# Parameter > Parameter is an AI security company. Its agents continuously pentest web apps, APIs, cloud infrastructure and code, proving every vulnerability they find before it reaches you. Parameter (parameter.ai, formerly Hex Security; legal entity Anytool, Inc.) builds autonomous security agents: continuous AI penetration testing, cloud security mapping, software supply chain analysis, Sentinel, an AI security review for every pull request, and Watchtower, external attack surface management. ## Products - [AI Penetration Testing](https://www.parameter.ai/pentesting): Autonomous agents that pentest web apps and APIs on demand and on every release, with audit-grade SOC 2 / ISO 27001 reports. - [Cloud Security](https://www.parameter.ai/cloud-security): Agents inventory AWS, Google Cloud, Azure and Oracle Cloud resources, trace real attack paths, and open the Terraform fix. - [Supply Chain Security](https://www.parameter.ai/supply-chain): Full dependency-graph resolution, malicious and vulnerable package detection, and an audit-ready SBOM. - [Sentinel — AI Security Code Review](https://www.parameter.ai/sentinel): Reviews GitHub, GitLab and Bitbucket pull requests for real, exploitable vulnerabilities before they merge. - [Watchtower — External Attack Surface Management](https://www.parameter.ai/watchtower): Maps the hostnames, IP addresses, services and websites exposed under a verified domain, and diffs every discovery run against the last. ## Solution briefs A downloadable two-page PDF per product: the problem, what a security team needs, and how the agents deliver it. Each page previews its PDF and links the download. - [Parameter Platform solution brief](https://www.parameter.ai/solution-briefs/platform): AI agents that find and prove vulnerabilities across your web apps, APIs, cloud and dependencies. Continuously, not once a year. PDF: https://www.parameter.ai/solution-briefs/parameter-platform-solution-brief.pdf - [Pentesting Agent solution brief](https://www.parameter.ai/solution-briefs/pentesting): Autonomous agents that pentest every release and prove every finding with a working exploit. PDF: https://www.parameter.ai/solution-briefs/parameter-pentesting-solution-brief.pdf - [Cloud Security solution brief](https://www.parameter.ai/solution-briefs/cloud-security): Agents inventory every resource across AWS, Google Cloud, Azure and Oracle Cloud, trace real attack paths, and open the Terraform fix as a pull request. PDF: https://www.parameter.ai/solution-briefs/parameter-cloud-security-solution-brief.pdf - [Supply Chain solution brief](https://www.parameter.ai/solution-briefs/supply-chain): Software supply chain security that resolves your full dependency graph, catches malicious packages before they ship, and keeps your SBOM audit-ready. PDF: https://www.parameter.ai/solution-briefs/parameter-supply-chain-solution-brief.pdf - [Sentinel solution brief](https://www.parameter.ai/solution-briefs/sentinel): Sentinel reviews each pull request the moment it opens and flags exploitable vulnerabilities as inline comments. The signal, not the noise. PDF: https://www.parameter.ai/solution-briefs/parameter-sentinel-solution-brief.pdf - [Secrets Detection solution brief](https://www.parameter.ai/solution-briefs/secrets-detection): Keys, tokens and credentials found across your repositories and their full history, correlated with the code, cloud and application findings around them. PDF: https://www.parameter.ai/solution-briefs/parameter-secrets-detection-solution-brief.pdf ## Knowledge Center Explainers for security categories, each covering what it is, how it works, the threats and risks, and how Parameter helps. - [Security information and event management (SIEM)](https://www.parameter.ai/knowledge-center/siem): What a SIEM is, how it collects and correlates security logs, where it falls short, and how proven findings cut the noise it has to sift. - [Security orchestration, automation and response (SOAR)](https://www.parameter.ai/knowledge-center/soar): What SOAR is, how playbooks automate triage and response across security tools, and where automation needs verified input to be safe. - [Endpoint detection and response (EDR)](https://www.parameter.ai/knowledge-center/edr): What EDR is, how it records and responds to activity on laptops and servers, and which attacks it can't see. - [Extended detection and response (XDR)](https://www.parameter.ai/knowledge-center/xdr): What XDR is, how it correlates endpoint, identity, email, network and cloud telemetry, and how it differs from EDR and SIEM. - [Managed detection and response (MDR)](https://www.parameter.ai/knowledge-center/mdr): What MDR is, what an outsourced detection and response team actually does, and what it can't cover on its own. - [Security operations center (SOC)](https://www.parameter.ai/knowledge-center/soc): What a security operations center is, the roles and tools inside it, and why most SOCs are overwhelmed by volume, not threats. - [AI security operations center (AI SOC)](https://www.parameter.ai/knowledge-center/ai-soc): What an AI SOC is, how AI agents triage and investigate alerts, and where human analysts stay in the loop. - [Threat intelligence](https://www.parameter.ai/knowledge-center/threat-intelligence): What threat intelligence is, the strategic, operational and tactical levels, and how to turn feeds into decisions that reduce risk. - [Vulnerability management](https://www.parameter.ai/knowledge-center/vulnerability-management): What vulnerability management is, the discover-assess-fix-verify cycle, and why backlogs grow faster than teams can close them. - [Risk-based vulnerability management (RBVM)](https://www.parameter.ai/knowledge-center/risk-based-vulnerability-management): What RBVM is, how it ranks vulnerabilities by exploitability and business impact instead of raw severity, and what data it needs. - [Continuous threat exposure management (CTEM)](https://www.parameter.ai/knowledge-center/ctem): What CTEM is, Gartner's five stages from scoping to mobilization, and why validation is the stage most programs skip. - [Exposure management](https://www.parameter.ai/knowledge-center/exposure-management): What exposure management is, how it differs from vulnerability management, and why attack paths matter more than individual findings. - [Patch management](https://www.parameter.ai/knowledge-center/patch-management): What patch management is, how teams test and roll out