Glossary

Last updated: Oct 21, 2026

---

A

AI SAST

AI SAST is static application security testing that uses AI. Fluid Attacks uses AI SAST in the Advanced plan of its solution. AI SAST quickly examines the source code of an application and analyzes many files together. It understands the context of the code. Thus, it detects high-risk security vulnerabilities that simple scanners frequently do not find.

Application security posture management (ASPM)

ASPM is a cybersecurity approach that gives one real-time view of the application security posture of an organization across all of the software development lifecycle. ASPM is a unifying layer above separate security tools. It collects and correlates findings from sources such as SAST, DAST, SCA, CI/CD pipelines, and cloud infrastructure. Thus, scattered alerts become useful information for security teams. ASPM does more than list vulnerabilities.

ASPM also gives context to findings with risk-based prioritization. It examines factors such as exploitability, reachability, and proximity to sensitive data. Thus, teams can first fix the vulnerabilities that are the largest threat to the business. ASPM also automates remediation workflows, enforces security policies, and generates SBOMs. These functions help organizations expand their security programs at the speed of modern development.

C

CI/CD pipeline

A CI/CD pipeline is a series of organized steps or tasks. These steps let you release a new software version quickly and successfully, mainly with automation. These steps include the compilation of source code, the distribution of packages, the execution of quality and security tests, and the deployment to different environments.

CI Gate

The CI Gate is a Docker-based tool from Fluid Attacks. It connects to the platform from a CI/CD pipeline and checks if the repository has open vulnerabilities. You can configure it to break the build when findings break a policy. It supports all the primary CI/CD platforms, for example GitHub Actions, GitLab CI, Azure DevOps, and Jenkins. For the installation steps, see CI Gate installation.

Cloud security posture management (CSPM)

CSPM is a set of practices to monitor and manage security configurations and compliance with standards in cloud resources. It examines IaC scripts, container images, and cloud environments and services to find misconfigurations, policy violations, and other security issues. Fluid Attacks uses this technique in its solution.

Container scanning (CS)

CS is an automated technique that scans container images for known vulnerabilities. It examines image layers, installed OS packages, and embedded dependencies to detect security issues. It runs before you push an image to a registry or deploy it. Fluid Attacks uses this technique in its solution.

Continuous deployment (CD)

CD is a process that comes after CI. When developers merge their code changes, these changes make a software product that you can deploy in a test or production environment. Automated procedures build the product and verify that it meets the acceptance requirements. Then, they deploy the product at the expected time, frequently directly to the end users.

Continuous integration (CI)

CI is a practice in which a development team frequently uploads changes, either additions or removals, to a central repository. Each time, automated procedures make sure that the code changes meet the predefined requirements. They also make sure that the changes integrate correctly into the software.

CVSS

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard to assess the severity of security vulnerabilities in computer systems. CVSS gives severity scores to vulnerabilities. Thus, responders can prioritize responses and resources in relation to the risks. A formula calculates the scores. This formula uses different metrics that estimate how easy an exploitation is and how large its impact is. Scores go from 0 to 10, and 10 is the most severe.

By default, the Fluid Attacks platform uses CVSS v4.0 for the severity scores and thresholds in its UI and documentation. When a page uses a different version, the page says so.

CVSSF

The CVSSF is a risk-exposure metric that Fluid Attacks developed. It applies an exponential transformation to the standard CVSS base score. CVSS uses a linear 0.0–10.0 scale and puts scores into qualitative bands (low, medium, high, critical). In CVSSF, high- and critical-severity vulnerabilities add much more to the total. This shows the larger impact that these vulnerabilities have on the overall risk. Thus, many low-severity findings cannot hide the impact of a small number of critical findings.

The result is one value that represents the overall risk exposure of a system. With this value, security teams can prioritize remediation by the real threat impact, not by the number of vulnerabilities.

