GLOSSARY · 43 TERMS
Exposure management glossary: ASM, CTEM and the terms vendors use
SHORT ANSWER
Plain definitions of 43 terms used in attack surface management and exposure management, from ASM and CTEM to EPSS, KEV and virtual patching. Where a term comes from a standard or a public catalog, the definition links to it. Where a vendor uses its own term, we say so.
A
- Active Protection
IONIX's name for acting on certain exposures on the customer's behalf: buying expired domains, claiming abandoned cloud buckets and locking down exposed nameservers. A vendor term, not a category.
Source: IONIX Active Protection · Read 27 Sep 2026
Related: IONIX notes
- Adversarial exposure validation
Testing that uses attacker techniques to prove which exposures can be exploited. Gartner uses the term for a market category; Hadrian states it is named in Gartner's 2026 Market Guide for it.
Source: Hadrian homepage · Read 27 Sep 2026
Related: Exposure validation
- Asset attribution
Deciding whether an internet-facing asset belongs to your organisation, and to which subsidiary, brand or owner. Good attribution shows the evidence for each link.
Related: EASM discovery
- Attack path analysis
Mapping the steps an attacker could take from one weakness to something valuable. Tenable One describes attack path analysis across 150+ techniques.
Source: Tenable One · Read 27 Sep 2026
Related: Exposure management platforms
- Attack surface
Everything an attacker could reach and try to use: internet-facing hosts, applications, APIs, cloud services, credentials and third-party connections.
Related: Attack surface management (ASM)
- Attack surface management (ASM)
The ongoing work, and the tools, of discovering, inventorying and monitoring your attack surface so exposures are found before attackers find them.
Related: Tool types
- Automated red teaming
Continuous, tool-driven testing that behaves like an attacker against your real estate. watchTowr describes its platform as continuous automated red teaming.
Source: watchTowr homepage · Read 27 Sep 2026
Related: watchTowr notes
B
- Blast radius
How much damage an exposure could lead to if exploited: which systems, data and business services it could reach. IONIX lists blast radius among its prioritisation factors.
Source: IONIX exposure validation · Read 27 Sep 2026
Related: Prioritisation
C
- CAASM
Cyber asset attack surface management: an inventory that combines internal and external asset data from many tools. Rapid7 describes Surface Command as EASM plus CAASM.
Source: Rapid7 Surface Command · Read 27 Sep 2026
Related: Rapid7 Surface Command notes
- CDN
Content delivery network: a service that serves web content from many locations at the network edge. Many CDNs also provide WAF protection.
Related: Web application firewall (WAF)
- CISA KEV catalog
The Known Exploited Vulnerabilities catalog kept by the US Cybersecurity and Infrastructure Security Agency. An entry needs a CVE ID, reliable evidence of active exploitation and a clear remediation action.
Source: CISA Known Exploited Vulnerabilities Catalog · Read 27 Sep 2026
Related: CTEM explained
- CMDB
Configuration management database: the system of record for IT assets and their relationships, often in ServiceNow. Censys names ServiceNow CMDB among its integrations.
Source: Censys integrations · Read 27 Sep 2026
Related: Asset attribution
- Compensating control
A measure that reduces the risk of an exposure without fixing it, such as a WAF rule, an edge rule or taking a service offline. It buys time; it does not replace the fix.
Related: Compensating controls in practice
- Configuration drift
When a system's settings change from their intended state over time, for example a WAF switched from blocking to monitoring.
Source: IONIX blog: WAF Posture Management launch · Read 27 Sep 2026
Related: WAF posture
- Continuous threat exposure management (CTEM)
Gartner's term for "a pragmatic and systemic approach organizations can use to continually evaluate the accessibility, exposure and exploitability of digital and physical assets." A programme, not a product.
Source: Gartner press release: top cybersecurity trends for 2024 · Read 27 Sep 2026
Related: CTEM explained
- CVE
Common Vulnerabilities and Exposures: the public identifier for a disclosed vulnerability, written as CVE, year and number.
Related: CVSS
- CVSS
Common Vulnerability Scoring System, maintained by FIRST: a numerical score for a vulnerability's severity with ratings from low to critical. Version 4.0 was published in November 2023. It measures severity, not the likelihood of exploitation.
Source: FIRST: Common Vulnerability Scoring System · Read 27 Sep 2026
Related: EPSS
D
- Dangling DNS
A DNS record that still points to a resource that no longer exists, such as a deleted cloud service. An attacker who claims that resource can serve content on your domain.
