Learning Center
Our mission is to provide the most comprehensive and up-to-date security knowledge for developers, testers, and security professionals.
J
K
M
O
P
- Penetration test attestation letterA penetration test attestation letter is a short signed statement from the testing firm confirming that it tested a named scope during stated dates, with a stated method, and summarizing findings and remediation status.
- Penetration testingPenetration testing is an authorized, simulated attack on an application, network or cloud environment in which a tester exploits vulnerabilities, chains them together, and proves what a real attacker could reach, such as another customer's data or an admin account, then reports each finding with evidence and a fix.
- Penetration testing as a service (PTaaS)Penetration testing as a service (PTaaS) is a way of buying pentests as a subscription delivered through a web platform: you scope and launch tests in a portal, testers or automated agents post findings there as they confirm them, and you track fixes and request retests in the same place, usually under an annual contract.
- Penetration testing costPenetration testing cost is the price of a security test, set mostly by how many tester-days the scope needs multiplied by the provider's day rate.
- Penetration testing methodologyA penetration testing methodology is the documented sequence a tester follows, from scoping and reconnaissance through exploitation, post-exploitation, reporting and retest, usually based on a published standard such as PTES, the OWASP WSTG or NIST SP 800-115, so that coverage is repeatable and results can be compared.
- Pentest retestA pentest retest is a follow-up check in which the tester repeats the original reproduction steps for each reported finding after the fix ships, confirms whether the issue is gone, and issues an updated status for every finding.
- Poisoned pipeline execution (PPE)Poisoned pipeline execution (PPE) is a CI/CD attack where someone who can push a branch or open a pull request changes the pipeline definition, or a file the pipeline runs such as a Makefile or test script, so the build system executes their commands with the pipeline's secrets and permissions.
- Privilege escalationPrivilege escalation is gaining access or permissions beyond what an account was granted: reaching another user's data at the same level (horizontal) or performing actions reserved for a higher role such as admin (vertical), usually because the server does not check authorization on every request.
- Prompt injectionPrompt injection is a vulnerability in applications built on large language models where text supplied by a user, or hidden in a web page, email or document the model reads, is treated as instructions, so an attacker can override the developer's intent and make the model ignore rules, leak context or misuse its connected tools.
- Proof of concept exploit (PoC)A proof of concept (PoC) exploit is the smallest demonstration that a vulnerability is real and exploitable: a request, script or sequence of steps that triggers the flaw and shows its effect without doing further harm.
R
- Race conditionA race condition is a vulnerability where an application checks a condition and then acts on it as separate steps, so two requests arriving at nearly the same time both pass the check before either acts, letting an attacker overrun a limit or bypass a guard.
- Reachability analysisReachability analysis is a technique for triaging dependency vulnerabilities that checks whether your application can actually execute the vulnerable function in a library, by tracing a call path from your own code to it, so teams fix the findings that are reachable and deprioritize ones where the flawed code is present but never runs.
- Rules of engagement (RoE)Rules of engagement (RoE) are the signed document that authorizes a security test and sets its limits: which systems may be attacked, when, from where, with which techniques, how data is handled, who to call when something breaks, and when testing must stop.
S
- Secrets detectionSecrets detection is the automated search of source code, git history, CI logs, container images and build artifacts for credentials such as API keys, tokens, private keys and database passwords, using provider patterns, entropy checks and live verification, so exposed secrets are found and revoked before an attacker uses them.
- Secure code reviewSecure code review is the examination of source code, usually a pull request diff, specifically to find security flaws such as missing authorization checks, injection, unsafe deserialization and leaked secrets, by a person, a static analysis tool, an AI reviewer, or a combination, before the change reaches production.
- Segmentation testingSegmentation testing is penetration testing that verifies network controls isolate the cardholder data environment (CDE) from out-of-scope networks.
