Security terms, defined plainly.

01 · Agentic AI

AI systems that plan and take actions using tools, such as browsing or calling APIs; they need testing for unsafe tool use and prompt injection.

02 · AI red teaming

Adversarial testing of AI systems for prompt injection, jailbreaks, data leakage and unsafe tool use.

03 · AI-assisted triage

Using a model to summarise, deduplicate and suggest severity for incoming reports before a human analyst confirms them.

04 · AI-native security platform

A security platform designed with AI in its core workflows rather than added on later — for example autonomous testing alongside human researchers — with people making final decisions.

05 · Attack surface

All points where an attacker could try to enter or extract data.

06 · Autonomous pentesting

Penetration testing performed by AI agents that discover, exploit and validate vulnerabilities without step-by-step human direction, such as AutoVAPT AI.

07 · Broken access control

Any flaw that lets a user act outside their intended permissions; the top risk in the OWASP Top 10.

08 · Bug bounty

A program that rewards independent researchers for reporting valid vulnerabilities.

09 · Coordinated disclosure

Reporting a vulnerability privately and publishing details only after a fix or agreed deadline.

10 · CTEM

Continuous threat exposure management — a cyclical program for reducing exposure.

11 · CTF

Capture the flag — a security competition where participants solve hacking challenges to find hidden flags.

12 · CVE

Common Vulnerabilities and Exposures — a public identifier assigned to a specific disclosed vulnerability.

13 · CVSS

Common Vulnerability Scoring System, a standard for rating severity.

14 · Duplicate

A report of an issue that has already been reported; typically only the first valid report is rewarded.

15 · Human in the loop

A design where AI recommends and a person reviews and decides, especially for severity, validity and payouts.

16 · IDOR

Insecure direct object reference — accessing another user's data by changing an identifier the server fails to check.

17 · Jailbreak

A prompt that makes an AI model ignore its safety rules or intended behaviour.

18 · OWASP Top 10

A widely used list of the most critical web application security risks, maintained by the OWASP Foundation.

19 · Penetration test

A time-boxed, authorised simulated attack that follows a methodology and ends with a report of findings and fixes.

20 · Prompt injection

Manipulating an AI model's instructions through crafted input.

21 · PTaaS

Penetration testing as a service — pentests booked and delivered through a platform, with live findings and built-in retesting.

22 · RCE

Remote code execution — running attacker-controlled code on a target system; usually the highest severity.

23 · Red teaming

A goal-based exercise that tests people, processes and technology together by emulating a real adversary.

24 · Retest

Checking that a fix actually closes the vulnerability it was meant to address.

25 · Safe harbor

A commitment not to take legal action against good-faith researchers.

26 · Scope

The assets a program authorises researchers to test, and those it excludes.

27 · security.txt

A standard file at /.well-known/security.txt that tells researchers how to report vulnerabilities.

28 · SQL injection

Inserting database commands into input that is passed unsafely to a SQL query.

29 · SSRF

Server-side request forgery — tricking a server into making requests to internal systems or cloud metadata services.

30 · Triage

Reproducing, deduplicating and scoring incoming reports.

31 · VDP

Vulnerability disclosure program — a public channel for reporting security issues, usually without rewards.

32 · XSS

Cross-site scripting — injecting script that runs in another user's browser in the context of a trusted site.

33 · Zero-day

A vulnerability unknown to the vendor, with no fix available when it is discovered or exploited.