updates, and why patching everything on time is rarely possible. - [Auto remediation](https://www.parameter.ai/knowledge-center/auto-remediation): What auto remediation is, how security fixes are generated and applied automatically, and the guardrails that make it safe. - [Penetration testing (Pentesting)](https://www.parameter.ai/knowledge-center/penetration-testing): What penetration testing is, the main types and methodologies, and how continuous AI pentesting differs from an annual engagement. - [Attack surface management (ASM)](https://www.parameter.ai/knowledge-center/attack-surface-management): What attack surface management is, how external discovery finds unknown assets, and why inventory is the first security control. - [Cloud security](https://www.parameter.ai/knowledge-center/cloud-security): What cloud security is, the shared responsibility model, the controls it covers, and why misconfiguration is the leading cause of cloud breaches. - [Cloud security posture management (CSPM)](https://www.parameter.ai/knowledge-center/cspm): What CSPM is, how it checks cloud configuration against benchmarks, and why rule-based findings need attack-path context. - [Data security posture management (DSPM)](https://www.parameter.ai/knowledge-center/dspm): What DSPM is, how it discovers and classifies sensitive data across cloud stores, and how it maps who can reach it. - [AI security posture management (AI-SPM)](https://www.parameter.ai/knowledge-center/ai-spm): What AI-SPM is, how it inventories models, agents and AI pipelines, and the new risks such as prompt injection and model data leakage. - [Cloud-native application protection platform (CNAPP)](https://www.parameter.ai/knowledge-center/cnapp): What a CNAPP is, the posture, workload and code capabilities it combines, and why unified context matters more than feature count. - [Cloud infrastructure entitlement management (CIEM)](https://www.parameter.ai/knowledge-center/ciem): What CIEM is, how it finds excessive cloud permissions and identity sprawl, and why the risk is in what an identity can reach, not just what it holds. - [Infrastructure as code security (IaC security)](https://www.parameter.ai/knowledge-center/iac-security): What IaC security is, how scanning Terraform, CloudFormation and Pulumi catches misconfigurations before deploy, and why fixes belong in code. - [Kubernetes and container security (KSPM)](https://www.parameter.ai/knowledge-center/kspm): What Kubernetes security posture management covers, from cluster configuration and RBAC to image vulnerabilities, and how it fits between CSPM and CNAPP. - [Attack path analysis](https://www.parameter.ai/knowledge-center/attack-path-analysis): What attack path analysis is, how it chains minor findings into routes to critical assets, and why proven paths beat theoretical graphs. - [Cloud penetration testing](https://www.parameter.ai/knowledge-center/cloud-penetration-testing): What cloud penetration testing is, how it differs from a network pentest, what provider rules allow, and how agents test cloud estates continuously. - [Cloud workload protection platform (CWPP)](https://www.parameter.ai/knowledge-center/cwpp): What a CWPP is, how it protects VMs, containers and serverless functions at runtime, and how it fits alongside CSPM inside a CNAPP. - [Cloud detection and response (CDR)](https://www.parameter.ai/knowledge-center/cdr): What CDR is, how it detects attacks in cloud control plane logs and workloads, and why it needs posture context to separate threats from noise. - [SaaS security posture management (SSPM)](https://www.parameter.ai/knowledge-center/sspm): What SSPM is, how it finds misconfigurations in SaaS apps like Okta, GitHub and Slack, and how it fits with CSPM and DSPM in the posture family. - [Data loss prevention (DLP)](https://www.parameter.ai/knowledge-center/dlp): What DLP is, how it detects and blocks sensitive data leaving through email, endpoints and cloud apps, and how it relates to DSPM. - [Cloud access security broker (CASB)](https://www.parameter.ai/knowledge-center/casb): What a CASB is, how it gives visibility and control over SaaS usage and shadow IT, and where it fits in SSE and zero trust architectures. - [Shared responsibility model](https://www.parameter.ai/knowledge-center/shared-responsibility-model): What the cloud shared responsibility model is, where the provider's job ends and yours begins across IaaS, PaaS and SaaS, and where breaches happen. - [Application security (AppSec)](https://www.parameter.ai/knowledge-center/application-security): What application security is, the testing methods from SAST to pentesting, and why business logic flaws escape most tools. - [Application security posture management (ASPM)](https://www.parameter.ai/knowledge-center/aspm): What ASPM is, how it unifies findings from AppSec tools into one prioritized view, and what it needs to prioritize well. - [DevSecOps](https://www.parameter.ai/knowledge-center/devsecops): What DevSecOps is, how security is built into CI/CD pipelines, and what it takes to make developers want the checks. - [Shift left security](https://www.parameter.ai/knowledge-center/shift-left-security): What shift left security means, why fixing flaws earlier costs less, and how to shift left without flooding developers. - [Software supply chain security](https://www.parameter.ai/knowledge-center/software-supply-chain-security): What software supply chain security is, from vulnerable dependencies to malicious packages and compromised builds, and how to prioritize it. - [Software bill of materials (SBOM)](https://www.parameter.ai/knowledge-center/sbom): What an SBOM is, the SPDX and CycloneDX formats, who requires them, and why an SBOM is only useful if it matches the build. - [Secrets detection](https://www.parameter.ai/knowledge-center/secrets-detection): What secrets detection is, how leaked API keys and credentials are found in code and git history, and why deleting the line isn't enough. - [Static application security testing (SAST)](https://www.parameter.ai/knowledge-center/sast): What SAST is, how static analysis finds vulnerabilities in source code, and why proving a finding beats matching a pattern. - [Dynamic application security testing (DAST)](https://www.parameter.ai/knowledge-center/dast): What DAST is, how it tests running applications and APIs from the outside, and why agent-driven testing finds what crawlers miss. - [Software composition analysis (SCA)](https://www.parameter.ai/knowledge-center/sca): What SCA is, how it finds vulnerable and risky open source dependencies, and why reachability decides which findings matter. - [Reachability analysis](https://www.parameter.ai/knowledge-center/reachability-analysis): What reachability analysis is, how call-graph tracing decides whether a vulnerable dependency can be exploited, and why it cuts most SCA noise. - [API security](https://www.parameter.ai/knowledge-center/api-security): What API security is, how APIs are attacked through authorization and business logic flaws, and how to test them continuously. - [Secure code review and AI code review (AI code review)](https://www.parameter.ai/knowledge-center/ai-code-review): What secure code review is, how AI code review finds vulnerabilities in pull requests, and how it differs from static analysis. - [Broken access control, BOLA and IDOR (Broken access control)](https://www.parameter.ai/knowledge-center/broken-access-control): What broken access control, BOLA and IDOR are, why they top the OWASP Top 10, and why scanners miss the business logic flaws that agents find. - [LLM and AI application security (LLM security)](https://www.parameter.ai/knowledge-center/llm-security): What LLM application security is, how prompt injection and the OWASP LLM Top 10 work, and how to test apps built on large language models. - [AI-generated code security](https://www.parameter.ai/knowledge-center/ai-generated-code-security): What AI-generated code security is, why Copilot, Cursor and vibe coding output introduces vulnerabilities, and how to review it at the speed it is written. - [Mobile application security](https://www.parameter.ai/knowledge-center/mobile-application-security): What mobile application security is, how Android and iOS apps are attacked through their code, storage and APIs, and how to test them. - [IAST and RASP](https://www.parameter.ai/knowledge-center/iast-rasp): What interactive application security testing (IAST) and runtime application self-protection (RASP) are, how instrumentation works, and where they fit today. - [Vulnerability prioritization](https://www.parameter.ai/knowledge-center/vulnerability-prioritization): What vulnerability prioritization is, how CVSS, EPSS and KEV differ, and why exploitability in your environment matters more than a base score. - [Threat modeling](https://www.parameter.ai/knowledge-center/threat-modeling): What threat modeling is, how frameworks like STRIDE identify design-level risks, and how to keep a threat model current as code changes. - [Container image scanning](https://www.parameter.ai/knowledge-center/container-image-scanning): What container image scanning is, how it finds vulnerable packages and misconfigurations in images, and why runtime context decides what to fix. - [Security operations (SecOps)](https://www.parameter.ai/knowledge-center/secops): What SecOps is, how security and IT operations share responsibility for protecting production, and the metrics that show it works. - [Operational security (OPSEC)](https://www.parameter.ai/knowledge-center/operational-security): What operational security (OPSEC) is, the five-step process, and how everyday information leaks give attackers a head start. - [Operational technology security (OT security)](https://www.parameter.ai/knowledge-center/ot-security): What OT security is, how it protects industrial control systems, and why IT security practices can't be copied across unchanged. - [Zero trust](https://www.parameter.ai/knowledge-center/zero-trust): What zero trust is, the principles behind 'never trust, always verify', and why authorization inside your application matters as much as the network. - [Red teaming](https://www.parameter.ai/knowledge-center/red-teaming): What red teaming is, how it differs from a penetration test, how engagements run, and what red team as a service changes. - [External attack surface management (EASM)](https://www.parameter.ai/knowledge-center/easm): What EASM is, how it discovers internet-facing assets you didn't know about, and why discovery needs validation to be useful. - [Breach and attack simulation (BAS)](https://www.parameter.ai/knowledge-center/breach-and-attack-simulation): What BAS is, how it tests whether security controls stop known attack techniques, and how it compares with automated pentesting. - [Bug bounty and vulnerability disclosure programs (Bug bounty / VDP)](https://www.parameter.ai/knowledge-center/bug-bounty-vdp): The difference between a bug bounty and a VDP, how each program runs, where they fall short, and how they fit next to pentesting. - [Purple teaming](https://www.parameter.ai/knowledge-center/purple-teaming): What purple teaming is, how attackers and defenders work together to close detection gaps, and how to run an exercise. - [Offensive security (OffSec)](https://www.parameter.ai/knowledge-center/offensive-security): What offensive security covers, from pentesting and red teaming to bug bounties, and why testing like an attacker beats assuming controls work. - [Incident response (IR)](https://www.parameter.ai/knowledge-center/incident-response): What incident response is, the phases of the IR lifecycle, what goes wrong under pressure, and how to shorten the next incident. - [Threat hunting](https://www.parameter.ai/knowledge-center/threat-hunting): What threat hunting is, how hypothesis-driven hunts find attackers that alerts missed, and what makes a hunting program work. - [Mean time to detect and mean time to respond (MTTD / MTTR)](https://www.parameter.ai/knowledge-center/mttd-mttr): What MTTD and MTTR measure, how to calculate them, the traps in using them, and how to bring both down. - [Payment Card Industry Data Security Standard (PCI DSS)](https://www.parameter.ai/knowledge-center/pci-dss): What PCI DSS is, who must comply, the 12 requirements, and what version 4.0 asks of vulnerability management and penetration testing. - [ISO/IEC 27001 (ISO 27001)](https://www.parameter.ai/knowledge-center/iso-27001): What ISO 27001 is, how an ISMS and Annex A controls work, the certification process, and where technical testing fits in. - [SOC 2](https://www.parameter.ai/knowledge-center/soc-2): What SOC 2 is, the five Trust Services Criteria, Type I vs Type II reports, and what auditors expect for vulnerability testing. - [Federal Risk and Authorization Management Program (FedRAMP)](https://www.parameter.ai/knowledge-center/fedramp): What