# Pentest glossary: 60+ terms buyers meet

Source: https://pentestcompare.com/glossary/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

A pentest glossary with 60+ terms from scope and severity to BOLA, PTaaS and prompt injection, each in one to three plain sentences with links to deeper guides.

Terms you meet when you buy a penetration test, in alphabetical order. Each entry is a short definition. Where a standard or vendor defines the term, we say so. For the buying process, see the [buyer guides](/guides/), and use the [provider table](/providers/) to compare providers.

### API penetration testing
A pentest of an application programming interface: its endpoints, authentication, authorization and rate limits. Testers often work from an OpenAPI file or a Postman collection. OWASP keeps a separate API Security Top 10 (2023 edition).

### Approved Scanning Vendor (ASV)
A company approved by PCI SSC to run the external vulnerability scans PCI DSS asks for every three months. An ASV scan is a scan, not a pentest. See [pentest vs vulnerability scan](/guides/pentest-vs-vulnerability-scan/).

### Attack surface
The set of points where an attacker can send input or reach a system: domains, IP addresses, APIs, login pages, file uploads and exposed cloud storage. A larger surface needs a larger scope.

### Attestation letter
A short letter from a provider that says a test took place and states its date and scope. No standard defines the letter, and acceptance by auditors or customers varies. The service-site guide on [pentest attestation letters](https://penetrationtestservices.com/guides/pentest-attestation-letter/) covers what one should contain.

### Authenticated testing
Testing while signed in as one or more users. It reaches features behind a login and lets testers compare what each role can see. Most authorization flaws appear only in authenticated tests.

### Authorization (written permission)
The system owner's written consent to a test, with scope and dates. Without it, a test can break the law. Providers should ask for it before any testing. Not to be confused with the access-control sense below.

### Authorization testing
Checking that each user can reach only what their role allows. It covers horizontal access (another user's data) and vertical access (admin functions). OWASP groups these flaws under broken access control and, for APIs, BOLA and BFLA.

### Black-box testing
Testing with no inside information, as an outside attacker would start. The tester gets a URL and perhaps nothing else. See the [black box, grey box and white box guide](https://penetrationtestservices.com/guides/black-box-grey-box-white-box-testing/).

### Bug bounty
A program that pays researchers for valid vulnerability reports, with no fixed end date unless the program sets one. It differs from a pentest in payment, tester count and report. See [bug bounty vs pentest](/guides/bug-bounty-vs-pentest/).

### Broken access control
A class of flaw where users can act outside their permissions. It covers IDOR, missing function-level checks and privilege escalation. Penetration tests prove it by repeating a request with another account.

### Broken Object Level Authorization (BOLA)
OWASP API1:2023. An API flaw where changing an object ID in a request returns or changes another user's object. The web term for the same pattern is IDOR. See [IDOR testing](https://penetrationtestservices.com/guides/idor-testing/).

### Business logic flaw
A flaw in how an application's rules work, such as skipping a payment step or reusing a coupon. Scanners rarely find these because they do not know your rules. OWASP's testing guide has a business logic section (WSTG-BUSL). See [business logic vulnerabilities](https://penetrationtestservices.com/guides/business-logic-vulnerabilities/).

### Control (test control)
A request that should fail, run next to an exploit attempt: a nonexistent ID, another account's token or an anonymous call. When the control fails as expected, the finding is more credible. Reports can list controls that held.

### CREST
A professional body that accredits penetration testing companies and certifies individuals. Check what a provider's badge covers (a company or a person) and look it up on the body's public register.

### CSRF (cross-site request forgery)
An attack that, in the words of OWASP's testing guide, "forces an end user to execute unintended actions on a web application in which they are currently authenticated". See [CSRF testing](https://penetrationtestservices.com/guides/csrf-testing/).

### CVSS (Common Vulnerability Scoring System)
A scoring system maintained by FIRST. CVSS v4.0, released 1 November 2023, rates scores as Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0). Use of these ratings is optional.

### DAST (dynamic application security testing)
Automated testing of a running application from outside, by sending requests and reading responses. It is scanner technology. Some newer tools add AI to follow user flows. See [automated pentesting tools](/guides/automated-pentesting-tools/).

