Plain-language cyber security

Glossary

Clear definitions, practical context and connected guidance for the terms used across vulnerability and exposure management.

Reference library

Terms and concepts

Alternative safeguards used when the preferred treatment cannot be applied immediately.

A structured naming scheme used to identify hardware, operating systems and applications.

A continuous programme for scoping, discovering, prioritising, validating and mobilising action around material exposure.

A public identifier for a specific, disclosed cyber-security vulnerability.

A standard for describing the technical severity and characteristics of a vulnerability.

A classification of the underlying software and hardware weakness types that can lead to vulnerabilities.

The continuous discovery and assessment of internet-visible assets and services from an external perspective.

A daily estimate of the probability that a published CVE will be exploited in the wild during the next 30 days.

The practical likelihood and conditions under which a vulnerability can be successfully exploited.

CISA’s catalog of vulnerabilities with evidence of exploitation in the wild.

A vulnerability impact that can allow an attacker to run code on a system from another location.

A decision-tree approach that maps vulnerability evidence and stakeholder context to an action outcome.

The accumulated exposure and operational burden created when vulnerability treatment is delayed or repeatedly deferred.