FedRAMP is, the Low, Moderate and High baselines, the authorization path, and its penetration testing and continuous monitoring demands. - [Health Insurance Portability and Accountability Act (HIPAA)](https://www.parameter.ai/knowledge-center/hipaa): What the HIPAA Security Rule requires, who it applies to, and where risk analysis, vulnerability scanning and penetration testing fit. - [Digital Operational Resilience Act (DORA)](https://www.parameter.ai/knowledge-center/dora): What DORA requires of EU financial entities, including resilience testing, threat-led penetration testing (TLPT) and ICT third-party risk. - [NYDFS Cybersecurity Regulation (23 NYCRR 500) (NYDFS Part 500)](https://www.parameter.ai/knowledge-center/nydfs-part-500): What 23 NYCRR 500 requires of New York financial services firms, including annual penetration testing, scanning and 72-hour notification. - [NIST Cybersecurity Framework and NIST SP 800-53 (NIST CSF / 800-53)](https://www.parameter.ai/knowledge-center/nist-csf-800-53): How the NIST CSF and NIST SP 800-53 relate, what each contains, and which controls cover vulnerability scanning and penetration testing. - [Cybersecurity Maturity Model Certification (CMMC)](https://www.parameter.ai/knowledge-center/cmmc): What CMMC 2.0 requires of US defense contractors, its three levels, and how assessments and penetration testing fit in. - [HITRUST CSF (HITRUST)](https://www.parameter.ai/knowledge-center/hitrust): What HITRUST certification is, its e1, i1 and r2 assessments, and why healthcare buyers ask for it and its penetration testing requirements. - [NIS2 Directive (NIS2)](https://www.parameter.ai/knowledge-center/nis2): What the EU NIS2 Directive requires, which entities it covers, the 24-hour reporting rule, management liability and fines. - [UAE Information Assurance Standard (UAE IA (NESA))](https://www.parameter.ai/knowledge-center/uae-ia-standard): What the UAE Information Assurance Standard (formerly NESA) requires, who must follow it, and how testing supports compliance. - [Saudi NCA Essential Cybersecurity Controls (NCA ECC)](https://www.parameter.ai/knowledge-center/saudi-nca-ecc): What Saudi Arabia's NCA Essential Cybersecurity Controls require, who must comply, and the dedicated penetration testing control. - [SAMA Cyber Security Framework (SAMA CSF)](https://www.parameter.ai/knowledge-center/sama-csf): What the Saudi Central Bank's Cyber Security Framework requires of financial institutions, its maturity levels, and where testing fits. - [ISO/IEC 42001 (ISO 42001)](https://www.parameter.ai/knowledge-center/iso-42001): What ISO/IEC 42001 is, how an AI management system works, and how it relates to ISO 27001, AI security and the EU AI Act. - [EU Artificial Intelligence Act (EU AI Act)](https://www.parameter.ai/knowledge-center/eu-ai-act): What the EU AI Act requires, its risk categories, the cybersecurity duties for high-risk AI, key dates and fines. - [General Data Protection Regulation (GDPR)](https://www.parameter.ai/knowledge-center/gdpr): What GDPR requires for security of processing, the 72-hour breach rule, fines, and how regular testing supports Article 32. - [CIS Critical Security Controls (CIS Controls)](https://www.parameter.ai/knowledge-center/cis-controls): What the 18 CIS Controls are, how implementation groups prioritize them, and where vulnerability management and penetration testing fit. - [OWASP Application Security Verification Standard (OWASP ASVS)](https://www.parameter.ai/knowledge-center/owasp-asvs): What OWASP ASVS is, its three verification levels, and how teams use it to scope penetration tests and secure development. - [CREST accreditation (CREST)](https://www.parameter.ai/knowledge-center/crest): What CREST is, what CREST-accredited penetration testing means, where buyers require it, and how it fits alongside continuous testing. ## Penetration testing How the pentesting agents apply to specific needs. Each page defines the term, explains the workflow, and answers the common questions. - [Web application penetration testing](https://www.parameter.ai/pentesting/web-application-penetration-testing): SPAs, server-rendered apps, and their APIs tested for the vulnerabilities attackers use. - [API security testing](https://www.parameter.ai/pentesting/api-security-testing): REST, GraphQL, and gRPC endpoints tested for broken auth, IDOR, and logic flaws. - [Red team as a service](https://www.parameter.ai/pentesting/red-team-as-a-service): Adversarial testing that does not stop: agents chain real attack paths and prove every step. - [External attack surface management](https://www.parameter.ai/pentesting/external-attack-surface-management): Everything reachable from the internet, mapped continuously and then tested. - [Managed vulnerability scanning](https://www.parameter.ai/pentesting/managed-vulnerability-scanning): Scanning as an outcome: every finding validated, ranked by reachability, and delivered with a fix. - [Android penetration testing](https://www.parameter.ai/pentesting/android-penetration-testing): The APIs, auth flows, and source behind your Android app, tested on every release. ## Industries The same agents explained for one regulated vertical: what breaks there, which frameworks the buyer answers to, and what evidence a run produces. - [Fintech](https://www.parameter.ai/use-cases/fintech): Payment flows, partner APIs, cloud, and code pentested as they change, with evidence for PCI DSS and SOC 2. - [Healthcare](https://www.parameter.ai/use-cases/healthcare): The code, cloud, and dependencies behind patient data pentested on every release, with evidence for HIPAA, SOC 2, and HITRUST. ## Compliance What SOC 2, ISO 27001, PCI DSS, and FedRAMP each ask of penetration testing, clause by clause, and what a run produces for it, including where each still expects a qualified human or accredited assessor. - [SOC 2 penetration testing](https://www.parameter.ai/compliance/soc-2-penetration-testing): What a SOC 2 auditor expects from penetration testing, clause by clause, and how a run on every release supplies it. - [ISO 27001 penetration testing](https://www.parameter.ai/compliance/iso-27001-penetration-testing): What ISO 27001 controls expect from penetration testing, clause by clause, and how continuous runs supply the evidence. - [PCI pentest](https://www.parameter.ai/compliance/pci-pentest): What PCI DSS v4.0 Requirement 11.4 asks, what a QSA wants, and where continuous testing fits alongside