⬢ Reference · 66 Terms · Updated May 2026
Penetration Testing Glossary Terms, Acronyms & Definitions
A working glossary of 66 terms used in Australian penetration testing engagements. Vulnerability classes (XSS, IDOR, BOLA, SSRF), methodologies (OWASP WSTG, NIST 800-115, PTES, MITRE ATT&CK), certifications (CREST, OSCP), and Australian compliance frameworks (APRA CPS 234, Essential Eight, IRAP, ISM, Privacy Act).
Clear scope, real exploitation, audit-ready evidence
A practical Penva Security guide for Australian teams comparing methodology, timelines, active testing effort and final evidence quality.
At-a-glance
Key buyer signals before you book
A compact summary of standards, phases, timing, deliverables and evidence requirements.
- Total terms: 66
- Vulnerability classes: 12 terms
- Methodologies / frameworks: 6 terms
- AU / global compliance: 8 terms
- Certifications: 2 terms
- Schema type: DefinedTermSet
- Per-term URLs: All anchorable
Quick Answer
About this glossary
A working glossary of penetration testing terms used by Penva Security and the broader CREST-aligned Australian penetration testing community.
Quick answer
About this glossary
A working glossary of penetration testing terms used by Penva Security and the broader CREST-aligned Australian penetration testing community.
Use the alphabetical navigation to jump to a letter, or search the page (Ctrl/Cmd + F) for a specific term. Every definition is self-contained and linkable – each term has its own URL fragment for direct citation.
Terms include vulnerability classes (XSS, SQLi, IDOR, BOLA, SSRF, RCE), testing methodologies (OWASP WSTG, NIST SP 800-115, PTES, MITRE ATT&CK), certifications (CREST, OSCP), and Australian compliance frameworks (APRA CPS 234, Essential Eight, IRAP, ISM, Privacy Act).
Certified & aligned with
Security Standards We Support
Recognised frameworks and methodologies used across Penva Security engagements.
CREST
OSCP
OWASP WSTG
PTES
CVSS
CWE / CVE
Jump To Letter
Browse the 66 Terms
Use the alphabetical index to quickly find penetration testing terms, vulnerability classes, compliance acronyms and methodology references.
66+ terms
Australian penetration testing terminology, acronyms, frameworks and vulnerability classes in one place.
22 active letters
Every term is organised alphabetically so your team can quickly find what a report or proposal means.
Buyer-friendly
Definitions are written for decision-makers, technical teams and compliance reviewers, not just security specialists.
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
Glossary Letter
A
6 penetration testing terms beginning with A.
API Penetration Testing
Manual security testing of REST or GraphQL APIs against the OWASP API Security Top 10 – covering broken object-level authorisation, broken function-level authorisation, mass assignment, excessive data exposure, and rate-limit abuse. The dominant attack surface for modern SaaS and mobile applications.
Learn more →
Application Security AppSec
The practice of finding, fixing and preventing security vulnerabilities in software applications throughout the development lifecycle. Includes penetration testing, code review, security architecture review, and developer security training.
Attack Surface
The complete set of points where an unauthorised user could attempt to enter, extract data from, or take control of a system. Includes internet-exposed services, APIs, web applications, mobile applications, employee devices, and supply-chain integrations.
Authentication AuthN
The process of verifying that a user is who they claim to be. Common mechanisms include passwords, multi-factor authentication, single sign-on (SSO), biometric authentication and hardware security keys. Distinct from authorisation.
Authorisation AuthZ
The process of determining what an authenticated user is allowed to do. Authorisation flaws – broken access control, IDOR, BOLA – are the single most common high-severity vulnerability class in modern applications. Distinct from authentication.
APRA CPS 234 CPS 234
The Australian Prudential Regulation Authority’s information security standard for ADIs, insurers, and superannuation funds. Paragraphs 27 and 28 specifically address penetration testing requirements for APRA-regulated entities.
