Glossary
The words this site uses, and what each one means
Two or three sentences per term, in alphabetical order. Where a page carries the full treatment, the term links to it — and where no page here owns a term, the entry says what it means and stops.
The terms
Seventeen terms, alphabetically
The ones that carry a specific meaning on this site, and the neutral industry terms a reader needs in order to read the rest of it.
| Term | What it means here |
|---|---|
| Agentic penetration testing | Testing where the system chooses its own next action from what the previous one returned, rather than running a fixed list of checks. What that buys is not only pace but provenance: a finding is reached by pursuing a hypothesis, so the route to it exists and can be replayed. |
| Approval gate | One of the three actions B-52 will not take without your written approval: destructive or state-changing actions in production; persistence and movement past the entry host; live credentials or real customer data. The same three apply on every coverage class and in all three delivery models, and because the approval has to be in writing, each one produces a document naming what was asked for and what was permitted. |
| Autonomy boundary | The line between what B-52 decides for itself and what it stops to ask about. It is drawn by the three approval gates and by the scope you signed off, which means it is written down before a run starts rather than described after one. |
| Build gate | A pass or fail handed back to a build pipeline on the result of a scan, so a release can be held on a finding rather than reported against once it is already live. What the gate fails on is a threshold you set; B-52 supplies the result and the artefact behind it. |
| Chaining | Using the outcome of one finding as the input to the next — a disclosed credential used to authenticate, an authenticated route used to reach an internal service — so the report shows a path rather than a list of unconnected items. Where the next step would cross an approval gate, the chain stops there and waits. |
| Coverage class | One of the eleven kinds of target B-52 tests, each with its own methodology, its own defect classes and its own standards. All three delivery models cover all eleven. Physical, hardware and wireless testing sit outside the platform entirely. |
| CVSS | The Common Vulnerability Scoring System, published and maintained by FIRST. Every finding carries a v4.0 vector rather than a bare number, because the vector records the assumptions the score was derived from and lets you re-score it against your own environment. |
| CWE | MITRE’s Common Weakness Enumeration, a catalogue of the underlying weakness types a vulnerability belongs to. Every finding carries one, which is what turns a list of individual defects into a view of which mistake keeps recurring. |
| Delivery model | Which of the three arrangements an engagement runs under: fully autonomous, autonomous expert verified, or human led. Coverage is identical across all three. What differs is where the human sits, and whether the report carries a Security Brigade auditor’s signature. |
| Empanelment | Formal recognition by CERT-In that an organisation is authorised to carry out security auditing, and the basis on which a report can be signed for a regulated filing. Security Brigade has been empanelled since 2008; the B-52 platform holds no instrument of its own. |
| False positive | A reported finding that is not actually present in the target. It is the reason every finding here is issued with a reproducible artefact rather than a signature match — a finding you can replay is a finding you can disprove, which is the only thing that settles the argument. |
| Indirect prompt injection | Instructions reaching a model through content it retrieves — a document, a web page, a support ticket — rather than through the user’s own input. It matters because the application, not the model, decides what is retrieved, what is trusted, what is rendered and which tools can be invoked, and that is what an assessment of this class works on. |
| Phases, the six | Discovery, planning, scanning, exploitation, reporting, and QA. QA is the sixth, and it runs on the finished report before that report reaches you. |
| Reproducible exploit artefact | What every finding ships with: the request, the response, and the steps to reproduce it. Severity comes with a CVSS v4.0 vector and the CWE. In the fully autonomous model a finding also passes an independent automated cross-check before it is reported. |
| Retest | Re-running the exact steps in a finding’s artefact after a fix, to establish whether it still reproduces. Findings move through open, fixed, retested and closed, and a finding closes on a retest that cannot reproduce it. |
| Scope sign-off | The written authorisation naming the targets, the boundaries and the window, agreed before any testing begins. In the fully autonomous model it is the last human action in the engagement, which is why it is the document worth the most attention. |
| VAPT | Vulnerability assessment and penetration testing, written as one term across Indian procurement and audit paperwork. It covers two different activities — an inventory of known weaknesses, and an attempt to exploit them — so a scope that does not say which it means leaves the question open until the report arrives. |
- What it means here
- Testing where the system chooses its own next action from what the previous one returned, rather than running a fixed list of checks. What that buys is not only pace but provenance: a finding is reached by pursuing a hypothesis, so the route to it exists and can be replayed.
- What it means here
- One of the three actions B-52 will not take without your written approval: destructive or state-changing actions in production; persistence and movement past the entry host; live credentials or real customer data. The same three apply on every coverage class and in all three delivery models, and because the approval has to be in writing, each one produces a document naming what was asked for and what was permitted.
- What it means here
- The line between what B-52 decides for itself and what it stops to ask about. It is drawn by the three approval gates and by the scope you signed off, which means it is written down before a run starts rather than described after one.
- What it means here
- A pass or fail handed back to a build pipeline on the result of a scan, so a release can be held on a finding rather than reported against once it is already live. What the gate fails on is a threshold you set; B-52 supplies the result and the artefact behind it.