D

DevSecOps

DevSecOps is a software development approach that integrates security practices in all of the CI/CD pipeline, from the initial design to deployment and monitoring. In DevSecOps, security is not a final step. DevSecOps puts automated security testing, code analysis, and compliance checks into the development workflow. Thus, teams can find and fix vulnerabilities early, decrease remediation costs, and deliver more secure software. Fluid Attacks supports DevSecOps practices with tools such as the CI Gate and the standalone scanners.

Dynamic application security testing (DAST)

DAST is a security testing technique that detects security vulnerabilities in an application. It examines the running software without access to its source code. It uses different attack vectors to find unexpected behavior and weaknesses in the deployment configuration, data, and business logic. Fluid Attacks uses this technique in its solution.

F

False negative

A false negative is an incorrect report that says that a vulnerability is not present when it is present. To learn how to report a false negative, see the False negatives page.

False positive

A false positive is an incorrect alert that says that a vulnerability is present when it is not present. To learn how to report a false positive, see the False positives page.

G

Group

A group in the Fluid Attacks platform is the organizational unit that you use to manage the security testing of a product. It contains the targets of evaluation, that is, the Git repositories and environments in the scope of the security testing. It also contains the reported vulnerabilities, analytics, and policies of that product. Groups belong to an organization, and you manage them on the Fluid Attacks platform.

H

Health Check

Health Check is part of the Fluid Attacks solution. It does PTaaS, secure code review, and reverse engineering on the software that the client developed before it bought the Advanced plan.

I

Infrastructure as code (IaC)

IaC is a practice that uses machine-readable configuration files to make and manage computing infrastructure, not manual processes or interactive tools. These files describe servers, networks, storage, and other resources in a format that has version control and that you can reproduce. IaC scripts can cause misconfigurations and policy violations. Cloud security posture management (CSPM) examines these security issues.

M

Mailmap

Mailmap is a table that organizes and unifies the different email addresses and names that authors or contributors use.

Mobile application security testing (MAST)

MAST is a methodology that combines different techniques and tools to find vulnerabilities, misconfigurations, and privacy issues in mobile applications during all of their lifecycle. It integrates automated scanning with manual expert analysis to address the special challenges of mobile environments. These challenges include different operating systems, many types of devices, and security mechanisms that are specific to each platform. MAST examines static code and runtime behavior. It includes data handling, authentication, permissions, and backend API security. Fluid Attacks uses this technique in its solution.

O

Organization

An organization in the Fluid Attacks platform is the top-level entity that contains all the security testing activity of a company. It contains one or more groups. Each group is a product or system that Fluid Attacks evaluates. The organization settings include member management, billing, policies, and aggregated analytics for all the groups. To learn how to navigate the platform, see the Fluid Attacks platform section.

P

Penetration testing as a service (PTaaS)

PTaaS is a cybersecurity assessment method. In PTaaS, skilled human testers, called ethical pentesters, actively and continuously simulate real-world cyberattacks on infrastructure, applications, and other IT systems. The primary objective of PTaaS is to find and exploit vulnerabilities that automated tools cannot find. PTaaS can combine many vulnerabilities to show the full impact on the security of the application. Fluid Attacks uses this technique in its solution.

R

Reachability

Reachability is a characteristic of SCA vulnerabilities. It shows if the code of your application calls the vulnerable function in a third-party dependency. Reachability has three possible values:

• Reachable: The code of your application calls the vulnerable function directly.
• Potentially Reachable: Your code imports the package, but it does not necessarily call the vulnerable function.
• Latent: Your code declares the package, but it does not import it.

A reachable vulnerability has a higher risk of exploitation in your application. The Fluid Attacks platform also uses reachability as a prioritization attribute. This attribute applies only to SCA vulnerabilities.

Reattack

A reattack is the process that verifies if the fix for a reported vulnerability is effective. In the Fluid Attacks platform, users can request a reattack on individual vulnerable locations. Then, the security team tries to exploit the vulnerability again. After that, it changes the status of the vulnerability to fixed or still vulnerable. To learn how to request and track reattacks, see Verify fixes with reattacks.

