Cybersecurity glossary: 19 definitions, from EASM to the CLOUD Act

EASM (External Attack Surface Management)

EASM is the continuous discovery and monitoring of an organisation’s internet-facing assets: domains, subdomains, IP addresses, services, certificates and applications. It starts from an external attacker’s point of view, with no prior inventory, to find forgotten or unknown assets and the exposures they create.

Reference page: understanding EASM

CAASM (Cyber Asset Attack Surface Management)

CAASM consolidates an organisation’s asset inventory from its existing internal tools, such as the directory, IT asset management, endpoint security, cloud platforms and scanners, through connectors. It aims for a single, deduplicated view of assets, to find those that escape security controls.

Reference page: understanding CAASM

VMDR (Vulnerability Management, Detection and Response)

VMDR brings together vulnerability detection, prioritisation and remediation tracking in a continuous cycle. Prioritisation relies on indicators such as the CVSS score, the EPSS probability of exploitation or listing in the CISA KEV catalogue, together with the context of the affected asset.

Reference page: vulnerability management

CTEM (Continuous Threat Exposure Management)

CTEM is an exposure management framework described by Gartner, organised in five cyclical stages: scoping, discovery, prioritisation, validation and mobilisation. It is not a single tool but a continuous programme that links vulnerabilities to business context and checks what can actually be exploited.

Reference page: understanding CTEM

BAS (Breach and Attack Simulation)

BAS refers to tools that automatically simulate known attack techniques, often referenced in the MITRE ATT&CK knowledge base, to check whether the security controls in place detect or block them. Simulations are repeatable and controlled: they measure how effective defences are rather than searching for new flaws.

Reference page: breach and attack simulation

Red Team, a simulated attack by an offensive team

A Red Team exercise simulates a real attacker, over a set period and with defined objectives, to test an organisation’s ability to detect and respond. It can combine technical, human and physical vectors. It is carried out under written authorisation, according to rules of engagement agreed in advance.

Reference page: the Red Team exercise

CART (Continuous Automated Red Teaming)

CART automates part of the Red Team approach so that it runs continuously: discovering exposure, chaining attack techniques and validating whether they are feasible, without waiting for a one-off exercise. It does not replace the human expertise of a full Red Team exercise, but extends its logic between two engagements.

Reference page: continuous exposure validation

TPRM (Third-Party Risk Management)

TPRM covers the practices used to identify, assess and monitor the risks that an organisation’s third parties bring: suppliers, service providers, subcontractors and partners. It spans document compliance as well as cyber, financial and regulatory risk. NIS2 and DORA strengthen this requirement for the supply chain.

Reference page: understanding TPRM

Penetration test (pentest)

A penetration test, or pentest, is an authorised, time-boxed assessment in which testers attempt to exploit the vulnerabilities of a defined scope: an application, a network or an infrastructure. It produces a report describing the flaws exploited, their impact and the recommended remediation measures.

Reference page: our penetration testing service

OSINT (Open Source Intelligence)

OSINT is the collection and analysis of publicly available information: websites, social networks, registers, public databases and technical publications. In cybersecurity, it measures what an attacker can learn about an organisation or its executives before acting. It must be practised within the legal framework and with respect for data protection.

Reference page: continuous OSINT monitoring ; OSINT assessments

Dark web and data leaks

The dark web is the part of the internet reachable only through anonymity networks such as Tor. Data from leaks, such as credentials, customer databases or internal documents, is often traded or resold there. A data leak is an unauthorised disclosure of information: detecting it early makes it possible to neutralise exposed access.

Reference page: dark web monitoring

Typosquatting, domain name impersonation

Typosquatting means registering domain names close to an organisation’s own: a typo, swapped letters, visually similar characters or a different extension. These domains are used for phishing, impersonation or fraud. Detecting them early makes it possible to start takedown action, including domain name dispute resolution procedures.

Reference page: typosquatting detection

Attack path

An attack path is the sequence of steps an attacker can chain to move from an entry point to a sensitive asset: exploiting a flaw, reusing a credential, escalating privileges, moving laterally. Reasoning in paths rather than isolated flaws helps fix first what actually opens access to critical assets.

Reference page: attack paths and CTEM

Attack surface (exposure surface)

The attack surface covers everything an attacker can reach or exploit in an organisation: internet-facing assets, vulnerabilities, misconfigurations, leaked credentials, connected third parties and public information. It changes constantly, with every technical and organisational change, which is why it calls for continuous monitoring.

Reference page: managing the attack surface

NIS2, Directive (EU) 2022/2555 on the security of network and information systems

NIS2 is European Directive (EU) 2022/2555 on the cybersecurity of network and information systems. It covers 18 sectors, distinguishes essential and important entities, and requires risk governance, security measures, incident reporting and supply chain security. Each Member State must transpose it into national law.

Reference page: NIS2 compliance

DORA (Digital Operational Resilience Act), Regulation (EU) 2022/2554

DORA is European Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, applicable since 17 January 2025. It governs information and communication technology risk management, incident reporting, resilience testing and the risk arising from ICT third-party service providers.

Reference page: DORA compliance

SecNumCloud, the ANSSI qualification framework for cloud services

SecNumCloud is a framework from ANSSI, the French national cybersecurity agency, that sets security requirements for cloud service providers. An offering qualified SecNumCloud has been assessed against this framework, which includes requirements for protection from extraterritorial laws. Qualification covers one specific offering of a provider, not all its services.

CLOUD Act (Clarifying Lawful Overseas Use of Data Act), US federal law

The CLOUD Act is a US federal law passed in 2018. It allows US authorities to require, as part of legal proceedings, that service providers subject to US law disclose data they control, including when that data is stored outside the United States.

Reference page: the CLOUD Act and sovereignty

Digital sovereignty

In cybersecurity, digital sovereignty is an organisation’s ability to keep control of its data and tools: knowing where data is hosted, which law applies, who can access it, and which suppliers or subcontractors it depends on. It is judged across the whole chain, not only on data location.

Reference page: verifiable sovereignty criteria