Cyber Security & EASM Glossary

Account Takeover

ATO

Identity & Credentials

Account takeover (ATO) is when an attacker gains control of a legitimate user’s account, such as email, banking, SaaS or a cloud console, usually by using stolen credentials, hijacked session cookies or phishing, then uses that trusted access for fraud, data theft or further attacks against the organisation and its contacts.

Attack Surface

Attack Surface

An attack surface is the total set of points where an attacker could try to get into, or extract data from, an organisation’s systems. It includes internet-facing assets such as websites, servers and cloud services, software and its vulnerabilities, user accounts and credentials, and the people and suppliers connected to the organisation.

Attack Surface Management

ASM

Attack Surface

Attack surface management (ASM) is the ongoing practice of identifying, classifying, prioritising and reducing every point where an organisation could be attacked. It combines asset discovery, vulnerability assessment and continuous monitoring so the security team always has an accurate, current picture of its exposure and can act on the riskiest items first.

Brand Impersonation

Brand & Fraud

Brand impersonation is when attackers pose as a legitimate organisation, using its name, logo, website design, domains or staff identities, to deceive customers, partners or employees. Common forms include phishing emails, fake websites, lookalike domains, fraudulent social media accounts and fake mobile apps, usually aimed at stealing credentials, payments or personal data.

Business Email Compromise

BEC

Brand & Fraud

Business email compromise (BEC) is a fraud in which attackers impersonate or take over a trusted email account, such as an executive, supplier or finance colleague, to persuade staff to make payments, change bank details or share sensitive information. It relies on trust and timing rather than malware, which makes it hard for filters to catch.

Common Vulnerabilities and Exposures

CVE

Vulnerabilities

A CVE, short for Common Vulnerabilities and Exposures, is a unique public identifier assigned to a specific, publicly disclosed security vulnerability, in the format CVE-year-number such as CVE-2021-44228. The CVE Program, operated by MITRE with funding from the US Cybersecurity and Infrastructure Security Agency, gives everyone a common name for the same flaw.

Common Vulnerability Scoring System

CVSS

Vulnerabilities

The Common Vulnerability Scoring System (CVSS) is an open standard, maintained by FIRST, for rating the severity of software vulnerabilities on a scale from 0.0 to 10.0. Scores are calculated from characteristics such as how the flaw is reached, how complex it is to exploit and its impact on confidentiality, integrity and availability.

Continuous Threat Exposure Management

CTEM

Vulnerabilities

Continuous threat exposure management (CTEM) is a framework, introduced by Gartner in 2022, for running exposure reduction as a repeating programme rather than a series of one-off scans. It moves through five stages: scoping, discovery, prioritisation, validation and mobilisation, so teams focus on the exposures most likely to be exploited.

Credential Stuffing

Identity & Credentials

Credential stuffing is an automated attack in which criminals take large lists of usernames and passwords leaked from previous breaches and try them against other websites and services. Because many people reuse passwords, a small percentage of attempts succeed, giving attackers access to genuine accounts without needing to crack or guess anything.

Cyber Asset Attack Surface Management

CAASM

Attack Surface

Cyber asset attack surface management (CAASM) is an approach that builds a single, unified inventory of an organisation’s assets by pulling data from internal tools through APIs, such as endpoint agents, cloud consoles, identity providers and vulnerability scanners, then uses that inventory to find coverage gaps and security control failures.

Dangling DNS

Attack Surface

A dangling DNS record is a DNS entry, typically a CNAME, A or NS record, that points to a resource which no longer exists or is no longer controlled by the organisation, such as a deleted cloud app, released IP address or cancelled hosting account. Dangling records are the root cause of subdomain takeover.

Dark Web Monitoring

Dark Web

Dark web monitoring is the continuous searching of dark web marketplaces, forums, leak sites and related channels for information connected to an organisation, such as stolen credentials, customer data, internal documents, access for sale or discussion of planned attacks, so the organisation is alerted early and can respond before the data is used.

Digital Risk Protection

DRPS

Brand & Fraud

Digital risk protection (DRP), often delivered as digital risk protection services (DRPS), is the monitoring of the open web, social media, the deep and dark web and other external sources for threats to an organisation’s brand, people and data, such as impersonation, leaked credentials, data for sale and fake websites, followed by action to remove or mitigate them.

Executive Protection

Identity & Credentials

Digital executive protection is the monitoring and reduction of online risk to senior leaders and other high-profile individuals, covering impersonation, leaked credentials, exposed personal information such as home addresses, and targeted phishing or fraud. Because executives hold authority and access, attackers often target them to reach the wider organisation.

Exploit Prediction Scoring System

EPSS

Vulnerabilities

The Exploit Prediction Scoring System (EPSS) is a free, data-driven model maintained by FIRST that estimates the probability that a published vulnerability will be exploited in the wild within the next 30 days. Scores range from 0 to 1 and are updated daily, helping teams prioritise the small share of vulnerabilities attackers actually use.

External Attack Surface Management

EASM

Attack Surface

External attack surface management (EASM) is the continuous discovery, inventory and monitoring of an organisation’s internet-facing assets, such as domains, subdomains, IP addresses, cloud services and exposed applications, combined with testing those assets for vulnerabilities and misconfigurations so security teams can fix exposures before attackers find them.

Initial Access Broker

IAB

Dark Web

An initial access broker (IAB) is a cyber criminal who breaks into organisations’ networks, or collects working access such as VPN, remote desktop or cloud logins, and then sells that access to other criminals, most often ransomware affiliates. IABs advertise on dark web forums and Telegram channels, usually describing victims by sector, country and revenue.