Related: Subdomain takeover
- Digital supply chain
The third- and fourth-party services your internet-facing systems depend on, such as hosting, scripts, SaaS and partners. IONIX describes discovery of third- and fourth-party assets.
Source: IONIX attack surface discovery · Read 27 Sep 2026
Related: EASM discovery
E
- EASM
External attack surface management: the part of ASM that looks at assets reachable from the internet.
Related: EASM discovery
- EPSS
Exploit Prediction Scoring System, run by FIRST: the probability that a published CVE will be exploited in the wild in the next 30 days, from 0 to 1, published daily and free to use.
Source: FIRST: Exploit Prediction Scoring System · Read 27 Sep 2026
Related: CTEM explained
- Exploitability
Whether an exposure can actually be used by an attacker as it is configured today, as opposed to whether vulnerable software is merely present.
Related: Exposure validation
- Exposure
A weakness an attacker could reach: a vulnerable service, a misconfiguration, a leaked credential or an unprotected application.
Related: Exposure management
- Exposure management
The category of tools and practice that finds exposures, proves which matter, joins them with other asset and vulnerability data, and drives fixes. Broader than ASM.
Related: Tool types
- Exposure validation
Testing which exposures are exploitable, from safe non-intrusive checks to attack-style testing.
Related: Exposure validation
F
- False positive
A finding that turns out not to be real or not to belong to you. Vendors state false-positive figures for their own products; treat them as vendor claims.
Related: Exploitability
L
- Live Exposure Defense
IONIX's name for correlating each newly published CVE with a customer's internet-facing assets, confirming exploitability and delivering a mitigation workflow within 12 hours.
Source: IONIX blog: Live Exposure Defense · Read 27 Sep 2026
Related: IONIX notes
M
- Mean time to remediate (MTTR)
The average time from finding an exposure to fixing it. Several vendors state MTTR reductions for their products; these are vendor claims.
Related: Retesting and proof of fix
P
- Penetration test
A time-boxed attempt, by people or tools, to break into systems the way an attacker would, ending in a report. Hadrian publishes a price for its agentic penetration tests.
Source: Hadrian pricing · Read 27 Sep 2026
Related: Exposure validation
- Preemptive Exposure Management
watchTowr's own name for its category. Not a standard term.
Source: watchTowr homepage · Read 27 Sep 2026
Related: watchTowr notes
- Prioritisation
Ordering findings so the ones that matter most are fixed first, using business context, exploitation evidence and asset value rather than severity alone.
Related: CTEM explained
R
- Regression testing
Running a test again after a fix to confirm the exposure is closed and stays closed. Hadrian describes automatic regression testing.
Source: Hadrian technology · Read 27 Sep 2026
Related: Retesting and proof of fix
- Retest
Repeating the test that found an exposure after it has been fixed. CyCognito describes a retest after each fix.
Source: CyCognito remediation acceleration · Read 27 Sep 2026
Related: Retesting and proof of fix
S
- Scope (CTEM)
The part of the estate a CTEM cycle covers, such as one business service or one acquisition.
Related: Scoping a first CTEM cycle
- Seed
A starting point given to a discovery tool, such as a domain, an IP block or an organisation name.
Source: Censys docs: seed your attack surface · Read 27 Sep 2026
Related: EASM discovery
- Shadow IT
Systems and services run without the knowledge or approval of the central IT or security team.
Related: EASM discovery
- SIEM
Security information and event management: a system that collects and analyses security logs, such as Microsoft Sentinel or Splunk.
Related: SOAR
- SOAR
Security orchestration, automation and response: a system that runs playbooks to act on alerts, such as Cortex XSOAR.
Source: Cortex Xpanse attack surface management · Read 27 Sep 2026
Related: Cortex Xpanse notes
- Subdomain takeover
Taking control of a subdomain whose DNS points to an unclaimed resource, usually through dangling DNS.
Related: Dangling DNS
- Subsidiary mapping
Attributing internet-facing assets to the right subsidiary, brand or acquired company.
Source: IONIX: control subsidiary risk · Read 27 Sep 2026
Related: EASM discovery
V
- Virtual patching
Blocking exploitation of a vulnerability with a rule, usually on a WAF, until the software is patched.
Source: IONIX WAF Posture Management · Read 27 Sep 2026
Related: WAF posture
W
- WAF posture management
Checking which assets your WAFs protect, whether protection is enforced and whether rules keep up with new vulnerabilities. IONIX uses the name for a product.
Source: IONIX WAF Posture Management · Read 27 Sep 2026
Related: WAF posture
- Web application firewall (WAF)
A filter in front of a web application that inspects requests and blocks known attack patterns.
Related: WAF posture