Penetration Testing Glossary

A

Assumed breach

A testing approach that starts from the premise that an attacker already has a foothold, such as a compromised laptop or user account. Testers measure what that attacker can reach, how far they can move and whether defenders notice. It is common in internal network tests and red team exercises.

Attack surface

The sum of all points where an attacker can try to enter or extract data from a system: websites, APIs, open ports, cloud services, user accounts, devices and people. Reconnaissance, the second stage of a test, maps the attack surface so testing can focus on the most promising entry points.

Authenticated testing

Testing performed while logged in as one or more user roles, with credentials supplied by the system owner. It reaches functions that an outside visitor cannot see, which is where authorisation errors and business-logic flaws usually sit. Authenticated testing is the basis of grey box tests.

B

Black box testing

A penetration test where the tester starts with no knowledge of the target beyond its name or address, as an outside attacker would. It shows what is visible and exploitable from outside, but discovery takes time. Black box testing is common for external network tests. See types of penetration testing.

Blue team

The defenders in a security organisation: the people who monitor systems, detect attacks, investigate alerts and respond to incidents. In a red team exercise, the blue team tries to detect and stop the testers. In a purple team exercise, both sides work together to improve detection.

Bug bounty

A programme in which an organisation pays outside security researchers for valid vulnerability reports, under published rules and a defined scope. It offers continuous coverage from many researchers, and it complements, but does not replace, a scoped penetration test with a formal report.

Business logic flaw

A weakness in how an application's rules work, not in its code or configuration: for example, applying a discount twice, skipping a payment step or approving your own request. Scanners rarely detect these flaws, because finding them requires understanding what the application is meant to do. Manual testers look for them.

C

C2 (command and control)

The infrastructure an attacker uses to communicate with and direct compromised systems. Red teams run C2 frameworks to simulate real adversaries, manage access inside a target network and test whether defenders can detect the traffic. Testers set up and remove this infrastructure under the agreed rules of engagement.

CEH

Certified Ethical Hacker, a certification from EC-Council. The CEH knowledge exam has 125 multiple-choice questions in four hours, and a separate CEH Practical has 20 challenges in six hours. It covers attack techniques and tools. See credentials that matter for how it compares with others.

CPENT

Certified Penetration Testing Professional, a certification from EC-Council. Its exam is fully practical and lasts 24 hours or two 12-hour sessions, with a report due within seven days of finishing. It tests the ability to plan and carry out penetration tests under time pressure. See credentials that matter.

CREST

An international accreditation and certification body for the cybersecurity industry. CREST accredits companies that provide services such as penetration testing and incident response, and it certifies individual testers. Buyers can verify a provider's status on the CREST marketplace. CREST also supports the DESC Cyber Force programme in Dubai.

CVE

Common Vulnerabilities and Exposures, a catalogue of public identifiers for disclosed vulnerabilities, written as CVE-year-number. A CVE identifier lets teams refer to the same vulnerability across scanners, advisories and patches. A penetration test report may cite CVE identifiers for the affected software versions.

CVSS

Common Vulnerability Scoring System, an open framework maintained by FIRST that rates the severity of a vulnerability from 0.0 to 10.0. Reports use CVSS scores and bands from low to critical to help teams prioritise fixes. The score reflects technical severity, and your own context can change the real priority.

CWE

Common Weakness Enumeration, a community-maintained list of software and hardware weakness types, such as injection and broken access control. Where a CVE names one specific vulnerability, a CWE names the class it belongs to. Reports cite CWE identifiers to explain the root cause of a finding.

D

DAST

Dynamic Application Security Testing, the testing of a running application from the outside by sending requests and examining responses. DAST tools find issues such as injection and misconfiguration without access to source code. They complement SAST, but they do not replace manual penetration testing.

DESC Cyber Force

A certification programme run by the Dubai Electronic Security Center with CREST for companies and individuals that provide penetration testing and incident response to Dubai government entities. Since 2024, these buyers must use certified providers. See the compliance guide.

