Key terms

A glossary of the platform's terminology, covering organisation and project, AI Sidekick and MCP, and the risk/compliance/exposure vocabulary used throughout these docs.

Short definitions for terms used across these docs, grouped by area. See Introduction for the fuller explanation of how an organisation, project and module fit together.

Platform

Term	Meaning
Organisation	Your tenant. Data is isolated per organisation, and every credential is bound to one.
Project	A scope within an organisation: its own assets, assessments, risks and evidence. Every organisation has a main project, which carries the organisation's main domain. The Admin role granted there cascades across every other project in the organisation; other roles stay scoped to the project they were granted on.
Module	A capability switched on per organisation: governance and compliance, attack-surface scanning, identity-exposure scanning, or the policy starter set. Engagements needs no module switch. See Getting started.

AI and agents

Term	Meaning
AI Sidekick	The platform's built-in AI vCISO: five expert personas, each suited to a different job. See AI Sidekick.
Persona	One of AI Sidekick's five roles (CISO, Compliance Officer, Security Analyst, Incident Responder, Pentester), each with its own conversation history and tailorable operating policy.
MCP (Model Context Protocol)	The open protocol the platform's agent server speaks. Point any MCP-compatible client (Claude, Copilot, or your own) at your tenant. See Connect your AI agent.
Proposal	A change an AI persona drafts but does not apply (a compliance score, a risk, or a remediation action), held for a human to approve or reject.
Action	A tracked, assignable piece of remediation work, whether it came from a proposal, a failed check, or a manually logged gap.

Risk and compliance

Term	Meaning
GRC	Governance, Risk and Compliance: the combined discipline of setting policy, managing risk and demonstrating conformance to a standard.
NIST CSF	The NIST Cybersecurity Framework, the platform's free, always-on spine framework. Every other supported standard is mapped onto it, which is what makes cross-framework coverage possible.
Coverage	How much of a framework's requirements are addressed, whether by a claimed assessment answer, a mapped control, or attached evidence.
Maturity	How consistently and reliably a control operates, distinct from whether it exists at all. A control can be present but still immature.
Inherent risk	The level of risk before any control or mitigation is taken into account.
Residual risk	The level of risk that remains after controls are applied: what you're carrying today.

Exposure

Term	Meaning
Finding	A specific occurrence of a vulnerability on a specific asset: the thing you triage.
Vulnerability	The underlying weakness (typically a CVE) that one or more findings point back to.
Exposure band	A ranking of findings by how exploitable and reachable they are, not by severity alone. See Exposure.
EPSS	The Exploit Prediction Scoring System, an industry score estimating how likely a vulnerability is to be exploited in the wild.
KEV	The Known Exploited Vulnerabilities catalogue: vulnerabilities with confirmed, real-world exploitation, which rank higher as a result.

Penetration tests and assessments

Term	Meaning
Engagement	One penetration test or security assessment: its scope, testing window, team, findings and report. Distinct from a compliance assessment, which is scoring yourself against a framework. See Penetration tests & assessments.
Scope target	Something agreed to be in (or explicitly out of) scope for an engagement — a URL, hostname, IP range, or free text. Optionally linked to a discovered asset.
Finding reference	The identifier a finding is given when attached to an engagement (F-01, F-02). It stays with the finding through remediation and any retest, so a client can cite it later; renumbering the engagement's findings is the one action that reassigns it, and a delivered report keeps the references it was generated with.
Vulnerability library	A shared catalogue of reusable write-ups — description, impact, remediation, CVSS, OWASP category — instantiated onto a finding and then edited for the instance you found.
Retest	A follow-up engagement that links back to its predecessor, carrying a per-finding verdict on whether the fix held.

Cloud and SaaS posture

Term	Meaning
Configuration posture	Your cloud/SaaS tenant's settings checked against the same NIST CSF spine as everything else. A failing check becomes evidence against the requirement it maps to, plus a remediation proposal that, by default, waits for a person to approve.
Microsoft Secure Score	Microsoft 365's own configuration score, tracked over time alongside the platform's own checks once you connect a tenant. See Exposure.