### Differential testing
Comparing what two callers receive for the same request, such as an anonymous user and a signed-in user, or two accounts of different roles. It is a main method for finding access-control flaws.

### Evidence
What proves a finding: the request, the response and the observed effect. A write is proven when another session reads the changed record back. A bare "success" message is not proof.

### Exploit
Code, a request or a technique that takes advantage of a vulnerability. In a pentest, testers use the least harmful exploit that proves impact.

### External penetration test
A test from outside the network, against what the internet can reach. PCI DSS v4.0.x asks for internal and external pentests at least every 12 months and after significant change.

### False positive
A reported issue that is not a real vulnerability. Scanners produce many. Manual review or exploit validation removes them.

### Finding
One reported issue, with a title, severity, description, evidence, reproduction steps and a fix. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) lists what a good finding includes.

### Grey-box testing
Testing with partial inside knowledge, such as test accounts and API docs. It is the most common setup for web apps because it reaches signed-in features.

### IDOR (insecure direct object reference)
A flaw where an application gives access to an object based on a user-supplied value such as an ID, without checking ownership. OWASP's testing guide ID is WSTG-ATHZ-04. See [IDOR testing](https://penetrationtestservices.com/guides/idor-testing/).

### Impact
What an attacker gains from a flaw: data exposed, actions taken, money lost. A good report states impact from the evidence, not from the vulnerability class alone.

### Internal penetration test
A test from inside the network, as a malicious insider or an attacker who already has a foothold would. It is a separate test from an external one.

### Jailbreak
An attack that tries to get an AI model to ignore its safety rules. OWASP's LLM01:2025 treats it as a form of prompt injection, while MITRE ATLAS lists the two as separate techniques. See [jailbreak vs prompt injection](https://airedteamingservices.com/guides/jailbreak-vs-prompt-injection/).

### Mass assignment
A flaw where an API lets a user set fields they should not, for example by adding an `is_admin` field to a request. OWASP API3:2023 covers it under broken object property level authorization.

### Model Context Protocol (MCP)
An open protocol that lets AI applications call external tools and data sources. Its servers and clients are a new surface to test. See [MCP security risks](https://airedteamingservices.com/guides/mcp-security-risks/).

### Multi-tenant
A system where one deployment serves many customers (tenants). The core test is that tenant A can never read or change tenant B's data. See [multi-tenant isolation testing](https://penetrationtestservices.com/guides/multi-tenant-isolation-testing/).

### NIST SP 800-115
A NIST guide to security testing and assessment, published September 2008 and still listed as final. It is old, so do not describe it as a current NIST requirement.

### OWASP ASVS
The OWASP Application Security Verification Standard, a list of security requirements for web apps. Version 5.0.0 was published on 30 May 2025.

### OWASP API Security Top 10
OWASP's list of the most critical API risks. The 2023 edition has API1 Broken Object Level Authorization through API10. See the [API Security Top 10 guide](https://penetrationtestservices.com/guides/owasp-api-security-top-10/).

### OWASP Top 10
OWASP's awareness list of the most critical web application risks. See the [OWASP Top 10 guide](https://penetrationtestservices.com/guides/owasp-top-10-2025/).

### OWASP Web Security Testing Guide (WSTG)
OWASP's guide to testing web apps, with test IDs such as WSTG-ATHZ-04. The stable release is v4.2, and v5.0 is in development.

### Out of scope
Assets or actions the provider must not test, written into the scope. Examples are third-party services, production data and denial-of-service tests.

### Penetration test (pentest)
A test where evaluators, in NIST's wording, "attempt to circumvent or defeat the security features of a system", usually within defined limits. It ends in a report of proven findings. See [pentest vs vulnerability scan](/guides/pentest-vs-vulnerability-scan/).

### Prompt injection
An attack on an LLM application where untrusted text changes what the model does. It is direct when the user types it and indirect when it arrives in content the model reads. See [prompt injection](https://airedteamingservices.com/guides/prompt-injection/).