DevSecOps

A way of working that builds security checks into software development and operations, usually in the delivery pipeline. Teams run code analysis, dependency checks and automated tests on every change. Periodic penetration testing still adds a manual view of weaknesses that automated pipeline checks do not find.

E

Exploit

A piece of code, a technique or a sequence of steps that takes advantage of a vulnerability to make a system behave in an unintended way. Testers use exploits inside the agreed scope to confirm that a weakness is real and to show its impact. Exploitation separates a penetration test from a scan.

F

False positive

A finding reported by a tool or a tester that turns out not to be a real vulnerability. Scanners produce false positives because they infer weaknesses from signatures, and each one wastes engineering time. Penetration testers validate findings by hand, so the report contains confirmed issues.

G

Grey box testing

A penetration test where the tester starts with partial knowledge, such as a user account, an API definition or a network diagram. It balances speed and depth and suits most web, API and mobile tests, because a logged-in view reaches the functions where authorisation errors occur.

H

Hardening

The process of reducing a system's attack surface by removing unneeded services, closing ports, applying secure settings and limiting privileges. Secure configuration benchmarks guide the work. Penetration testers report hardening gaps, and the remediation plan usually lists the settings to change.

I

IDOR

Insecure Direct Object Reference, an access control flaw in which changing an identifier in a request, such as an invoice number, returns another user's data. IDOR is a common finding in web and API tests and belongs to the broken access control category of the OWASP Top 10.

ISO/IEC 27001

The international standard for an information security management system. The 2022 edition lists Annex A controls, including 8.8 on technical vulnerabilities and 8.29 on security testing. It does not name penetration testing as mandatory, but test results are common evidence. See the compliance guide.

L

Lateral movement

The techniques an attacker uses to move from one compromised system to others inside a network, for example by reusing stolen credentials. Testers use lateral movement in the post-exploitation stage to show how far a single foothold can reach, and segmentation testing checks whether controls stop it.

N

NIST SP 800-115

The Technical Guide to Information Security Testing and Assessment, published by the US National Institute of Standards and Technology. It describes penetration testing in four phases: planning, discovery, attack and reporting. Many methodologies, including those in provider proposals, map to it. See the five stages explained.

O

OSCP

OffSec Certified Professional, a certification from OffSec. Its exam is a 24-hour proctored practical test in which candidates attack a lab network and then document the results. Buyers often see it on tester profiles, and DESC Cyber Force lists it among accepted team member credentials.

OWASP Top 10

An awareness document from the Open Worldwide Application Security Project that lists the most critical web application security risks, such as broken access control and injection. It is updated periodically. Web application penetration tests commonly use it with the OWASP Web Security Testing Guide as a coverage baseline.

P

Payload

The part of an exploit that performs the action after a vulnerability is triggered, such as opening a connection back to the tester or running a command. Testers choose payloads that prove impact without causing damage, and they remove them after the test.

PCI DSS

The Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council for organisations that handle card data. Requirement 11.4 asks for internal and external penetration testing at least every 12 months and after significant change. See the compliance guide.

Penetration test

An authorised, scoped attack on a system by security specialists to find weaknesses that a real attacker could exploit and to prove their impact. Unlike a scan, it includes manual exploitation. The result is a report with evidence and fix advice. See types of penetration testing.

Persistence

Techniques that let an attacker keep access to a system after a restart or a password change, such as a scheduled task or a new account. Testers demonstrate persistence only when the rules of engagement allow it, and they remove every artefact when the test ends.

Phishing simulation

A controlled test in which testers send deceptive emails, messages or calls to staff to measure who clicks, who enters credentials and who reports the message. Results guide awareness training and email controls. It is one form of social engineering testing.

Post-exploitation

The stage after a successful exploit, when testers show what an attacker could do next: escalate privileges, move laterally, reach sensitive data and test detection. Post-exploitation turns a technical finding into a business impact, and it stays inside the safety limits agreed in the scope.

