Glossary

Security and audit terms, defined plainly

One definition per term, written to be understood the first time. Every definition stands on its own, so it makes sense quoted with nothing around it.

Testing

Authorization letter: An authorization letter is a signed statement from someone with authority over the target systems confirming that the named tester may perform the described testing during a specified window. It is the tester's legal basis for the work.
Black box testing: Black box testing is a penetration test performed with no information about the target beyond what is publicly available, simulating an external attacker who starts from nothing.
Grey box testing: Grey box testing is a penetration test performed with partial information, most often valid credentials for each user role but no source code. It is the common default for testing authorization logic in a product.
OWASP Top 10: The OWASP Top 10 is a periodically updated awareness document listing the most critical categories of web application security risk. OWASP also publishes a Top 10 for Large Language Model applications covering risks specific to AI features.
Penetration test: A penetration test is an authorized, time-boxed security assessment in which a tester attempts to exploit weaknesses in a system the way an attacker would, and documents what was reached, how, and what it would mean.
Retest: A retest is a follow-up assessment that verifies specific findings from an earlier test have actually been fixed, producing a dated record that closes the loop between a finding and its remediation.
Rules of engagement: Rules of engagement are the written agreement that defines what may be tested, when, by what methods, what is explicitly out of bounds, and who to contact if something goes wrong. They are what makes a penetration test lawful rather than an intrusion.
Scope: Scope is the explicit list of systems, applications, networks, accounts and techniques included in a security assessment, and everything excluded from it. It determines what the resulting report can be used to claim.
Vulnerability scan: A vulnerability scan is an automated check that compares software versions and configurations against a database of known vulnerabilities, producing a list of potential issues without confirming whether any of them can actually be exploited.
White box testing: White box testing is a penetration test performed with full information: source code, architecture documentation and credentials. Because no budget goes to discovery, it generally produces the most findings per dollar and the only provable statement of coverage.

Audit and compliance

Annex A: Annex A is the list of information security controls in ISO/IEC 27001. The 2022 revision contains 93 controls organized into four themes: organizational, people, physical and technological, replacing the 114 controls in 14 domains of the 2013 version.
Bridge letter: A bridge letter is a statement from management covering the gap between the end of a SOC 2 report's observation window and the current date, asserting that no material changes to the control environment have occurred. It is written by management, not the auditor, and carries no audit opinion.
Compensating control: A compensating control is an alternative safeguard used where the expected control is not feasible, which must meet the intent of the original requirement and be documented and assessed as such.
Control: A control is a specific measure put in place to achieve a security or operational outcome, such as requiring multi-factor authentication or reviewing access quarterly. Audits assess whether controls are designed appropriately and, in a Type II, whether they actually operated.
Evidence: Evidence is the documentation that proves a control operated: a dated access review, a change ticket with approval, an alert with its triage, a penetration test report. Auditors test controls by sampling evidence, so a control with no evidence is treated as a control that did not run.
Exception: In a SOC 2 report, an exception is an instance where a control did not operate as described during the observation window. Exceptions appear in the report with management's response, and a report containing them is not a failed report.
Gap assessment: A gap assessment is a review performed before a formal audit that compares current practice against a framework's requirements and lists what is missing. It is advisory work, not an audit, and cannot be performed by the firm issuing the opinion in a way that impairs independence.
ISMS: An information security management system is the documented set of policies, processes and controls, and the governance around them, that an organization uses to manage information security risk. ISO 27001 certifies the management system, not any individual control.
Nonconformity: A nonconformity is an audit finding that a requirement of the standard has not been met. A major nonconformity blocks certification until it is resolved; a minor one requires a corrective action plan but does not necessarily block the certificate.
Observation window: The observation window is the period a SOC 2 Type II report covers, typically three to twelve months, during which controls must be shown to have operated effectively.
Qualified opinion: A qualified opinion is an auditor's conclusion that, except for specified matters, the controls met the criteria. In a SOC 2 it signals that one or more issues were significant enough to modify the opinion rather than be listed as exceptions.
Security questionnaire: A security questionnaire is a set of questions a prospective customer sends a vendor to assess its security posture during procurement. Standardized formats include the Consensus Assessments Initiative Questionnaire and the Standardized Information Gathering questionnaire.
Shared responsibility model: The shared responsibility model is the division of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure; the customer secures configuration, identity, access and data. A provider's own compliance certifications do not transfer to the customer's system.
SOC 2 report: A SOC 2 report is an attestation issued by a licensed CPA firm on a service organization's controls against the Trust Services Criteria. A Type I addresses control design at a point in time; a Type II addresses design and operating effectiveness across a period.
Stage 1 and Stage 2 audit: ISO 27001 certification is performed in two stages. Stage 1 reviews documentation and readiness to confirm the management system is capable of being audited. Stage 2 audits the system in operation and leads to the certification decision.
Statement of Applicability: The Statement of Applicability is the ISO 27001 document listing every Annex A control, whether it applies to the organization, the justification for including or excluding it, and its implementation status. It is the central artifact a certification auditor works from.
System description: The system description is the section of a SOC 2 report where management describes the system being reported on: its boundaries, components, the services delivered, and the controls in place. It defines what the report covers.
Trust Services Criteria: The Trust Services Criteria are the AICPA's control criteria used in SOC 2 engagements, organized into five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is required in every SOC 2; the others are included only if the organization selects them.

Findings and risk

CVE: A CVE is a unique public identifier assigned to a specific known vulnerability in a specific product, in the form CVE-YYYY-NNNNN. It names a vulnerability so that different tools and vendors can refer to the same thing.
CVSS: CVSS is an open standard for scoring the technical severity of a vulnerability from 0.0 to 10.0 based on characteristics such as attack vector, complexity and impact. It measures severity, not business risk.
False positive: A false positive is a reported finding that is not actually exploitable or not actually present. Validating findings before they reach the report is one of the main differences between a penetration test and a raw scan output.
Remediation: Remediation is the work of fixing a finding, as distinct from acknowledging it. In an audit context it also means the documented record of who fixed what, when, and how it was verified.
Risk acceptance: Risk acceptance is a documented decision not to remediate a finding, recording who accepted it, the rationale, any compensating controls, and when the decision will be revisited. It is a legitimate outcome when it is written down and owned.
Severity: Severity is the rating assigned to a finding to communicate how urgently it should be addressed, typically on a scale from informational to critical, and ideally reflecting exploitability and business impact rather than a score alone.

AI security

Agent authority: Agent authority is the set of actions an AI agent can perform and the identity it performs them as. Where an agent acts with a service credential rather than the calling user's permissions, it can reach data and operations the user could not, which converts a content-level attack into a privilege escalation.
Prompt injection: Prompt injection is an attack in which content the model reads is crafted to be followed as instruction. In the indirect form, the malicious text arrives inside a document, web page, email or tool response rather than from the user, which is what makes it a supply chain problem for AI features.
Tool use: Tool use is the mechanism by which a language model invokes external functions, APIs or systems. From a security standpoint each tool is an interface reachable by whatever influences the model's context, so tools should be scoped, validated and audited like any other privileged endpoint.

Get a scoped price without a discovery call

Tell us what is in scope and what your audit needs. You get a fixed price and a date, not a quote after two meetings.

Scope an assessment See pricing