the annual test. - [FedRAMP penetration testing](https://www.parameter.ai/compliance/fedramp-penetration-testing): What FedRAMP requires of penetration testing, the 3PAO's role, and how continuous testing supports continuous monitoring. ## Alternatives How Parameter compares with the pentesting vendors buyers evaluate it against. Each page states what the other product is, where the two differ, and where each fits. - [Cobalt alternative](https://www.parameter.ai/alternative/cobalt): Scheduled, human-led pentest engagements, compared with agents that test on every release and prove every finding. - [Horizon3 alternative](https://www.parameter.ai/alternative/horizon3): Autonomous network pentesting from Horizon3, compared with agents built for the application layer: code, cloud, and dependencies. - [NodeZero alternative](https://www.parameter.ai/alternative/nodezero): Horizon3's NodeZero, compared with Parameter at the product level: attack surface, deployment, validation, and where findings land. - [Pentera alternative](https://www.parameter.ai/alternative/pentera): Pentera's automated security validation of the network, compared with agents that pentest the application layer on every release. - [Bugcrowd alternative](https://www.parameter.ai/alternative/bugcrowd): A crowdsourced researcher program, compared with agents that test everything continuously and deliver findings already proven. - [HackerOne alternative](https://www.parameter.ai/alternative/hackerone): Bug bounty and community-delivered pentests, compared with agents that test on every release and prove every finding. - [XBOW alternative](https://www.parameter.ai/alternative/xbow): XBOW's autonomous black-box pentests, compared with agents that test code, cloud, and dependencies on every release. - [Aikido alternative](https://www.parameter.ai/alternative/aikido): Aikido's self-serve scanner platform and AI pentest, compared with agents that pentest on every release and prove every finding. ## Free tools Interactive tools that need no account. Each runs entirely in the browser. - [CVSS calculator (v3.1)](https://www.parameter.ai/tools/cvss-calculator): Score a vulnerability against the FIRST specification, with base, temporal and environmental metrics and the definition of every value on screen while you choose it. ## Company - [About](https://www.parameter.ai/about): What Parameter is building and why. - [Security](https://www.parameter.ai/security): How Parameter secures its own platform and handles customer data. - [Careers](https://www.parameter.ai/careers): Open roles in San Francisco. - [Book a call](https://www.parameter.ai/book-a-call): Talk to the team and see first findings in 24 hours. ## Glossary Definitions of the vulnerabilities, testing methods and scoring systems in this field. Each entry has a standalone definition, example requests, how it is tested, and how it is fixed. - [Attack surface](https://www.parameter.ai/learn/attack-surface): An attack surface is every point where an attacker can try to get into a system, affect it, or pull data out of it: internet-facing hosts, APIs, login pages, cloud services, internal network services, physical access and the people who can be tricked. The larger and less known it is, the more places a single flaw can be exploited. - [Authenticated penetration testing](https://www.parameter.ai/learn/authenticated-penetration-testing): Authenticated penetration testing is a pentest in which the tester logs in with real accounts, usually one per role and tenant, and attacks the application from inside the session, looking for users who can read or change data, or run functions, that their role should not allow. - [Black-box, gray-box and white-box penetration testing](https://www.parameter.ai/learn/black-box-gray-box-white-box-testing): Black-box, gray-box and white-box testing describe how much a penetration tester is told before starting: nothing beyond a target (black-box), partial information such as accounts and API specs (gray-box), or full access to source code, architecture and configuration (white-box). - [Broken function level authorization (BFLA)](https://www.parameter.ai/learn/broken-function-level-authorization): Broken function level authorization (BFLA) is an API vulnerability where an endpoint meant for a higher role, such as an admin or support action, does not check the caller's role, so an ordinary user calls it directly and performs privileged operations like managing users or changing settings. - [Broken object level authorization (BOLA)](https://www.parameter.ai/learn/broken-object-level-authorization): Broken object level authorization (BOLA) is an API vulnerability where an endpoint accepts an object ID from the client and returns or changes that object without checking the caller owns it, so an attacker swaps in another user's or tenant's ID and reads, edits or deletes their records. - [Business logic vulnerability](https://www.parameter.ai/learn/business-logic-vulnerability): A business logic vulnerability is a flaw in how an application enforces its own rules, letting an attacker abuse legitimate features in unintended sequences or with unexpected values to skip payment, pay negative amounts, or reach states the workflow was meant to prevent. - [CI/CD pipeline security](https://www.parameter.ai/learn/ci-cd-pipeline-security): CI/CD pipeline security is the practice of controlling who and what can change, trigger and run your build and deployment pipelines, and what those pipelines can reach, so an attacker who gets into a branch, a third-party action or a runner cannot use the pipeline's secrets and deploy rights to ship code or reach production. - [Common Vulnerabilities and Exposures (CVE)](https://www.parameter.ai/learn/common-vulnerabilities-and-exposures): Common Vulnerabilities and Exposures (CVE) is the public catalog that gives each disclosed software or hardware vulnerability a unique ID such as CVE-2023-4966. A CVE Numbering Authority assigns the ID and publishes a record naming the affected product, versions, weakness type and references, so every tool and advisory refers to the same flaw. - [Common Vulnerability Scoring System (CVSS)](https://www.parameter.ai/learn/common-vulnerability-scoring-system): Common Vulnerability Scoring System (CVSS) is an open standard from FIRST that rates the severity of a software vulnerability from 0.0 to 10.0. Metrics describing how a flaw is exploited and what