Vexaro SecurityGlossary

Security glossary

Plain-English answers to the questions that come up when you scope a penetration test or a compliance project: what each term means and why it matters.

Penetration testing

An authorised, simulated attack that confirms exploitable weaknesses instead of only listing them.

Read the explainer

Black / grey / white-box

How much the tester knows up front: nothing, credentials and a spec, or the full source.

Read the explainer

Pentest vs vulnerability scan

A scan flags possible issues automatically; a pentest confirms and chains exploitable ones.

Read the explainer

SOC 2 vs ISO 27001

SOC 2 is a CPA-issued attestation report; ISO 27001 is an accredited management-system certification.

Read the explainer

CVSS

An open standard that scores the technical severity of a vulnerability from 0 to 10.

Read the explainer

OWASP Top 10

A widely-referenced awareness list of the most critical web application security risks.

Read the explainer

Talk to a real practitioner.

Got a question these pages didn't answer? Tell us what you're trying to protect and we'll point you to the right engagement. The first consultation is free.