Security terms.
A shared language for your teams.

Audit chain

The append-only, hash-chained audit log. Altering or removing any record breaks the chain.

Blast radius

The known assets and services potentially affected by an issue. The view depends on available inventory and relationship evidence.

Callback

The single authenticated path by which scan results enter the platform. Every callback is single-use, signed and replay-protected.

Conflict

Two sources making incompatible claims about the same lineage hop. Conflicts are shown at read time and resolved at the source, never stored as edges.

Cross-walk

A mapping between requirements in different frameworks. Overlap may be partial; assess scope and evidence sufficiency for each requirement.

Decision

A digitally signed policy evaluation over a canonical input. An evaluator error is always a deny with an explicit reason.

Disposition

A human verdict on a finding — true positive, false positive, by design or accepted risk — with a mandatory reason code. Never written by AI or automation.

Evidence kind

One of seven typed evidence carriers on a native finding: code span, dataflow path, dependency path, config path, request trace, exploit proof or artifact hash.

Execution cluster

In development: a customer-registered Kubernetes cluster that runs scan jobs so code never leaves the customer's network. Today, run the whole platform self-hosted, on request.

Exploit path

A computed route from an exposure through identities, roles and policies to an asset, with its chokepoints and candidate interventions.

Lineage

The expected-hop walk Repository → Commit → Build → ContainerImage → Registry → Workload → KubeService → KubeIngress, built only from observed and derived edges.

Missing hop

A lineage hop the template expects but the graph does not have, reported with a reason: no_producer_data, source_gap or unbound_endpoint. Never stored.

Observation

A raw result from one tool about one thing. Observations are accepted or quarantined, then resolved into entities and findings.

Persona

A view-tier role (developer, AppSec, cloud, SOC, GRC, executive and others) that selects a home view. Access is decided by RBAC, never by persona.

Provenance class

How an edge was established: observed (telemetry, provider API, verified attestation), derived (deterministic join over immutable identifiers) or inferred (heuristic candidate, never on a strict path).

Reachability hint

For a dependency finding, whether vulnerable code is reachable, not_reachable or unknown, with a confidence and, when reachable, a call path.

Scan band

The untrusted zone where every scanner runs: isolated, short-lived and holding credentials for the scan target only.

Scan states

The explicit outcome every scan ends in: completed, partial (results kept from the tools that finished, with the gap shown) or failed with a reason.

Split secret

The principle that the credential which reads a target and the credential which reports results are never held by the same component.

Tool plan

The set of scanners launched for a scan target, derived from what the target contains. For a repository: the native engine and baseline tools, plus language-specific tools for the languages detected.

Application security posture management (ASPM)

Correlating findings from SAST, SCA, secrets, IaC and container scanning into one prioritised view tied to the code and workloads they affect. In SecurityVault, the finding ontology is that view.

Cloud infrastructure entitlement management (CIEM)

Mapping which identities can assume which roles and reach which data, and flagging excess privilege. SecurityVault stores these as assumes, can_access and authenticates_as edges.

Cloud security posture management (CSPM)

Continuously checking cloud accounts (AWS, Azure, GCP) for misconfiguration and exposure. In SecurityVault a posture finding sits on the same graph as code and image findings.

Container image scanning

Inspecting an image's layers for vulnerable packages and misconfigurations. Results are bound to the image digest and the workloads that run it.

Continuous compliance

Deriving control status from scan evidence as scans complete, instead of periodic manual attestation. SecurityVault maps your controls to frameworks; it holds no third-party certification of its own today.

Infrastructure-as-code (IaC) scanning

Checking Terraform, Kubernetes manifests, Helm charts and similar files for misconfigurations before they are applied.

Kubernetes security posture management (KSPM)

Assessing the inventory, topology and admission posture of Kubernetes clusters. Runtime signals from an eBPF sensor are in development. Discuss rollout with our team.

Policy as code

Security policy written as code and evaluated automatically. SecurityVault gates run Open Policy Agent over the finding graph and fail closed when they cannot answer.

Secrets detection

Finding credentials committed to source or baked into images so they can be rotated before they are used.

Software bill of materials (SBOM)

The inventory of components in a build or image. SecurityVault retains generated SBOMs and keeps it as evidence, so a newly published CVE can be matched against what already shipped.

Software composition analysis (SCA)

Identifying open-source dependencies, their known vulnerabilities and their licences. It runs on supported repository and image scans, and results are linked to the SBOM.

Static application security testing (SAST)

Analysing source code for vulnerabilities without running it. SecurityVault's native engine performs per-language taint analysis alongside open-source SAST tools.

Related security concepts.

API

An interface through which software systems exchange requests and data.

API route

An operation exposed by an API, typically identified by a method and path.

Endpoint

A network address or application entry point that can receive a request.

Exposure

The conditions under which a person or system could reach an affected asset; exposure alone does not prove exploitation.

Misconfiguration

A setting that conflicts with an applicable security requirement or expected state.

Group membership

An association between an identity and a group that may contribute to its effective permissions.

Role assumption

Taking on a role under the provider’s trust and permission rules.

Resource access

An effective permission to perform an action on a resource, subject to applicable conditions and denies.

Workload identity

The identity a running service uses when authenticating to another system.

SBOM component

An identified software component recorded in a bill of materials, with available version and relationship information.

Credential

A token, key, password or other proof used to authenticate access.

Exposed secret

A potentially sensitive credential discovered in source, history, configuration or another scanned input.

Threat

A potential event or action that could harm an asset or business objective.

Control

A safeguard or process used to address a security or compliance objective.

Weakness

A defect or condition that may contribute to a vulnerability.

Corroborating evidence

An additional observation that supports a finding; it is not necessarily an independent proof.