Vulnerability management glossary
Plain-language definitions of the scoring systems, catalogs, artifacts and metrics used across the guides.
- Attack surface management (ASM / EASM)
- The continuous discovery and monitoring of an organization's exposed assets, especially those reachable from the internet.
- Authenticated scanning
- Vulnerability assessment performed with credentials, so the scanner can inspect installed software and configuration directly.
- Compensating control
- A safeguard that reduces the likelihood or impact of exploiting a vulnerability that cannot be removed right away.
- CVE (Common Vulnerabilities and Exposures)
- The program and identifier scheme that gives each publicly disclosed vulnerability a unique ID such as CVE-2021-44228.
- CVSS (Common Vulnerability Scoring System)
- FIRST's open standard for describing the technical severity of a vulnerability as a vector and a 0–10 score.
- EPSS (Exploit Prediction Scoring System)
- A daily, data-driven probability that a published CVE will see exploitation activity in the next 30 days.
- KEV (Known Exploited Vulnerabilities catalog)
- CISA's authoritative list of CVEs with reliable evidence of active exploitation in the wild and a clear remediation action.
- MTTR (Mean Time to Remediate)
- The average time between detecting a vulnerability on an asset and verifying that it has been remediated.
- Risk acceptance
- A documented, time-limited decision by an accountable owner to tolerate a known vulnerability instead of remediating it.
- SBOM (Software Bill of Materials)
- A formal, machine-readable inventory of the components and dependencies that make up a piece of software.
- SSVC (Stakeholder-Specific Vulnerability Categorization)
- A decision-tree approach to vulnerability prioritization that outputs an action such as Track, Attend or Act instead of a score.
- VEX (Vulnerability Exploitability eXchange)
- A machine-readable statement from a supplier about whether a product is actually affected by a specific vulnerability.