/ Blog
Research, writeups, and product news.
/ Labs
What our agents find, and how we prove it.
/ Videos
Short explainers on security fundamentals.
/ Solution Briefs
One-PDF overviews of each product.
/ Knowledge Center
Security concepts, from SIEM to SOC 2.
/ Glossary
Vulnerabilities and testing terms, defined.
/ Security
How we secure the agents and your data.
/ About
The team behind Parameter.
/ Careers
Open roles. Come build with us.
/ Compare
Parameter next to the tools you're weighing.
Security Glossary
Plain definitions of the vulnerabilities, testing techniques and scoring systems pentesters work with day to day. For the categories teams evaluate — CNAPP, SIEM, SOC 2 — see the Knowledge Center.
A
- Attack surfaceAn attack surface is every point where an attacker can try to get into a system, affect it, or pull data out of it: internet-facing hosts, APIs, login pages, cloud services, internal network services, physical access and the people who can be tricked.
- Authenticated penetration testingAuthenticated penetration testing is a pentest in which the tester logs in with real accounts, usually one per role and tenant, and attacks the application from inside the session, looking for users who can read or change data, or run functions, that their role should not allow.
B
- Black-box, gray-box and white-box penetration testingBlack-box, gray-box and white-box testing describe how much a penetration tester is told before starting: nothing beyond a target (black-box), partial information such as accounts and API specs (gray-box), or full access to source code, architecture and configuration (white-box).
- Broken function level authorization (BFLA)Broken function level authorization (BFLA) is an API vulnerability where an endpoint meant for a higher role, such as an admin or support action, does not check the caller's role, so an ordinary user calls it directly and performs privileged operations like managing users or changing settings.
- Broken object level authorization (BOLA)Broken object level authorization (BOLA) is an API vulnerability where an endpoint accepts an object ID from the client and returns or changes that object without checking the caller owns it, so an attacker swaps in another user's or tenant's ID and reads, edits or deletes their records.
- Business logic vulnerabilityA business logic vulnerability is a flaw in how an application enforces its own rules, letting an attacker abuse legitimate features in unintended sequences or with unexpected values to skip payment, pay negative amounts, or reach states the workflow was meant to prevent.
C
- CI/CD pipeline securityCI/CD pipeline security is the practice of controlling who and what can change, trigger and run your build and deployment pipelines, and what those pipelines can reach, so an attacker who gets into a branch, a third-party action or a runner cannot use the pipeline's secrets and deploy rights to ship code or reach production.
- Common Vulnerabilities and Exposures (CVE)Common Vulnerabilities and Exposures (CVE) is the public catalog that gives each disclosed software or hardware vulnerability a unique ID such as CVE-2023-4966.
- Common Vulnerability Scoring System (CVSS)Common Vulnerability Scoring System (CVSS) is an open standard from FIRST that rates the severity of a software vulnerability from 0.0 to 10.0.
- Common Weakness Enumeration (CWE)Common Weakness Enumeration (CWE) is MITRE's catalog of the types of mistakes in software and hardware that lead to vulnerabilities, such as CWE-89 SQL injection or CWE-639 authorization bypass through a user-controlled key.
- Continuous penetration testingContinuous penetration testing is offensive testing that runs repeatedly on its own, triggered by a schedule, a release or a detected change, so new endpoints, roles and exposed services are tested for exploitable flaws within hours or days of appearing, not at the next annual engagement.
- Continuous security validationContinuous security validation is the practice of repeatedly running safe, simulated attack techniques against your own environment to prove whether exposures are actually exploitable and whether prevention and detection controls stop or flag them.
- Cross-site request forgery (CSRF)Cross-site request forgery (CSRF) is a vulnerability where a site the attacker controls makes a logged-in victim's browser send a state-changing request to another application, which accepts it because the browser attaches the victim's cookies automatically.
- Cross-site scripting (XSS)Cross-site scripting (XSS) is a vulnerability where an application places attacker-supplied input into a page without encoding it, so the victim's browser runs the attacker's JavaScript with the site's origin and can read the page, act as the logged-in user, or change what they see.
D
E
G
I
- Instance metadata service (IMDS)The instance metadata service (IMDS) is a local HTTP endpoint at 169.254.169.254 that a cloud VM queries to learn about itself, including the temporary credentials of its attached role, which makes it the highest-value target for a server-side request forgery attack.
- Internal vs external penetration testingInternal and external penetration testing differ by starting position.
J