### Proof of concept (PoC)
A minimal example that shows a flaw can be exploited. Reports often include a PoC request or script that is safe to run only with authorization.

### PTaaS (penetration testing as a service)
A delivery model that uses an online platform for scoping, live findings and retests, often on a subscription or credit model. See [PTaaS vs traditional pentesting](/guides/ptaas-vs-traditional-pentesting/).

### PTES
The Penetration Testing Execution Standard, a community methodology. Its pages were last edited in 2014, so describe it as dated.

### QSA (Qualified Security Assessor)
A person certified by PCI SSC to assess PCI DSS compliance. Your QSA decides which requirements apply to you and what evidence they accept.

### RAG (retrieval-augmented generation)
A design where an LLM answers using documents fetched from a data store. The main test is that retrieval respects each user's access rights. See [RAG security](https://airedteamingservices.com/guides/rag-security/).

### Red team
A group that simulates a real adversary against people, process and technology over a longer period than a pentest, with a goal such as reaching a crown-jewel system. See [red team vs penetration testing](https://penetrationtestservices.com/guides/red-team-vs-penetration-testing/). For AI systems, see [what AI red teaming is](https://airedteamingservices.com/guides/what-is-ai-red-teaming/).

### Remediation
Fixing a finding. A report's remediation advice should name the layer, the check and a way to confirm the fix. See [after the pentest](https://penetrationtestservices.com/guides/after-the-pentest-remediation-and-retest/).

### Retest
A repeat test of a fixed finding to confirm that the fix works. PCI DSS v4.0.x requires exploitable findings to be corrected and the testing repeated. Retest terms differ by provider. See [retesting](https://penetrationtestservices.com/retesting/).

### Rules of engagement
The written agreement on how a test runs: authorization, scope, test windows, contacts, off-limits actions and stop conditions. See [rules of engagement](https://penetrationtestservices.com/guides/penetration-testing-rules-of-engagement/).

### SAST (static application security testing)
Automated analysis of source code without running it. It finds code patterns, not whether the running app can be exploited.

### Scope
The list of assets, environments, roles and test types in a contract. It decides price and what stays untested. Use the [scoping checklist](/tools/scoping-checklist/).

### Segmentation testing
A PCI DSS test that checks segmentation controls isolate the cardholder data environment. PCI DSS asks for it at least every 12 months where segmentation is used, and every six months for service providers.

### Severity
A rating of how serious a finding is, such as Critical, High, Medium or Low. Reports should define each level or state a CVSS version.

### SOC 2
An AICPA reporting framework on service-organization controls. Its Trust Services Criteria do not explicitly require a penetration test, though auditors and customers often ask for one. See [SOC 2 penetration testing providers](/guides/soc-2-penetration-testing-providers/).

### Social engineering
Tricking people into giving access or information, for example by phishing. A standard web app pentest does not include it unless the scope says so.

### SSRF (server-side request forgery)
A flaw where an attacker can make a server fetch a URL of the attacker's choice, which can reach internal resources. It is API7:2023 in the OWASP API list.

### Stored XSS
Cross-site scripting where the injected script is stored on the server, such as in a comment field, and runs for each visitor. OWASP files XSS under Injection in the Top 10:2025.

### Tenant isolation
The property that one customer cannot reach another customer's data in a shared system. Testers check it with accounts in two tenants. See [multi-tenant isolation testing](https://penetrationtestservices.com/guides/multi-tenant-isolation-testing/).

### Threat model
A structured list of what you protect, who might attack it and how. AI red teams use one to choose tests. A pentest scope often starts from a light version.

### Vulnerability assessment
In NIST's glossary, a "systematic examination of an information system or product to determine the adequacy of security measures". Vendors often use the term for scanner-led work.

### Vulnerability scan
An automated check of systems against known weaknesses. PCI DSS v4.0.x covers scans in requirement 11.3 and pentests in 11.4. See the [PCI penetration testing requirements](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/).

### White-box testing
Testing with full inside knowledge: source code, architecture and credentials. It finds more per hour than black-box testing, and it requires you to share code.