/ Blog
Research, writeups, and product news.
/ Labs
What our agents find, and how we prove it.
/ Videos
Short explainers on security fundamentals.
/ Solution Briefs
One-PDF overviews of each product.
/ Knowledge Center
Security concepts, from SIEM to SOC 2.
/ Glossary
Vulnerabilities and testing terms, defined.
/ Security
How we secure the agents and your data.
/ About
The team behind Parameter.
/ Careers
Open roles. Come build with us.
/ Compare
Parameter next to the tools you're weighing.
Security Glossary
Plain definitions of the vulnerabilities, testing techniques and scoring systems pentesters work with day to day. For the categories teams evaluate — CNAPP, SIEM, SOC 2 — see the Knowledge Center.
K
M
O
P
- Penetration test attestation letterA penetration test attestation letter is a short signed statement from the testing firm confirming that it tested a named scope during stated dates, with a stated method, and summarizing findings and remediation status.
- Penetration testing as a service (PTaaS)Penetration testing as a service (PTaaS) is a way of buying pentests as a subscription delivered through a web platform: you scope and launch tests in a portal, testers or automated agents post findings there as they confirm them, and you track fixes and request retests in the same place, usually under an annual contract.
- Penetration testing costPenetration testing cost is the price of a security test, set mostly by how many tester-days the scope needs multiplied by the provider's day rate.
- Penetration testing methodologyA penetration testing methodology is the documented sequence a tester follows, from scoping and reconnaissance through exploitation, post-exploitation, reporting and retest, usually based on a published standard such as PTES, the OWASP WSTG or NIST SP 800-115, so that coverage is repeatable and results can be compared.
- Pentest retestA pentest retest is a follow-up check in which the tester repeats the original reproduction steps for each reported finding after the fix ships, confirms whether the issue is gone, and issues an updated status for every finding.
- Poisoned pipeline execution (PPE)Poisoned pipeline execution (PPE) is a CI/CD attack where someone who can push a branch or open a pull request changes the pipeline definition, or a file the pipeline runs such as a Makefile or test script, so the build system executes their commands with the pipeline's secrets and permissions.
- Privilege escalationPrivilege escalation is gaining access or permissions beyond what an account was granted: reaching another user's data at the same level (horizontal) or performing actions reserved for a higher role such as admin (vertical), usually because the server does not check authorization on every request.
- Prompt injectionPrompt injection is a vulnerability in applications built on large language models where text supplied by a user, or hidden in a web page, email or document the model reads, is treated as instructions, so an attacker can override the developer's intent and make the model ignore rules, leak context or misuse its connected tools.
- Proof of concept exploit (PoC)A proof of concept (PoC) exploit is the smallest demonstration that a vulnerability is real and exploitable: a request, script or sequence of steps that triggers the flaw and shows its effect without doing further harm.
R
- Race conditionA race condition is a vulnerability where an application checks a condition and then acts on it as separate steps, so two requests arriving at nearly the same time both pass the check before either acts, letting an attacker overrun a limit or bypass a guard.
- Rules of engagement (RoE)Rules of engagement (RoE) are the signed document that authorizes a security test and sets its limits: which systems may be attacked, when, from where, with which techniques, how data is handled, who to call when something breaks, and when testing must stop.
S
- Secure code reviewSecure code review is the examination of source code, usually a pull request diff, specifically to find security flaws such as missing authorization checks, injection, unsafe deserialization and leaked secrets, by a person, a static analysis tool, an AI reviewer, or a combination, before the change reaches production.
- Segmentation testingSegmentation testing is penetration testing that verifies network controls isolate the cardholder data environment (CDE) from out-of-scope networks.
- Server-side request forgery (SSRF)Server-side request forgery (SSRF) is a vulnerability where an attacker makes a server send HTTP requests to a destination of the attacker's choosing, reaching internal services, cloud metadata endpoints, and other hosts the attacker cannot address directly.
- Shadow APIA shadow API is an API endpoint, version or host that runs in production but is missing from the organization's inventory and documentation, so it skips the security reviews, gateway policies and monitoring applied to known APIs and often exposes old or unprotected functionality to anyone who finds it.
- SQL injection (SQLi)SQL injection (SQLi) is a vulnerability where user input is concatenated into a database query, letting an attacker change the query's logic to read rows they should not see, bypass login checks, modify or delete data, and sometimes run commands on the database server.
- Subdomain takeoverA subdomain takeover is a vulnerability where a DNS record still points to a deprovisioned cloud resource, letting an attacker register that resource and serve their own content from a subdomain the organization still owns, such as a dangling CNAME to a deleted host.
