Skip to main content

Core Concepts

A small vocabulary explains almost everything in apPosture. Learn these seven terms and the rest of the platform becomes intuitive.

The object model​

Application  ──< Target ──< Assessment (scan run) ──< Finding ──> Vulnerability
     │                                                              (deduped)
     └──< Repository (source) ──< Assessment ──< Finding ───────────┘

Application​

The business-level unit - a product, service or site. Carries an environment (prod/staging/dev) and business criticality, which weight risk. All posture and compliance numbers roll up to applications. Microservices can be grouped under a Product (see Products).

Target​

A concrete scannable endpoint: a URL for DAST, or a source Repository for code scanning. A target belongs to an application and can carry authentication configuration so scanners reach logged-in surface.

Assessment​

One execution of a scanner - a DAST scan, a SAST run, an SCA run, a container scan, an import, etc. Every assessment records what ran, when, and which findings it produced. The Assessments page is the run history across all tools.

Finding​

A single issue as reported by one tool. A SAST finding and a DAST finding can describe the same underlying weakness - that's where vulnerabilities come in.

Vulnerability​

The unified atom. apPosture computes a source-aware fingerprint and merges findings that describe the same real issue across tools into one Vulnerability. This is what you triage in the Vulnerabilities hub; it carries the merged evidence, the correlated sources, and a single status.

Finding vs. Vulnerability

Findings are raw tool output. Vulnerabilities are the deduplicated, correlated truth you act on. One vulnerability may be backed by several findings.

Risk & scoring terms​

TermMeaning
SeverityCritical / High / Medium / Low / Info - base impact rating.
CVSSStandard 0-10 severity score.
EPSSProbability (0-100%) a CVE will be exploited in the wild in the next 30 days.
KEVOn CISA's Known Exploited Vulnerabilities list - proven, active exploitation.
ReachableThe vulnerable code/endpoint is actually reachable from an entry point (not dead code).
Exploit confirmedapPosture proved exploitability - a DAST proof-of-exploit or a runtime IAST sink hit, not an AI guess.

See Severity & Scoring for how these combine into priority.

Posture & lifecycle terms​

  • Posture score / grade - an A-F rating of overall security health, shown on the Dashboard and in executive reports.
  • Coverage - how much of your portfolio has been tested by DAST / SAST / SCA.
  • Triage status - a finding's lifecycle: New → Triaged → Confirmed → In progress → Resolved / Verified / Closed, plus False positive and Risk accepted.
  • SLA - the remediation deadline for a finding based on its severity (see SLA Policy).
  • Gate - a CI/CD pass/fail decision driven by Policies.
  • Attack chain - a multi-step path an attacker could take by combining several vulnerabilities (see Attack Map).

The scan pipeline​

Every DAST scan runs as two named stages:

Discovery & active scan  →   Agent pentest
crawl + active               adaptive agent (read → mutate → escalate),
vulnerability tests          cross-finding chaining, proof-of-exploit +
                             Attack Trace, business-impact & fix

The second stage is an autonomous agent pentest you watch live in the Agent Cockpit. The Deep profile turns on the most aggressive settings and all available engines. Profiles are covered in Running a scan.

Last updated on