Active Defense (watchTowr)
watchTowr's name for pushing mitigation rules to the network edge through WAF and firewall vendors. A vendor term.
DICTIONARY
ASM dictionary: attack surface management terms defined
THE SHORT ANSWER
Thirty-six terms you meet when buying or running attack surface management, defined in one to three sentences each. Terms that come from a standard or a public catalog link to it. Terms a single vendor coined are marked as that vendor's term.
Active Protection (IONIX)
IONIX's name for reclaiming assets an attacker could take over, such as expired domains, abandoned cloud buckets and exposed nameservers, on the customer's behalf. A vendor term.
Active Response (Cortex Xpanse)
Palo Alto Networks' name for built-in automated playbooks in Cortex Xpanse that act on exposures. A vendor term.
Adversarial exposure validation (AEV)
Continuous, automated testing of whether exposures can actually be attacked, as an adversary would. Sits between ASM discovery and periodic penetration testing.
Asset attribution
Deciding that an asset belongs to your organization, and to which subsidiary, business unit or owner, with evidence for the decision.
Attack path analysis
Mapping how an attacker could move from one weakness to a target through a chain of steps. Tenable One describes attack path analysis across 150+ techniques.
Attack surface management (ASM)
The continuous discovery, inventory and assessment of the assets an attacker could target. Often used to mean EASM; can also include internal assets.
Black-box testing
Testing a system from the outside with no credentials or internal knowledge, as an external attacker would.
Blast radius
How much damage an exploited exposure could cause: the data, systems and business processes it could reach.
CAASM (cyber asset attack surface management)
Building a unified inventory of internal and external assets from existing tools such as endpoint, cloud and identity systems.
Compensating control
A measure that reduces the risk of a known weakness without fixing it, such as a WAF rule, access restriction or automated playbook. Temporary by design.
Connective Intelligence (IONIX)
IONIX's name for its recursive discovery engine that maps assets across subsidiaries and the digital supply chain. A vendor term.
CTEM (continuous threat exposure management)
A program, described by Gartner, for continually evaluating the accessibility, exposure and exploitability of an organization's digital and physical assets.
CVE
Common Vulnerabilities and Exposures: a public identifier for a specific, disclosed vulnerability, such as CVE-2026-63030.
CVSS
The Common Vulnerability Scoring System from FIRST: a numerical score for a vulnerability's severity, with ratings from low to critical. Version 4.0 was published in November 2023.
Dangling DNS
A DNS record that still points to a resource that no longer exists or is no longer yours, which can let someone else claim it.
EASM (external attack surface management)
Discovering and assessing internet-facing assets from the outside, the way an attacker sees them.
EPSS
The Exploit Prediction Scoring System from FIRST: the probability, from 0 to 1, that a published CVE will be exploited in the wild in the next 30 days, published daily.
Exploitability
Whether a weakness can actually be attacked as deployed, as opposed to being present in theory.
Exposure
Any internet-facing weakness: an unneeded open service, a misconfiguration, a vulnerable version, leaked credentials or an asset an attacker could take over.
False positive
A finding that turns out not to be real, or an asset wrongly attributed to you. Every false positive costs an owner's time.
KEV catalog
CISA's Known Exploited Vulnerabilities catalog: CVEs with reliable evidence of active exploitation and a clear remediation action.
MTTR (mean time to remediate)
The average time from finding an exposure to fixing it. Useful inside one team; vendor MTTR figures use their own definitions and are not comparable.
Penetration test
A time-boxed, scoped attack simulation by people, ending in a report. Deep but periodic.
Playbook
A predefined, automated sequence of response actions triggered by a condition, usually run by a SOAR platform.
Reachability
Whether a service answers from the internet. An observable fact, and the weakest of the claims an ASM finding can make.
Regression testing
Re-running the proof of an exposure after it has been fixed, so that it is caught if it returns.
Retest
Repeating the specific test that proved an exposure, after the owner reports the fix, to confirm it is closed.
Seed
A starting input for discovery, such as a domain, IP range, ASN or organization name. Some tools need seeds; others start from the company name.
Seedless discovery
Discovery that starts without a customer-supplied asset list. CyCognito, for example, states its discovery starts from the organization's name.
Shadow IT
Systems and services run without the knowledge of the central IT or security team, often the first finds of an ASM program.
SOAR
Security orchestration, automation and response: platforms that run playbooks across security and IT tools, such as Cortex XSOAR.
Subdomain takeover
Claiming a subdomain that points to an abandoned external resource, so an attacker can serve content under your name.
Subsidiary mapping
Attributing assets to the right legal entity or business unit in a group, including recent acquisitions.
Virtual patching
Blocking the exploitation of a known weakness at a WAF or edge service, without changing the vulnerable application.
WAF (web application firewall)
A filter in front of web applications that inspects and blocks malicious requests. The usual place for virtual patching.