Learn more →
Glossary Letter
B
4 penetration testing terms beginning with B.
BOLA Broken Object Level Authorisation
Number 1 on the OWASP API Security Top 10. A vulnerability where an authenticated user can access objects (records, files, resources) belonging to other users by manipulating object identifiers in API requests. The API-specific version of IDOR.
Broken Access Control
OWASP Top 10 #1 (web). A class of vulnerabilities where authorisation rules are inconsistently enforced, allowing users to access or modify resources they shouldn’t. Includes IDOR, BOLA, horizontal and vertical privilege escalation, and authorisation bypass via parameter manipulation.
Bug Bounty
A program where organisations invite external security researchers to find vulnerabilities in exchange for rewards. Distinct from penetration testing – bug bounty runs continuously and crowdsources researchers; pentest is a defined-scope, time-bounded engagement with specific testers.
Burp Suite
An industry-standard web application security testing platform from PortSwigger. Used by virtually every web application pentest team for proxy-based testing, request manipulation, and vulnerability discovery. Burp is a tool, not a methodology – automated ‘Burp scans’ alone are not penetration testing.
Glossary Letter
C
6 penetration testing terms beginning with C.
Cloud Penetration Testing
Manual security testing of cloud infrastructure (AWS, Azure, Google Cloud) focusing on IAM weaknesses, exposed storage, metadata service abuse, secret management, and cloud-native service misconfigurations. Tests the configuration surface, not the cloud provider’s underlying platform.
Learn more →
CREST Council of Registered Ethical Security Testers
An international not-for-profit accreditation body for cybersecurity service providers and individuals. CREST credentials (CRT, CPSA, CCT App, CCT Inf) are the recognised baseline for penetration testing in Australian government procurement, APRA-regulated entities, and most enterprise security programs.
CSRF Cross-Site Request Forgery
An attack that tricks an authenticated user’s browser into submitting unintended requests to a web application. Defended against using anti-CSRF tokens, SameSite cookies, and proper CORS configuration. Distinct from XSS, which targets the user’s browser directly.
CVE Common Vulnerabilities and Exposures
A standardised identifier for publicly disclosed security vulnerabilities, maintained by MITRE. CVE-YYYY-NNNN format. Pentesters use CVE matching during reconnaissance to identify known vulnerabilities in fingerprinted technologies.
CVSS Common Vulnerability Scoring System
An open standard for rating the severity of security vulnerabilities, currently at v3.1 and v4.0. Produces a numeric score (0.0-10.0) and severity rating (None, Low, Medium, High, Critical). Used in penetration test reports to communicate finding severity in a way auditors and risk teams recognise.
CWE Common Weakness Enumeration
A community-developed list of common software and hardware weakness types, maintained by MITRE. Pentest findings often map to CWE identifiers (CWE-79 for XSS, CWE-89 for SQL injection) to standardise terminology across reports and tools.
Glossary Letter
D
2 penetration testing terms beginning with D.
DAST Dynamic Application Security Testing
Automated security testing of a running application from the outside, simulating attacker behaviour. Distinct from SAST (static testing of source code) and IAST (instrumented testing). DAST tools produce signal but cannot replace manual penetration testing – they miss business logic and authorisation flaws.
Defence in Depth
A security strategy that layers multiple defensive controls so the failure of any single control doesn’t expose the system. Pentest findings often map to defence-in-depth gaps where a single control failure produces a full compromise path.
Glossary Letter
E
3 penetration testing terms beginning with E.
Essential Eight E8
The Australian Signals Directorate’s prioritised set of eight mitigation strategies for malicious cyber activity. Maturity levels ML0-ML3 indicate implementation completeness. Increasingly a procurement criterion for Australian Government supply-chain engagements.
Learn more →
Exploit
Code, technique, or sequence of actions that takes advantage of a vulnerability to cause unintended behaviour – typically gaining unauthorised access, escalating privileges, or extracting data. Pentesters develop and demonstrate exploits as proof that vulnerabilities are real and exploitable.
