Glossary
Quick definitions of the terms used throughout apPosture and this guide.
| Term | Definition |
|---|---|
| Application | The business-level unit (product/service/site) all data rolls up to. |
| Target | A concrete scannable endpoint - a URL (DAST) or a source repository. |
| Repository | A connected source-code repo, cloned on demand for code scanning. |
| Product | A group of applications/repos that form one logical system (microservices). |
| Assessment | One execution of a scanner (DAST, SAST, SCA, import, …). |
| Finding | A single issue as reported by one tool. |
| Vulnerability | The unified, deduplicated issue - findings from many tools merged into one. |
| DAST | Dynamic testing of a running app (attacks the live application). |
| SAST | Static analysis of source code (taint flow, patterns). |
| SCA | Software Composition Analysis - dependency vulnerabilities. |
| IaC | Infrastructure-as-Code scanning (Terraform/CFN/K8s). |
| Gray-box | Source-informed DAST - the scanner knows the code/routes. |
| Proof-of-exploit | The actual request/response demonstrating an issue is real. |
| Exploit confirmed | apPosture proved exploitability - not an AI guess. |
| Reachable | The vulnerable code/endpoint is actually reachable from an entry point. |
| Severity | Base impact rating: Critical/High/Medium/Low/Info. |
| CVSS | Standard 0-10 vulnerability severity score. |
| EPSS | Probability a CVE is exploited in the wild within 30 days. |
| KEV | CISA's Known Exploited Vulnerabilities list (active exploitation). |
| Attack chain | A multi-step exploit path combining several vulnerabilities. |
| Toxic combination | Several lower-severity issues that compose into a critical path. |
| Choke point | A vulnerability that, if fixed, breaks many attack chains. |
| Coverage | How much of the portfolio/surface has been tested. |
| Posture score | An A-F rating of overall security health. |
| MTTR | Mean Time To Remediation. |
| SLA | The remediation deadline for a finding based on severity. |
| Gate | A CI/CD pass/fail decision driven by a policy. |
| Policy | A set of rules expressing risk appetite (drives gates). |
| Triage | Reviewing and dispositioning a finding (status + owner). |
| Mute / suppression | A rule that hides a known false-positive/accepted issue. |
apt_ token | An apPosture API token for programmatic/CI access. |