it affects are encoded in a vector string, which produces the score. - [Common Weakness Enumeration (CWE)](https://www.parameter.ai/learn/common-weakness-enumeration): Common Weakness Enumeration (CWE) is MITRE's catalog of the types of mistakes in software and hardware that lead to vulnerabilities, such as CWE-89 SQL injection or CWE-639 authorization bypass through a user-controlled key. A CVE names one flaw in one product; a CWE names the kind of flaw, so findings can be grouped by root cause. - [Continuous penetration testing](https://www.parameter.ai/learn/continuous-penetration-testing): Continuous penetration testing is offensive testing that runs repeatedly on its own, triggered by a schedule, a release or a detected change, so new endpoints, roles and exposed services are tested for exploitable flaws within hours or days of appearing, not at the next annual engagement. - [Continuous security validation](https://www.parameter.ai/learn/continuous-security-validation): Continuous security validation is the practice of repeatedly running safe, simulated attack techniques against your own environment to prove whether exposures are actually exploitable and whether prevention and detection controls stop or flag them. It covers breach and attack simulation, automated penetration testing and the validation step of exposure management programs. - [Cross-site request forgery (CSRF)](https://www.parameter.ai/learn/cross-site-request-forgery): Cross-site request forgery (CSRF) is a vulnerability where a site the attacker controls makes a logged-in victim's browser send a state-changing request to another application, which accepts it because the browser attaches the victim's cookies automatically. - [Cross-site scripting (XSS)](https://www.parameter.ai/learn/cross-site-scripting): Cross-site scripting (XSS) is a vulnerability where an application places attacker-supplied input into a page without encoding it, so the victim's browser runs the attacker's JavaScript with the site's origin and can read the page, act as the logged-in user, or change what they see. - [Dependency confusion](https://www.parameter.ai/learn/dependency-confusion): Dependency confusion is a supply chain attack where an attacker publishes a package to a public registry under the same name as a company's internal package, usually with a higher version number, so build tools that consult both sources install the attacker's code and run it on developer machines and CI servers. - [Exploit Prediction Scoring System (EPSS)](https://www.parameter.ai/learn/exploit-prediction-scoring-system): Exploit Prediction Scoring System (EPSS) is a data-driven model from FIRST that estimates the probability a given CVE will be exploited in the wild within the next 30 days. It outputs a probability from 0 to 1 and a percentile, updated daily for every published CVE. - [GraphQL introspection](https://www.parameter.ai/learn/graphql-introspection): GraphQL introspection is the built-in GraphQL feature that lets any client query a server's schema through the __schema and __type fields, returning every type, field, argument and mutation; left enabled in production, it hands an attacker a complete map of the API to probe for authorization flaws. - [Instance metadata service (IMDS)](https://www.parameter.ai/learn/instance-metadata-service): The instance metadata service (IMDS) is a local HTTP endpoint at 169.254.169.254 that a cloud VM queries to learn about itself, including the temporary credentials of its attached role, which makes it the highest-value target for a server-side request forgery attack. - [Internal vs external penetration testing](https://www.parameter.ai/learn/internal-vs-external-penetration-testing): Internal and external penetration testing differ by starting position. An external test attacks from the internet with no access, looking for a way in; an internal test starts from inside the network or with a user's access, assuming a breach has already happened, and measures how far an attacker could spread from there. - [JWT algorithm confusion](https://www.parameter.ai/learn/jwt-algorithm-confusion): JWT algorithm confusion is a vulnerability where an attacker changes a token's alg header so the server verifies it with the wrong algorithm, signing an RS256 token with the public key as an HMAC secret or setting alg to none, and forging a valid token. - [Known Exploited Vulnerabilities catalog (KEV)](https://www.parameter.ai/learn/known-exploited-vulnerabilities-catalog): Known Exploited Vulnerabilities catalog (KEV) is a list, maintained by CISA, of vulnerabilities with reliable evidence of active exploitation in the wild. Each entry names the CVE, product, a required remediation action and a due date, and federal civilian agencies must remediate them on that schedule. - [Mass assignment](https://www.parameter.ai/learn/mass-assignment): Mass assignment is a vulnerability where a framework copies every field in a request body onto a data model, so an attacker adds fields the form never offered, such as role, plan or owner_id, and changes properties they should not control, often granting themselves higher privileges. - [OWASP Top 10](https://www.parameter.ai/learn/owasp-top-10): The OWASP Top 10 is the Open Worldwide Application Security Project's ranked list of the ten most critical web application security risk categories, such as broken access control and injection. The current edition is 2025. Each category groups related CWE weaknesses, and sibling lists cover APIs and LLM applications. - [Penetration test attestation letter](https://www.parameter.ai/learn/penetration-test-attestation-letter): A penetration test attestation letter is a short signed statement from the testing firm confirming that it tested a named scope during stated dates, with a stated method, and summarizing findings and remediation status. Companies share it with customers in place of the full report, which stays confidential. - [Penetration testing as a service (PTaaS)](https://www.parameter.ai/learn/penetration-testing-as-a-service): Penetration testing as a service (PTaaS) is a way of buying pentests as a subscription delivered through a web platform: you scope and launch tests in a portal, testers or automated agents post findings there as they confirm them, and you track fixes and request retests in the same place, usually under an annual contract. - [Penetration testing cost](https://www.parameter.ai/learn/penetration-testing-cost): Penetration