External Penetration Test
Penetration testing of internet-exposed infrastructure from outside the organisation’s network. Tests what an unauthenticated internet attacker can do against the perimeter. Often combined with internal penetration testing for full coverage.
Glossary Letter
F
1 penetration testing term beginning with F.
FHIR Fast Healthcare Interoperability Resources
An HL7 healthcare data exchange standard for clinical and administrative data, currently at R4 and R5. FHIR API testing is a specialist component of HealthTech penetration testing – SMART on FHIR OAuth flows, scope handling, patient-context binding.
Glossary Letter
G
1 penetration testing term beginning with G.
GraphQL
An API query language and runtime developed by Facebook, now widely adopted. GraphQL APIs introduce specific testing concerns – introspection exposure, deeply-nested query DoS, batched-query authorisation issues – that REST API testing methodologies don’t fully cover.
Glossary Letter
H
2 penetration testing terms beginning with H.
HIPAA Health Insurance Portability and Accountability Act
The U.S. healthcare data protection regulation. Australian HealthTech vendors serving US covered entities (as business associates) must comply with the HIPAA Security Rule’s administrative, physical and technical safeguards.
Learn more →
HL7 Health Level Seven
Standards for the electronic exchange of clinical, financial and administrative healthcare data. HL7 v2.x messaging and FHIR (HL7 v4) are the dominant standards. Healthcare penetration testing typically includes HL7 / FHIR interface security where present.
Glossary Letter
I
5 penetration testing terms beginning with I.
IDOR Insecure Direct Object Reference
A vulnerability where an attacker can access objects directly by manipulating identifiers (URLs, form fields, API parameters) without proper authorisation checks. Classic example: changing /account/123 to /account/124 to view another user’s account. The web-application equivalent of BOLA.
Internal Penetration Test
Penetration testing from inside the organisation’s network, simulating an attacker who has gained foothold via phishing, malicious insider, or compromised workstation. Tests lateral movement, privilege escalation, and access to sensitive data.
Learn more →
IRAP Information Security Registered Assessors Program
An Australian Signals Directorate program endorsing cybersecurity professionals to assess information security against Australian Government standards (ISM). Required for Government certification of cloud and ICT services.
Learn more →
ISM Information Security Manual
The Australian Signals Directorate’s comprehensive guidance for protecting Australian Government information. The basis of IRAP assessments and a common reference for Government supply-chain engagements.
Learn more →
ISO 27001
The international standard for information security management systems. Annex A.8.8 (vulnerability management) and A.8.29 (security testing during development) specifically address penetration testing requirements.
Learn more →
Glossary Letter
J
1 penetration testing term beginning with J.
JWT JSON Web Token
A compact, URL-safe means of representing claims between two parties. Widely used for authentication tokens. Common JWT vulnerabilities pentested include algorithm confusion attacks, signature bypass, key disclosure, and weak signing secrets.
Glossary Letter
L
2 penetration testing terms beginning with L.
LFI Local File Inclusion
A vulnerability where an attacker can read local files on the server by manipulating file-path parameters. Distinct from RFI (Remote File Inclusion) which executes remote files. Both fall under the broader Path Traversal vulnerability class.
LLM Large Language Model
A class of machine-learning models trained on large text corpora, including GPT, Claude, Gemini, and others. LLM penetration testing focuses on the OWASP LLM Top 10 – prompt injection, data leakage, insecure plugin design, agent tool misuse.
Learn more →
Glossary Letter
M
3 penetration testing terms beginning with M.
MASVS Mobile Application Security Verification Standard
The OWASP standard for mobile application security testing, covering iOS and Android. The methodology underlying credible mobile application pentests. Aligned with the MSTG (Mobile Security Testing Guide).
