Updated
Key terms
One-line definitions of the CISO360AI terms that are easy to confuse, such as finding, vulnerability and observation, or assessment and engagement.
| Term | Meaning | Guide |
|---|---|---|
| Finding | One weakness on one asset: the thing you triage. | Exposure |
| Vulnerability | The underlying weakness, typically a CVE. One vulnerability can have many findings, one per affected asset. | Vulnerabilities |
| Observation | A neutral fact a scan records about an asset, such as a detected technology or open port. | Findings |
| Assessment | Your scoring against one framework, requirement by requirement, under Compliance. It is not an engagement. | Score an assessment |
| Engagement | One penetration test, with its scope, testing window, findings and report. | Engagements |
| Requirement score | Claimed, Validated, Gap, Managed or Not applicable: the score you give one requirement in an assessment. | Score an assessment |
| Verified posture | Your confirmed position against a framework, shown apart from Claimed posture. | Score an assessment |
| Agent | An AI tool you connect to the platform, such as an assistant in an MCP client. | Connect an agent |
| Persona | One of the AI Sidekick's expert roles. | AI Sidekick |
| Proposal | A change suggested by the AI Sidekick or a connected agent, approved or rejected under Tasks › Inbox. | Tasks |
| Connector | A connection to a cloud or identity service, made under Cloud posture › Connectors. It is not the CISO360AI connector you add inside an AI tool. | Connectors |
| Identity exposure | An email address or password from your organisation that turned up in a breach or on the dark web. | Identity exposures |
| Main project | The project created with your organisation. Admin on it is the organisation administrator, shown as Super Admin in the app. | Roles and permissions |
| Main domain | The domain you signed up with: the one scans target by default and the setup wizard asks you to authorise. Until you verify it, scan results show as totals. | Set up your organisation |
| Module | A content area you choose for your organisation, such as GRC / compliance or attack surface. | Your modules |
| GRC | Governance, risk and compliance: the module behind frameworks and assessments. | GRC / compliance |
| CTEM | Continuous threat exposure management: the Attack surface module, which scans your main domain. | Attack surface (CTEM) |
| CSPM | Cloud security posture management: the Cloud posture module. | Cloud posture (CSPM) |
| Pentest as a Service | The pricing page's name for engagements: penetration tests you run and track on the platform. | Engagements |
| Guest | Someone from another organisation given a role on one of your projects. | Users and access |
| Section | A reusable block of text that policies and reports are built from, kept under Templates › Sections. | Sections |
| Assessment report | A penetration test report for one engagement, under Assurance › Reports. Not the compliance assessment above. | Reports |