testing cost is the price of a security test, set mostly by how many tester-days the scope needs multiplied by the provider's day rate. Published ranges for a single engagement run from a few thousand dollars for one small target to tens of thousands for multi-role applications, networks and cloud environments. - [Penetration testing methodology](https://www.parameter.ai/learn/penetration-testing-methodology): A penetration testing methodology is the documented sequence a tester follows, from scoping and reconnaissance through exploitation, post-exploitation, reporting and retest, usually based on a published standard such as PTES, the OWASP WSTG or NIST SP 800-115, so that coverage is repeatable and results can be compared. - [Pentest retest](https://www.parameter.ai/learn/pentest-retest): A pentest retest is a follow-up check in which the tester repeats the original reproduction steps for each reported finding after the fix ships, confirms whether the issue is gone, and issues an updated status for every finding. It verifies fixes; it is not a new test of the whole scope. - [Poisoned pipeline execution (PPE)](https://www.parameter.ai/learn/poisoned-pipeline-execution): Poisoned pipeline execution (PPE) is a CI/CD attack where someone who can push a branch or open a pull request changes the pipeline definition, or a file the pipeline runs such as a Makefile or test script, so the build system executes their commands with the pipeline's secrets and permissions. - [Privilege escalation](https://www.parameter.ai/learn/privilege-escalation): Privilege escalation is gaining access or permissions beyond what an account was granted: reaching another user's data at the same level (horizontal) or performing actions reserved for a higher role such as admin (vertical), usually because the server does not check authorization on every request. - [Prompt injection](https://www.parameter.ai/learn/prompt-injection): Prompt injection is a vulnerability in applications built on large language models where text supplied by a user, or hidden in a web page, email or document the model reads, is treated as instructions, so an attacker can override the developer's intent and make the model ignore rules, leak context or misuse its connected tools. - [Proof of concept exploit (PoC)](https://www.parameter.ai/learn/proof-of-concept-exploit): A proof of concept (PoC) exploit is the smallest demonstration that a vulnerability is real and exploitable: a request, script or sequence of steps that triggers the flaw and shows its effect without doing further harm. In a pentest finding it is the evidence; published publicly for a CVE, it is a signal that exploitation is getting easier. - [Race condition](https://www.parameter.ai/learn/race-condition): A race condition is a vulnerability where an application checks a condition and then acts on it as separate steps, so two requests arriving at nearly the same time both pass the check before either acts, letting an attacker overrun a limit or bypass a guard. - [Rules of engagement (RoE)](https://www.parameter.ai/learn/rules-of-engagement): Rules of engagement (RoE) are the signed document that authorizes a security test and sets its limits: which systems may be attacked, when, from where, with which techniques, how data is handled, who to call when something breaks, and when testing must stop. - [Secure code review](https://www.parameter.ai/learn/secure-code-review): Secure code review is the examination of source code, usually a pull request diff, specifically to find security flaws such as missing authorization checks, injection, unsafe deserialization and leaked secrets, by a person, a static analysis tool, an AI reviewer, or a combination, before the change reaches production. - [Segmentation testing](https://www.parameter.ai/learn/segmentation-testing): Segmentation testing is penetration testing that verifies network controls isolate the cardholder data environment (CDE) from out-of-scope networks. A tester attempts to reach the CDE from each out-of-scope segment and confirms the segmentation controls block that access. - [Server-side request forgery (SSRF)](https://www.parameter.ai/learn/server-side-request-forgery): Server-side request forgery (SSRF) is a vulnerability where an attacker makes a server send HTTP requests to a destination of the attacker's choosing, reaching internal services, cloud metadata endpoints, and other hosts the attacker cannot address directly. - [Shadow API](https://www.parameter.ai/learn/shadow-api): A shadow API is an API endpoint, version or host that runs in production but is missing from the organization's inventory and documentation, so it skips the security reviews, gateway policies and monitoring applied to known APIs and often exposes old or unprotected functionality to anyone who finds it. - [SQL injection (SQLi)](https://www.parameter.ai/learn/sql-injection): SQL injection (SQLi) is a vulnerability where user input is concatenated into a database query, letting an attacker change the query's logic to read rows they should not see, bypass login checks, modify or delete data, and sometimes run commands on the database server. - [Subdomain takeover](https://www.parameter.ai/learn/subdomain-takeover): A subdomain takeover is a vulnerability where a DNS record still points to a deprovisioned cloud resource, letting an attacker register that resource and serve their own content from a subdomain the organization still owns, such as a dangling CNAME to a deleted host. - [Types of penetration testing](https://www.parameter.ai/learn/types-of-penetration-testing): Types of penetration testing are the ways pentests are classified: by target (external network, internal network, web application, API, mobile, cloud, wireless, social engineering, physical) and by how much the tester knows beforehand (black-box, gray-box, white-box). The type decides which weaknesses a test can find at all. - [Vulnerability scanning vs penetration testing](https://www.parameter.ai/learn/vulnerability-scanning-vs-penetration-testing): Vulnerability scanning is automated checking of systems against signatures of known weaknesses, producing a list of possible issues. Penetration testing is a person attempting to exploit weaknesses, including ones no signature covers, to prove which are real and what an attacker could reach through them. - [Zero-day vulnerability](https://www.parameter.ai/learn/zero-day-vulnerability): A