MITRE ATT&CK
A curated knowledge base of adversary tactics, techniques and procedures derived from real-world threat intelligence. Pentest findings can be mapped to ATT&CK technique identifiers (e.g., T1135 Network Share Discovery) to give security teams direct detection-coverage context.
Learn more →
MFA Multi-Factor Authentication
Authentication requiring more than one factor – knowledge (password), possession (hardware key, mobile app), or inherence (biometric). Pentesters test MFA implementation for bypass paths, weak fallback mechanisms, and session-token theft.
Glossary Letter
N
1 penetration testing term beginning with N.
NIST SP 800-115
The U.S. National Institute of Standards and Technology’s Technical Guide to Information Security Testing and Assessment. Defines the four-phase model (planning, discovery, attack, reporting) widely used as the documented methodology for compliance-driven penetration testing.
Learn more →
Glossary Letter
O
3 penetration testing terms beginning with O.
OSCP Offensive Security Certified Professional
A widely-recognised hands-on offensive security certification from Offensive Security. Holding an OSCP demonstrates practical exploitation skill via a 24-hour exam. OSCP-certified testers are a common requirement for credible penetration testing in Australia.
OSINT Open Source Intelligence
Intelligence gathered from publicly available sources – DNS records, certificate transparency logs, social media, code repositories, breach data. Used during the reconnaissance phase of penetration testing to map an organisation’s attack surface.
OWASP Open Web Application Security Project
An international not-for-profit foundation that maintains free, open security resources including the OWASP Top 10, Web Security Testing Guide (WSTG), API Security Top 10, MASVS, and LLM Top 10. The dominant set of vulnerability classifications in web and API security.
Glossary Letter
P
7 penetration testing terms beginning with P.
PCI DSS Payment Card Industry Data Security Standard
The information security standard for organisations handling payment card data. Currently at v4.0.1. Requirement 11.4 specifically addresses penetration testing of the Cardholder Data Environment (CDE).
Learn more →
PHI Protected Health Information
Individually-identifiable health information held by HIPAA-covered entities or business associates. Healthcare pentesting includes specific PHI-handling tests – storage encryption, transmission encryption, log redaction, screenshot exclusion.
Phishing
A social engineering attack that uses fraudulent communications (typically email) to trick users into disclosing credentials or installing malware. Pentest engagements can include targeted phishing campaigns (spear-phishing) as part of red team exercises.
PII Personally Identifiable Information
Information that can identify a specific individual. Includes obvious identifiers (name, email, government ID numbers) and combinations that become identifying (date of birth + postcode + employer). Subject to Privacy Act APP 11 in Australia.
Privilege Escalation PrivEsc
An attack that elevates the attacker’s permissions beyond what was originally granted. Vertical privilege escalation gains higher-level access (user to admin); horizontal privilege escalation gains access to other accounts at the same level.
PTaaS Penetration Testing as a Service
A delivery model for penetration testing offered as an ongoing subscription with platform-based delivery, continuous coverage, and on-demand engagement scheduling. Distinct from project-based pentest engagements.
Learn more →
PTES Penetration Testing Execution Standard
A practitioner-authored penetration testing methodology defining seven phases: pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation, and reporting. The tactical playbook inside most credible engagements.
Learn more →
Glossary Letter
R
4 penetration testing terms beginning with R.
Red Team
An offensive security engagement focused on testing an organisation’s detection and response capabilities by simulating realistic threat actors with specific objectives (e.g., access executive email, exfiltrate sensitive data). Distinct from penetration testing in goal – red team tests blue team, pentest tests applications.
Remediation
The process of fixing vulnerabilities identified during a penetration test. Penva Security’s engagements include a 60-day remediation window with free retest, producing the closure evidence auditors expect.
RCE Remote Code Execution
A vulnerability that allows an attacker to execute arbitrary code on a target system from a remote location. Among the highest-severity vulnerability classes – typically rated CVSS 9.0-10.0 (Critical).