- What it means here
- Using the outcome of one finding as the input to the next — a disclosed credential used to authenticate, an authenticated route used to reach an internal service — so the report shows a path rather than a list of unconnected items. Where the next step would cross an approval gate, the chain stops there and waits.
- What it means here
- One of the eleven kinds of target B-52 tests, each with its own methodology, its own defect classes and its own standards. All three delivery models cover all eleven. Physical, hardware and wireless testing sit outside the platform entirely.
CVSS
- What it means here
- The Common Vulnerability Scoring System, published and maintained by FIRST. Every finding carries a v4.0 vector rather than a bare number, because the vector records the assumptions the score was derived from and lets you re-score it against your own environment.
CWE
- What it means here
- MITRE’s Common Weakness Enumeration, a catalogue of the underlying weakness types a vulnerability belongs to. Every finding carries one, which is what turns a list of individual defects into a view of which mistake keeps recurring.
- What it means here
- Which of the three arrangements an engagement runs under: fully autonomous, autonomous expert verified, or human led. Coverage is identical across all three. What differs is where the human sits, and whether the report carries a Security Brigade auditor’s signature.
- What it means here
- Formal recognition by CERT-In that an organisation is authorised to carry out security auditing, and the basis on which a report can be signed for a regulated filing. Security Brigade has been empanelled since 2008; the B-52 platform holds no instrument of its own.
- What it means here
- A reported finding that is not actually present in the target. It is the reason every finding here is issued with a reproducible artefact rather than a signature match — a finding you can replay is a finding you can disprove, which is the only thing that settles the argument.
- What it means here
- Instructions reaching a model through content it retrieves — a document, a web page, a support ticket — rather than through the user’s own input. It matters because the application, not the model, decides what is retrieved, what is trusted, what is rendered and which tools can be invoked, and that is what an assessment of this class works on.
- What it means here
- Discovery, planning, scanning, exploitation, reporting, and QA. QA is the sixth, and it runs on the finished report before that report reaches you.
- What it means here
- What every finding ships with: the request, the response, and the steps to reproduce it. Severity comes with a CVSS v4.0 vector and the CWE. In the fully autonomous model a finding also passes an independent automated cross-check before it is reported.
- What it means here
- Re-running the exact steps in a finding’s artefact after a fix, to establish whether it still reproduces. Findings move through open, fixed, retested and closed, and a finding closes on a retest that cannot reproduce it.
- What it means here
- The written authorisation naming the targets, the boundaries and the window, agreed before any testing begins. In the fully autonomous model it is the last human action in the engagement, which is why it is the document worth the most attention.
VAPT
- What it means here
- Vulnerability assessment and penetration testing, written as one term across Indian procurement and audit paperwork. It covers two different activities — an inventory of known weaknesses, and an attempt to exploit them — so a scope that does not say which it means leaves the question open until the report arrives.
House rule
Short, and linked once
A definition here is two or three sentences. Longer than that and it has stopped being a definition: it has become a second, shorter version of the page it was meant to point at, and the two will eventually say different things.
Three entries carry no link, because no page on this site owns them. For everything else, the depth sits where it belongs — the method written out step by step , the checklist behind it , and the mapping from a finding to the control a framework names .
What this page cites, and what it leaves out As of September 2026
- CVSS v4.0, November 2023, is the version FIRST publishes and maintains. Source read 2026-09-13.
- CWE is MITRE’s Common Weakness Enumeration, cited here without a version.
- The six phases, the three approval gates, the three delivery models and the eleven coverage classes are stated here in the same terms as the pages that own them, and each entry links to the page carrying the full treatment.
- CERT-In empanelment since 2008 and ISO 27001 certification are Security Brigade’s. They are the two instruments this site claims, and the B-52 platform holds no certification of its own.
Deliberately excluded
- Definitions of words this site does not use. A glossary is a reading aid for these pages, not a dictionary of the field.
- Any term whose full treatment has no page yet.
Sequence
The six phases, in the order they run
One glossary entry above is a list of six words, and the order in that list is the part that matters. It is set out here because a reader who arrived for the definition arrived for the ordering.
-
Discovery
What is actually there, established from what answers rather than from the asset list handed over.
-
Planning
What will be attempted against each thing found, and which of those attempts would cross an approval gate.
-
Scanning
The breadth pass: known weakness classes checked across everything in scope, so nothing depends on a hypothesis being formed first.
-
Exploitation
The attempt itself, inside the autonomy boundary, producing the request and the response that become the finding’s artefact.
-
Reporting
Findings written up with severity, a CVSS v4.0 vector, the CWE, and the steps that reproduce them.
-
QA
A review of the finished report, run before that report reaches you. The sixth phase, and the last thing that happens inside the engagement.
The same six run on every coverage class and in all three delivery models, and in the same order whether an engagement happens once or on a schedule . What the model changes is what stands between a finding and the report: a senior auditor in two of them, and an independent automated cross-check in the fully autonomous one.
A term you needed and did not find is worth telling us about
This page exists to make the rest of the site readable. Where a word on another page is not explained anywhere, the defect is in the page that used it, and it is quicker to fix than to work around.