Internet-Facing Asset Inventory

Attack Surface

An internet-facing asset inventory is a maintained record of every system an organisation exposes to the public internet, including domains, subdomains, IP addresses, open ports, web applications, APIs, cloud services and certificates, with an owner, purpose and risk status for each. It is the foundation for patching, monitoring and reducing the external attack surface.

Known Exploited Vulnerabilities Catalog

KEV

Vulnerabilities

The Known Exploited Vulnerabilities (KEV) catalog is a public list, maintained by the US Cybersecurity and Infrastructure Security Agency (CISA), of vulnerabilities with reliable evidence of active exploitation in the wild. Each entry has a CVE ID, a required action and a due date, which makes it a practical shortlist for prioritising patches.

Leaked Credentials

Identity & Credentials

Leaked credentials are usernames, email addresses, passwords, session cookies or API keys that have been exposed outside the organisation, through data breaches, malware, phishing, accidental publication in code or misconfigured systems. Attackers use them to log in as legitimate users, which makes credential abuse one of the most common ways breaches begin.

Lookalike Domain

Brand & Fraud

A lookalike domain is a domain name designed to be mistaken for a legitimate organisation’s domain, using tricks such as misspellings, added words, different top-level domains or visually similar characters from other alphabets. Attackers use lookalike domains for phishing emails, fake login pages, invoice fraud and brand impersonation.

Open-Source Intelligence

OSINT

Threat Intelligence

Open-source intelligence (OSINT) is information collected from publicly available sources, such as websites, social media, public records, code repositories, DNS and certificate data, news and breach dumps, then analysed to answer a specific question. In cyber security it is used by both attackers and defenders to understand an organisation’s exposure.

Penetration Testing

Vulnerabilities

Penetration testing is an authorised, simulated attack on an organisation’s systems, applications or network, carried out by security specialists to find and safely exploit weaknesses before real attackers do. It is usually time-boxed and scoped in advance, and ends with a report describing the issues found, their impact and how to fix them.

Phishing

Brand & Fraud

Phishing is a social engineering attack in which criminals send messages that appear to come from a trusted person or organisation, usually by email but also by text, phone or social media, to trick recipients into revealing credentials, sending money, opening malicious attachments or visiting fake websites.

Ransomware

Threat Intelligence

Ransomware is malicious software that encrypts an organisation’s files and systems so they cannot be used, followed by a demand for payment, usually in cryptocurrency, in exchange for a decryption key. Most modern groups also steal data first and threaten to publish it on a leak site, a tactic known as double extortion.

Shadow IT

Attack Surface

Shadow IT is any technology used for business purposes without the knowledge or approval of the IT or security team, such as cloud services, SaaS accounts, websites, servers or devices set up by individual staff, departments or agencies. Because it sits outside central management, it is rarely patched, monitored or included in security controls.

Stealer Logs

Identity & Credentials

Stealer logs are bundles of data collected by infostealer malware from an infected device, typically saved browser passwords, session cookies, autofill data, cryptocurrency wallets and system details. They are sold or shared on criminal markets and Telegram channels, where attackers use them to log in to accounts, often bypassing multi-factor authentication with stolen session cookies.

Subdomain Takeover

Attack Surface

A subdomain takeover happens when a subdomain’s DNS record still points to an external service, such as a cloud app, storage bucket or hosting platform, that the organisation no longer controls. An attacker claims that resource and then serves their own content on the organisation’s trusted subdomain, often for phishing, malware or session theft.

Third-Party Risk Management

TPRM

Compliance

Third-party risk management (TPRM) is the process of identifying, assessing and monitoring the cyber security, operational and compliance risks that come from suppliers, vendors, partners and service providers. In cyber security it focuses on how a supplier’s weaknesses, such as exposed systems, breaches or leaked credentials, could lead to an attack on your organisation.

Threat Intelligence

Threat Intelligence

Threat intelligence is evidence-based information about cyber threats, including who is behind them, what they target, how they operate and which indicators reveal their activity, that has been collected, analysed and put into context so an organisation can make better security decisions, from patching priorities to detection rules and board-level risk.

Typosquatting

Brand & Fraud

Typosquatting is the registration of domain names that are slight misspellings or variations of a legitimate brand’s domain, for example a swapped letter, missing character or different top-level domain, so that people who mistype the address or misread a link land on an attacker’s site used for phishing, malware or fraud.

Vulnerability Scanning

Vulnerabilities

Vulnerability scanning is the automated testing of systems, networks and applications to identify known security weaknesses, such as unpatched software, misconfigurations, exposed services and weak encryption. Scanners compare what they find against databases of known vulnerabilities and produce a prioritised list of issues to fix.

Website Takedown

Brand & Fraud

A website takedown is the process of getting a malicious or infringing website removed or disabled, usually a phishing page, fake shop or site impersonating a brand, by gathering evidence and submitting requests to the domain registrar, hosting provider, and other parties such as browsers’ safe browsing services and email providers, until the content is offline.

Zero-Day Vulnerability

Vulnerabilities

A zero-day vulnerability is a security flaw that attackers know about or are exploiting before the vendor has released a fix, meaning defenders have had zero days to patch it. An attack that uses such a flaw is called a zero-day exploit, and these are especially dangerous on internet-facing systems such as VPNs, firewalls and file transfer tools.

Zero Trust

Compliance

Zero trust is a security approach that assumes no user, device or network location should be trusted by default. Every request to access an application or data is verified using identity, device health and context, access is limited to what is needed, and activity is monitored continuously, rather than trusting anything that is inside the corporate network.