Retest
Verification testing performed after remediation to confirm that findings have been successfully fixed. Critical for compliance evidence – auditors expect closure verification, not just initial findings. Penva Security includes a 60-day free retest with every engagement.
Glossary Letter
S
7 penetration testing terms beginning with S.
SAST Static Application Security Testing
Automated security analysis of source code without executing the application. Distinct from DAST (dynamic testing of running applications). SAST tools find code-level vulnerability patterns but generate significant false positives without human triage.
Scoping
The initial phase of a penetration test where the scope, methodology, timeline, exclusions, and Rules of Engagement are defined. Penva Security’s scoping calls are 30-minute free conversations that produce a fixed-price quote within 24 hours.
SOC 2
An auditing standard for service organisations developed by AICPA, covering Security, Availability, Processing Integrity, Confidentiality and Privacy. Trust Services Criterion CC7.1 specifically addresses penetration testing evidence.
Learn more →
Social Engineering
Attacks that manipulate people into divulging information or taking actions that compromise security. Includes phishing, vishing (phone), smishing (SMS), pretexting, and physical intrusion. Tests human controls rather than technical controls.
SQL Injection SQLi
A web application vulnerability where untrusted input is incorporated into database queries without proper parameterisation, allowing an attacker to execute arbitrary database commands. Defended against using parameterised queries and ORMs with proper escaping.
SSRF Server-Side Request Forgery
A vulnerability where an attacker can induce the server to make HTTP requests to arbitrary destinations – including internal services, cloud metadata endpoints (AWS IMDS), and other resources the attacker shouldn’t reach. Particularly dangerous in cloud environments.
SSO Single Sign-On
An authentication scheme that allows users to access multiple applications with one set of credentials. Common implementations include SAML 2.0, OpenID Connect, and OAuth 2.0. Pentest engagements specifically test SSO flows for misconfiguration, session-fixation, and token-validation issues.
Glossary Letter
T
2 penetration testing terms beginning with T.
Threat Modelling
A structured analysis of an application or system to identify potential security threats, their impact, and the necessary defensive controls. Common approaches include STRIDE, PASTA, and attack-tree modelling. The third phase in PTES methodology.
TTP Tactics, Techniques and Procedures
The behavioural descriptions of how threat actors operate, catalogued comprehensively in MITRE ATT&CK. Penetration test reports increasingly map findings to TTPs so security teams can connect results directly to their SIEM and EDR detection coverage.
Glossary Letter
V
2 penetration testing terms beginning with V.
Vulnerability Vuln
A weakness in a system, application, network, or process that could be exploited to cause harm. Pentest findings are documented vulnerabilities with severity scores, proof of exploitability, and remediation guidance.
Vulnerability Assessment VA
A systematic review of a system’s security weaknesses using primarily automated tools. Distinct from penetration testing – VA identifies potential issues; pentesting proves which are actually exploitable.
Learn more →
Glossary Letter
W
2 penetration testing terms beginning with W.
Web Application Penetration Testing
Manual security testing of web applications aligned to the OWASP Web Security Testing Guide (WSTG) v4.2. Covers 91 test cases across authentication, authorisation, input validation, business logic, cryptography and API testing.
Learn more →
WSTG Web Security Testing Guide
The OWASP Web Security Testing Guide, currently at v4.2. The de facto standard methodology for web application penetration testing – 91 distinct test cases across 12 categories, with each test mapping to specific CWE identifiers.
Learn more →
Glossary Letter
X
1 penetration testing term beginning with X.
XSS Cross-Site Scripting
A web application vulnerability where untrusted user input is rendered to other users without proper encoding, allowing an attacker to execute JavaScript in victims’ browsers. Categories include stored, reflected, and DOM-based XSS. Defended against using context-aware output encoding and Content Security Policy.
Glossary Letter
Z
1 penetration testing term beginning with Z.