Privilege escalation

Gaining higher access than the account or process was meant to have, for example moving from a standard user to an administrator. Testers look for escalation paths in operating systems, applications and cloud permissions, because they turn a limited foothold into control of a system.

Proof of concept (PoC)

Evidence that a vulnerability is real and exploitable: the request, script, screenshot or sequence of steps that reproduces it. A good report includes a PoC for each finding so engineers can reproduce the issue and verify the fix. Scanner output often lacks one.

PTaaS

Penetration Testing as a Service, a model in which testing is delivered through a platform with on-demand or continuous testers, a findings dashboard and retests, usually for a subscription. Check which parts are automated and who validates findings. See the cost guide.

PTES

The Penetration Testing Execution Standard, a community methodology that describes seven phases: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post exploitation and reporting. Providers may cite it as the basis of their method. See the five stages explained.

Purple team

A collaborative exercise in which red team attackers and blue team defenders work together in real time. The attackers run techniques, and the defenders tune detection and response as they see the activity. It turns the lessons of a red team exercise into improvements.

R

Red team

A goal-driven campaign in which specialists imitate a real adversary over weeks, targeting people, process and technology, usually without warning most defenders. It tests detection and response as well as technical controls. It suits mature security programmes. See types of penetration testing.

Remediation

The work of fixing a vulnerability, by patching, changing configuration, rewriting code or adding a control. A good penetration test report gives specific remediation steps for your technology and a priority order. Remediation is verified by a retest.

Retest

A follow-up test, after remediation, that checks whether reported findings are fixed. The provider repeats the steps from each proof of concept and reports each finding as closed, partly fixed or open. Quotes should state whether a retest is included. See the cost guide.

Rules of engagement

The written terms that govern a test: allowed techniques, the scope, the test window, escalation contacts and limits on exploitation. They are signed with an authorisation letter and protect both the testers and the system owner. See the compliance guide.

S

SAST

Static Application Security Testing, the analysis of source code or compiled code without running the application. SAST finds patterns such as insecure functions early in development. It complements DAST and manual testing, and it is a core part of white box reviews.

Scope

The list of assets, environments and techniques that a test is allowed to cover, plus exclusions and the test window. Scope drives both the price and the value of a test, because providers estimate tester-days from it. See the cost guide.

Segmentation testing

A test that checks whether network controls keep sensitive zones, such as a cardholder data environment, separate from the rest of the network. Testers try to cross the boundary from other zones. PCI DSS asks for it where segmentation is used to reduce scope.

Social engineering

The manipulation of people, not systems, to obtain access or information, through phishing emails, phone calls, messages or visits. Social engineering tests measure how staff respond to deception. See types of penetration testing for how it fits with other test types.

SQL injection

A flaw in which an application passes untrusted input into a database query, letting an attacker read or change data. Parameterised queries prevent it. SQL injection belongs to the injection category of the OWASP Top 10 and is a standard check in web application tests.

U

UAE PDPL

The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021. It sets a general duty to secure personal data and keep it confidential, and it sets requirements for cross-border transfer. Testers may see personal data, so contracts should cover handling and deletion. See the compliance guide.

V

VAPT

Vulnerability Assessment and Penetration Testing, a combined service. The assessment finds and ranks known weaknesses, often with scanners, and the penetration test exploits them to prove impact. Providers use the label differently, so check what is tested by hand. See types of penetration testing.

X

XSS

Cross-site scripting, a flaw in which an application includes untrusted input in a page so that an attacker's script runs in another user's browser. It can steal sessions or change page content. Output encoding and content security policies reduce the risk. XSS is part of the injection category of the OWASP Top 10.

Z

Zero-day

A vulnerability for which the vendor has had no time to prepare a fix, so no patch exists when attackers begin using it. Penetration tests do not usually include zero-day research, and they focus on known weaknesses, misconfigurations and flaws in your own code and design.

Zero Trust

A security model that treats no user, device or network location as trusted automatically and verifies each request. NIST SP 800-207 describes the architecture. Penetration tests of zero trust environments check whether identity, device and segmentation controls hold when an attacker has a foothold.