Application Security Testing
- Static application security testing. Analyzes source code without running it to find code-level vulnerabilities. (SAST)
- SCASoftware Composition Analysis
- Software composition analysis. Checks open-source dependencies for known vulnerabilities. (SCA)
- DASTDynamic Application Security Testing
- Dynamic application security testing. Sends requests to a running service to check it. (Web service (DAST))
- IaCInfrastructure as Code
- Infrastructure defined as code. Checks the security-setting flaws in the definition files. (IaC)
- SBOMSoftware Bill of Materials
- A component inventory. A specification, in a standard format, of which open-source components are included and at which versions. (SBOM · License)
Vulnerabilities · priority
- findingDiscovered item
- A single individual vulnerability that analysis found. It has a severity, location, description, and references (CVE / CWE).
- CVECommon Vulnerabilities and Exposures
- The standard identifier assigned to a publicly disclosed vulnerability.
- CWECommon Weakness Enumeration
- A classification system for vulnerability types. Used as the basis for compliance mapping. (Compliance)
- KEVKnown Exploited Vulnerabilities
- A list of vulnerabilities confirmed to be actively exploited. A separate axis from severity; if it is attached, handle it first.
- EPSSExploit Prediction Scoring System
- A probability score for how likely a vulnerability is to be exploited in the near future.
Handling · documents
- TriageTriage
- The work of reviewing a finding and deciding its handling status. Closed as a false positive or accepted risk. (Vulnerability management)
- False positiveFalse Positive
- An item that is not a real risk. Permanently suppressed by fingerprint so it does not reappear in the next scan.
- Accepted riskAccepted Risk
- A state where the risk is acknowledged but a decision has been made not to remediate it for now.
- VEXVulnerability Exploitability eXchange
- A standard document that states "is this vulnerability actually exploitable in our product." (Reports · VEX)
Operations · metrics
- Runtime collector
- A lightweight collector installed on a server to detect and transmit runtime security events. It is the event source for runtime monitoring. (Runtime monitoring)
- MTTRMean Time To Remediate
- Mean time to remediate. The average time it takes from discovering a vulnerability to resolving it. (Security score)
- SLAService Level Agreement
- An organization-policy deadline that defines by when to remediate, per severity. (SLA settings)