Zero Day 0-day
A vulnerability unknown to the vendor and to the public defensive community at the time it’s exploited. Distinct from disclosed vulnerabilities with CVEs. Pentest engagements occasionally discover zero-days during the testing process; responsible disclosure protocols apply.
FAQ
About This Glossary
Direct answers to the questions about how this glossary is built and how to use it. Updated May 2026.
How is this glossary different from generic security glossaries?
This glossary is curated specifically for Australian penetration testing buyers – covering the 66 terms that appear in Penva Security engagement reports, the Australian compliance frameworks (APRA CPS 234, Essential Eight, IRAP, ISM, Privacy Act) most relevant to AU buyers, and the testing methodologies (OWASP WSTG v4.2, NIST SP 800-115, PTES, MITRE ATT&CK) actually used in credible engagements. Generic glossaries cover more terms; this one covers the terms that matter most to AU compliance-driven testing.
Why are vulnerability classes (XSS, IDOR, BOLA) and frameworks (PTES, NIST) in the same glossary?
Because pentest reports reference both fluently and buyers need to understand both. A typical Penva Security finding might read ‘IDOR vulnerability (CWE-639) in the /accounts API endpoint, mapped to MITRE ATT&CK T1078, contributes to OWASP API Security Top 10 #1 (BOLA).’ Without knowing all of IDOR, CWE, ATT&CK, T1078 and BOLA, the finding is opaque. The glossary brings them together.
Is this glossary citation-friendly for blog posts or training?
Yes. Every term has its own URL fragment (e.g., /penetration-testing-glossary/#idor) so you can deep-link to any definition. Each definition uses DefinedTerm schema, so AI engines (ChatGPT, Perplexity, Google AI Overview) can cite this page directly when answering queries about penetration testing terminology. Feel free to cite specific term URLs in your own content.
Where do these definitions come from?
Definitions are written from working pentester experience and validated against the canonical sources – OWASP project documentation, NIST SP 800-115, PTES specification, MITRE ATT&CK enterprise matrix, and Australian regulatory texts (APRA CPS 234, ASD ISM, OAIC Privacy Act guidance). They’re not academic – they’re how the terms are actually used in CREST-aligned Australian engagements.
Is the glossary kept current?
Yes. The glossary is reviewed and updated alongside our methodology pages – typically quarterly. As OWASP releases new Top 10 lists, as MITRE updates ATT&CK, and as Australian regulations evolve (e.g., APRA CPS 230 supply-chain rules in 2025), the relevant glossary entries are updated. The page footer shows the last update date.
Can you add a term we use that's missing?
Yes – particularly for industry-specific or AU-regulatory terms we haven’t covered. Email [email protected] with the term and we’ll add it to the next quarterly update if it’s broadly relevant. Customer-specific or product-specific terms generally aren’t added (those are for your own internal glossary).
Why does the glossary use DefinedTerm schema instead of just FAQ schema?
Because DefinedTerm is the schema specifically designed for glossary entries – it tells search engines and AI engines that each entry is a formal definition, not a Q&A. This dramatically increases the likelihood that ChatGPT, Perplexity, Claude (when browsing) and Google AI Overview will cite the definition directly when answering ‘what is X’ queries. FAQ schema would work; DefinedTermSet works better.
Are these definitions the same as Wikipedia or OWASP?
No – they’re shorter, more practical, and specifically framed for Australian pentest buyers. Wikipedia definitions tend toward academic completeness; OWASP definitions tend toward technical specification. These are written for the actual buyer reading a pentest report: ‘what does this term mean in the context of my engagement.’ Where we differ from canonical sources on substance, we link to them.
Next step
Need a Term Explained in the Context of Your Project?
Book a free 30-minute scoping call. We’ll walk through any glossary term in the context of your actual systems and compliance requirements – in plain language.
Need a Term Explained in the Context of Your Project?
Book a free 30-minute scoping call. We’ll walk through any glossary term in the context of your actual systems and compliance requirements – in plain language.