Quick Answer: This glossary covers the key terms used in external attack surface management, vulnerability scanning, and security compliance — from attack paths and CVSS scores to DMARC records and subdomain takeover. Each entry links to a full definition page with practical context for startup and SMB security teams.
What attack surface and asset discovery terms matter?
- EASM (External Attack Surface Management) — the continuous practice of discovering and monitoring all internet-facing assets for vulnerabilities
- Attack Surface — the complete set of entry points an attacker could use to interact with your systems
- External Attack Surface — the portion of your attack surface visible from the public internet
- Asset Discovery — the process of identifying all internet-facing assets associated with a domain
- Subdomain Takeover — when a DNS record points to an unclaimed external service, allowing an attacker to claim it
- Dangling CNAME — a DNS CNAME record pointing to a hostname that no longer exists
- Exposed Admin Panel — an administrative interface accessible from the public internet without restriction
What vulnerability and finding terms matter?
- Verified Exploitability — a finding that includes reproducible proof it can be exploited, not just an indicator it might be
- False Positive — a finding reported as a vulnerability that is not actually exploitable in the target environment
- CVSS Score — Common Vulnerability Scoring System, a standardised 0–10 numerical severity rating for vulnerabilities
- Business Impact Score — VeilScan's 0–10 risk rating that weights technical severity against business context
- Attack Path — a chain of vulnerabilities and steps an attacker follows from initial access to a meaningful impact
- Public S3 Bucket — a cloud storage bucket misconfigured to allow unauthenticated public access
- Exposed .env File — a configuration file containing secrets accidentally published to the web
- TLS Misconfiguration — insecure TLS/SSL settings including expired certificates, weak ciphers, or missing HSTS
What email security terms matter?
- DMARC — Domain-based Message Authentication, Reporting, and Conformance; email authentication policy that prevents spoofing
- SPF Record — Sender Policy Framework; a DNS record that specifies which mail servers are authorised to send email for your domain
- DKIM — DomainKeys Identified Mail; a cryptographic email authentication standard that signs outgoing messages
What monitoring and process terms matter?
- Continuous Monitoring — ongoing automated scanning to detect new vulnerabilities as infrastructure and code change over time
What are the most common questions?
Why do these definitions matter for non-security teams?
Security findings use specialised terminology that can be opaque to CTOs and founders without a security background. Understanding what a subdomain takeover or DMARC misconfiguration actually means — and what the business impact is — helps you make better decisions about which findings to fix first and how to explain security risk to your board or auditors.
Are these definitions vendor-neutral?
Yes. The core definitions on this glossary page are vendor-neutral. Where VeilScan-specific terms are used (like Business Impact Score), the definition explains how that term relates to broader industry concepts. VeilScan-specific terms are noted as such in the individual definition pages.
Where can I learn more about each term in practice?
Each term links to a full definition page with context on how it appears in real scan results, what the business impact is, and what remediation looks like. See also: FAQ, Features, and Documentation.
See these terms in your own scan results.
The free plan scans one domain at no cost and shows real findings with plain-language explanations.
Start your free scan →