A
- Adversarial exposure validation
- Testing that uses attacker techniques to prove which exposures can actually be exploited. Gartner uses the term for a market category; Hadrian states it is named in Gartner's 2026 Market Guide for it.
- ASN (autonomous system number)
- A number that identifies a network run under one routing policy, such as an internet provider's or a large company's. ASM tools use ASNs as discovery seeds and to attribute IP ranges.
- Asset inventory
- The list of assets an organization knows it owns, with an owner and a status for each. External discovery is how an ASM tool adds the assets that are missing from it.
- Asset owner
- The team or person responsible for an asset and for fixing its exposures. In a group, ownership is usually set at the subsidiary or brand level first and then at the team level.
- Attack surface
- Every point where an attacker could try to get in: internet-facing hosts, applications, APIs, cloud resources, credentials and third-party connections.
- Attack surface management (ASM)
- The umbrella term for the continuous discovery, inventory, assessment and remediation of an organization's attack surface. It covers EASM, the external view, and CAASM, the internal inventory. See ASM vs EASM vs CAASM.
- Attribution
- Deciding that an asset belongs to the organization, and to which subsidiary, brand or owner. Good tools show the evidence.
- Automated red teaming
- Continuous, automated use of attacker techniques against your own surface to find exploitable paths.
B
- Blast radius
- How much else would be affected if an asset were compromised, such as connected systems and sensitive data. IONIX lists blast radius among the factors it uses to prioritize exposures.
- BOD 22-01
- CISA's Binding Operational Directive 22-01, which requires US federal civilian agencies to remediate vulnerabilities in the KEV catalog within set timeframes.
C
- CAASM (cyber asset attack surface management)
- An inventory built from the inside, by pulling and reconciling data from tools you already run.
- CNA (CVE Numbering Authority)
- An organization authorized to assign CVE IDs for vulnerabilities in its scope. FIRST cited a sharp rise in CNA-of-Last-Resort activity as one driver of its 2026 CVE forecast.
- Compensating control
- A measure that reduces risk while the underlying flaw remains, such as a WAF rule in front of an unpatched application.
- Configuration drift
- A gradual change in a system's settings away from the approved configuration, for example a WAF policy moved from blocking to monitoring. IONIX says its WAF Posture Management detects drift across WAF deployments.
- Continuous discovery
- Discovery that runs repeatedly, on a schedule or when events occur, rather than once. Hadrian, for example, says its scans typically run hourly or are event-triggered.
- CTEM (continuous threat exposure management)
- Gartner's term for a program that continually evaluates the accessibility, exposure and exploitability of assets. See What is CTEM.
- CVE (Common Vulnerabilities and Exposures)
- The public identifier for a disclosed vulnerability, written as CVE, the year and a number. An assigned CVE ID is one of CISA's three conditions for adding a vulnerability to the KEV catalog.
- CVSS (Common Vulnerability Scoring System)
- FIRST's standard for scoring a vulnerability's severity as a number that maps to low, medium, high and critical ratings. Severity describes the flaw, not whether it is exploited or reachable in your estate. Version 4.0 was published in November 2023.
Source: FIRST, CVSS
D
- Dangling DNS
- A DNS record that still points to a resource that no longer exists, which an attacker may be able to claim. A common cause of subdomain takeovers.
- Digital supply chain
- Third-party services and infrastructure your internet-facing assets depend on, such as hosting, CDNs, scripts and SaaS.
- Discovery seed
- A known asset, such as a domain, IP block or ASN, that a tool uses as a starting point for finding related assets.
E
- EASM (external attack surface management)
- Discovery and assessment of internet-facing assets from the outside, as an attacker sees them.
- EPSS
- The Exploit Prediction Scoring System, maintained by FIRST. It estimates the probability, from 0 to 1, that a published CVE will be exploited in the wild in the next 30 days, and scores are published daily.
Source: FIRST, EPSS
- Exploitability
- Whether an attacker could actually use a vulnerability against a specific asset, given its configuration and the controls in front of it. It differs from severity, which describes the flaw in general.
- Exposure management
- The broader practice of finding, prioritizing and reducing exposures across external, internal, cloud and identity surfaces.
- Exposure validation
- Confirming that an exposure is reachable and exploitable in your environment, rather than inferring risk from a version number.
F
- False positive
- A finding that reports an exposure that is not real, or an asset attributed to you that is not yours. Vendor figures for false-positive reduction are claims that differ in how they are measured.
I
- Internet-facing asset
- Any host, application, API, domain or cloud resource that can be reached from the public internet. External discovery focuses on these.
K
- KEV
- CISA's Known Exploited Vulnerabilities catalog. A vulnerability is added when it has a CVE ID, there is reliable evidence it has been exploited in the wild, and there is a clear remediation action.
L
- Log-only mode
- A setting in which a WAF rule records matching requests without blocking them. New virtual patches often start in this mode so teams can check for false blocks before enforcing.
M
- M&A discovery
- Finding and attributing the internet-facing assets of an acquired company, often before its inventory is merged with the parent's. IONIX and watchTowr both describe mapping assets from M&A.
- Mean time to remediate (MTTR)
- The average time from finding an exposure to fixing it.
P
- Preemptive exposure management
- watchTowr's name for its approach. A vendor term, not an analyst category.
- Proof of concept (POC)
- A time-boxed trial of a tool on your own estate, with agreed inputs and measures. For ASM, give every shortlisted vendor the same starting input and compare results. See the buyer's guide.
R
- Rapid reaction testing
- Re-testing an estate for a newly published threat as soon as it emerges. watchTowr uses the name Rapid Reaction for its version.
- Retest
- Checking a finding again after a fix to confirm the exposure is gone. Also called regression testing. Our findings table records which tools document it.
S
- Seedless discovery
- Discovery that starts from little more than the organization's name, without a list of domains or IP ranges.
- Shadow IT
- Systems and services set up without the security team's knowledge, such as a marketing microsite or a test cloud account.
- Subdomain takeover
- An attacker claiming a subdomain whose DNS record points to an abandoned resource.
T
- Third-party and fourth-party exposure
- Risk that comes from your suppliers (third parties) and their suppliers (fourth parties), such as a hosting provider or a script your sites load. IONIX says its discovery extends to third- and fourth-party assets.
V
- Virtual patching
- Blocking exploitation of a vulnerability at a control point, usually a WAF, before the software itself is patched.
W
- WAF (web application firewall)
- A filter in front of web applications that blocks malicious requests according to rules.
- WAF posture
- Whether internet-facing web assets actually sit behind a WAF, and whether that WAF is blocking rather than only monitoring. Gaps are common in acquired companies and in sites launched outside the standard stack.
Want the concepts in order? Read the nine ASM University lessons.