Reverse engineering (RE)

RE is a process that deconstructs software to analyze and understand its design, structure, and functionality. In RE, experts called reverse engineers use tools to analyze the source code and its components. They find how the technology works and if it has security issues. Fluid Attacks uses this technique in its solution.

S

SARIF

The Static Analysis Results Interchange Format (SARIF) is an open standard (OASIS) that represents the output of static analysis tools. SARIF files use a JSON-based schema to record findings such as vulnerability locations, severity levels, rule descriptions, and remediation hints. The format has a structure and is machine-readable. It integrates with many development platforms, for example GitHub and GitLab. The Fluid Attacks standalone scanners support SARIF output. For an example of SARIF with the Fluid Attacks scanners, see GitHub Actions integration.

Secret scanning (SS)

SS is an automated practice that searches code, configuration files, infrastructure, and pipelines to find exposed credentials. These credentials include API keys, passwords, cloud access keys, and tokens that can give unauthorized access to systems. A good secret scanning program detects exposed secrets and examines if they are valid. It also shows their location and helps teams revoke, rotate, and remediate them.

Secure code review (SCR)

SCR is the systematic inspection of source code by human reviewers to find security flaws and make sure that the code follows security standards. This expert analysis frequently finds severe and complex vulnerabilities that automated tools alone cannot find. Fluid Attacks uses this technique in its solution.

Software bill of materials (SBOM)

An SBOM is a complete inventory of all the components and dependencies of a software application, with their metadata. Thus, SBOMs give information about the composition of a software product and about possible vulnerabilities that come from third-party code.

Software composition analysis (SCA)

SCA is a technique that identifies and analyzes third-party components and dependencies in software. For security, SCA examines libraries, frameworks, and packages to find their versions and detect vulnerabilities. Fluid Attacks uses this technique in its solution.

Static application security testing (SAST)

SAST is a security testing technique that identifies security vulnerabilities in the source code of an application. SAST does not run the code. It examines the code to find programming patterns, misconfigurations, and insecure practices that attackers can exploit. Fluid Attacks uses this technique in its solution.

T

Target of Evaluation (ToE)

The ToE is the product or system that Fluid Attacks tests for security. You mainly define it when you add Git repositories and environments in the Scope section of a group on the Fluid Attacks platform.

Treatment

A treatment is the decision that a team makes about how to manage a reported vulnerability when the team cannot fix it immediately. The Fluid Attacks platform has different treatment options. For example, you can accept the risk for a defined period or permanently, with a justification for each option. With treatments, teams can track and manage vulnerabilities that they know about but did not fix yet. You can see treatments in the vulnerabilities section of the platform.

V

VLAI

VLAI is an open-source RoBERTa-based model that CIRCL developed. It predicts the severity level of a software vulnerability from the text of its description, without a manual CVSS assessment. It classifies vulnerabilities into four levels: Low, Medium, High, and Critical. A confidence percentage shows how certain the model is about the classification. Fluid Attacks integrates VLAI as one more severity signal. You can see this signal next to the CVSS scores in the vulnerabilities section of the platform.

The Fluid Attacks platform also uses VLAI as a prioritization attribute. This attribute applies to all types of vulnerabilities.

Vulnerability

A vulnerability is a weakness or flaw in a software system, configuration, or process. A threat actor can exploit it to compromise the confidentiality, integrity, or availability of assets. In the Fluid Attacks platform, a vulnerability is a specific finding that the security testing team or the automated tools report. Each vulnerability has a location in the code or environment. The platform tracks the vulnerability through its lifecycle, from detection to remediation or accepted risk. You organize and manage vulnerabilities in the vulnerabilities section of the platform.

W

Weakness

A weakness is a category of software defect or design flaw that can cause vulnerabilities. A weakness is more general than a vulnerability: one weakness type can be the cause of many specific vulnerabilities in different systems. Fluid Attacks maps its findings to the weaknesses in its Criteria weakness database.

White-box testing

White-box testing is a service in which the pentester has access to all the information, for example Git repositories, credentials, source code, and environments.