Skip to main content

Core Concepts

A small vocabulary explains almost everything in apPosture. Learn these seven terms and the rest of the platform becomes intuitive.

The object model​

Application  ──< Target ──< Assessment (scan run) ──< Finding ──> Vulnerability
     │                                                              (deduped)
     └──< Repository (source) ──< Assessment ──< Finding ───────────┘

Application​

The business-level unit - a product, service or site. Carries an environment (prod/staging/dev) and business criticality, which weight risk. All posture and compliance numbers roll up to applications. Microservices can be grouped under a Product (see Products).

Target​

A concrete scannable endpoint: a URL for DAST, or a source Repository for code scanning. A target belongs to an application and can carry authentication configuration so scanners reach logged-in surface.

Assessment​

One execution of a scanner - a DAST scan, a SAST run, an SCA run, a container scan, an import, etc. Every assessment records what ran, when, and which findings it produced. The Assessments page is the run history across all tools.

Finding​

A single issue as reported by one tool. A SAST finding and a DAST finding can describe the same underlying weakness - that's where vulnerabilities come in.

Vulnerability​

The unified atom. apPosture computes a source-aware fingerprint and merges findings that describe the same real issue across tools into one Vulnerability. This is what you triage in the Vulnerabilities hub; it carries the merged evidence, the correlated sources, and a single status.

Finding vs. Vulnerability

Findings are raw tool output. Vulnerabilities are the deduplicated, correlated truth you act on. One vulnerability may be backed by several findings.

Risk & scoring terms​

TermMeaning
SeverityCritical / High / Medium / Low / Info - base impact rating.
CVSSStandard 0-10 severity score.
EPSSProbability (0-100%) a CVE will be exploited in the wild in the next 30 days.
KEVOn CISA's Known Exploited Vulnerabilities list - proven, active exploitation.
ReachableThe vulnerable code/endpoint is actually reachable from an entry point (not dead code).
Exploit confirmedapPosture proved exploitability with a working proof-of-exploit - not an AI guess.

See Severity & Scoring for how these combine into priority.

Posture & lifecycle terms​

  • Posture score / grade - an A-F rating of overall security health, shown on the Dashboard and in executive reports.
  • Coverage - how much of your portfolio has been tested by DAST / SAST / SCA.
  • Triage status - a finding's lifecycle: New → Triaged → Confirmed → In progress → Resolved / Verified / Closed, plus False positive and Risk accepted.
  • SLA - the remediation deadline for a finding based on its severity (see SLA Policy).
  • Gate - a CI/CD pass/fail decision driven by Policies.
  • Attack chain - a multi-step path an attacker could take by combining several vulnerabilities (see Attack Map).

The scan pipeline​

Every DAST scan runs as two named stages:

DAST stage        →   AI exploitation stage
crawl + active        AI-assisted exploitation,
vulnerability tests   false-positive filtering,
                      business-impact & fix suggestions

The Deep profile turns on the most aggressive settings and all available engines. Profiles are covered in Running a scan.

Last updated on