zero-day vulnerability is a security flaw that attackers exploit before the vendor has released a patch for it, so defenders have had zero days to fix it. Once a patch ships, the same flaw becomes an n-day: still dangerous on unpatched systems, but now fixable. ## Blog - [57 Best Penetration Testing Companies to Hire in 2026](https://www.parameter.ai/blog/penetration-testing-companies): CISOs, find the right penetration testing companies for your sprint cadence and close security gaps before they cost you. - [15 Best AI Penetration Testing Tools for 2026](https://www.parameter.ai/blog/best-ai-penetration-testing-tools): The best AI penetration testing tools for 2026, reviewed so security engineers stop missing vulnerabilities shipped between engagements. - [16 Best Autonomous Penetration Testing Security Vendors 2026](https://www.parameter.ai/blog/autonomous-penetration-testing-security-vendors): CISOs compare autonomous penetration testing security vendors wrong. Skip the feature matrix and find tools that prove real exploit paths. - [12 Types of Penetration Testing and How to Choose the Right One](https://www.parameter.ai/blog/types-of-penetration-testing-guide): Not all types of penetration testing protect equally. CISOs who match the right type to their attack surface avoid costly blind spots. - [AI Pentesting vs Traditional Pentesting: Which One Wins?](https://www.parameter.ai/blog/ai-pentesting-vs-traditional-pentesting): A lone glowing blue cube stands apart from scattered white cubes in a near-black void, signaling autonomous AI rising above traditional methods. - [Internal vs. External Penetration Testing Differences Explained](https://www.parameter.ai/blog/internal-vs-external-penetration-testing): A single electric-blue voxel cube glows among scattered white and grey cubes on a near-black ground, signaling one clear answer amid complexity. - [Is Annual Penetration Testing Still Enough in 2026?](https://www.parameter.ai/blog/annual-penetration-testing): A voxel conveyor carries grey cubes through a gate, one glowing blue cube held back and blocked. - [What Is Black Box Penetration Testing and How Does It Work](https://www.parameter.ai/blog/black-box-penetration-testing): Black box penetration testing explained for security engineers, so you can avoid blind spots and map real external exposure before attackers do. - [Penetration Testing Cost: 2026 Buyer's Pricing Guide](https://www.parameter.ai/blog/penetration-testing-cost): Avoid hidden retesting fees. Your 2026 CISO guide to true penetration testing cost starts here. - [8 Penetration Testing Methodology Types Explained](https://www.parameter.ai/blog/penetration-testing-methodology): 8 penetration testing methodology types explained so security engineers can choose the right framework and avoid costly coverage gaps. - [12 Types of Penetration Testing Explained for 2026](https://www.parameter.ai/blog/types-of-penetration-testing): CISOs, learn all types of penetration testing for 2026 and avoid the blind spots that leave your threat model dangerously incomplete. - [What Is Penetration Testing and How Does It Protect You](https://www.parameter.ai/blog/what-is-penetration-testing): What is penetration testing, really? CISOs learn why point-in-time tests expire fast and how to avoid the gaps that leave you exposed. - [13 Benefits of Penetration Testing Every Business Should Know](https://www.parameter.ai/blog/benefits-of-penetration-testing): Security leaders gain 13 benefits of penetration testing that stop breaches, audit failures, and reputational damage before they happen. - [The bug is rarely in the diff: reviewing 5,000 PRs per day](https://www.parameter.ai/blog/agentic-code-review-explained): How Sentinel, our agentic PR review bot, catches exploitable security bugs before they merge by following execution paths across a pull request, not just scanning the diff. - [We ran 2,300 pentests in 3 weeks. Here's what our AI finds](https://www.parameter.ai/blog/what-ai-pentests-find): In three weeks our agents ran 2,300 autonomous AI penetration tests. ~37% of findings were high or critical, mostly authorization, IDOR, and business-logic bugs scanners miss. - [Hex Security is now Parameter](https://www.parameter.ai/blog/we-are-now-parameter): Hex Security has a new name and a new home. The company behind it, Anytool, Inc., is unchanged, and so is the product. Here is what changed, what didn't, and where to verify it, including in person at Black Hat USA 2026. - [It's the harness, not the model: +26% on CryptanalysisBench's hard set](https://www.parameter.ai/blog/cryptanalysisbench-harness-not-model): Fix the model to Claude Opus 4.8, keep the paper's protocol, change only the harness, and the scaffold lifts Tier-2 from 31/140 (22.1%) to 39/140 (27.9%). - [Continuous penetration testing vs. annual pentests: what actually changed](https://www.parameter.ai/blog/continuous-penetration-testing-vs-annual-pentests): The annual pentest was built for a world that shipped software twice a year. Here's what continuous penetration testing means, where the market's definitions fall apart, and how to tell real coverage from a scanner in a trench coat. - [SSRF to cloud takeover: how one URL field becomes credential theft](https://www.parameter.ai/blog/ssrf-to-cloud-credentials): Server-side request forgery turns an innocent 'fetch this URL' feature into a path straight to your cloud's metadata endpoint, and the temporary credentials behind it. Here's the full chain and how to break it. - [Security at the speed of development](https://www.parameter.ai/blog/security-at-the-speed-of-development): Security can't be the team that says no once a quarter. It has to move at the cadence engineering already runs at: every commit, every deploy. ## Videos Short explainer videos from the team, one vulnerability per episode. Each has a page here with the video, its description, and a link to the upload on YouTube. - [Row Level Security (RLS)](https://www.parameter.ai/videos/row-level-security-rls): Why a browser-side filter hides records without restricting access, and how row-level security (RLS) policies in the database enforce the boundary. - [Broken Access Control (IDOR)](https://www.parameter.ai/videos/broken-access-control-idor): What an insecure direct object reference (IDOR) is, how a missing permission check exposes private records, and why servers must authorize every request.