Glossary / The outside-in security glossary
A shared language for understanding exposure.
Clear terminology helps teams agree on what an assessment established and what should happen next. These definitions describe how OPSEQ discusses outside-in exposure work. Use them to clarify the difference between finding an asset, understanding a risk, and verifying that a change worked.
Name the important distinctions
The outside view
Attack surface, footprint, and attribution
Work boundaries
Scope, rules, and attack-path validation
Finding strength
Observation, finding, and hypothesis
Verified change
Remediation, retest, and reassessment
These four groups organize the language of exposure, assessment, evidence, and follow-up.
01 / Glossary
The outside view
The starting point is the information and services an external observer can encounter. These terms help teams describe that view without assuming every visible asset is vulnerable or owned by the organization. Discovery creates candidates for review. Ownership and business context determine which candidates belong in the assessment and which need clarification before any deeper investigation.
FIELD NOTES
- External attack surface: the internet-facing systems and access points relevant to the organization.
- Public footprint: the visible assets, information, identities, and relationships associated with an organization.
- Asset attribution: the process of evaluating whether a discovered asset belongs to, represents, or connects to the organization.
02 / Glossary
The boundaries of the work
An assessment needs explicit boundaries so everyone understands what the work covers. A broad public footprint does not automatically grant permission to test every connected service. These terms describe the agreement that connects a business question to the permitted investigation. They also help explain why an assessment may document a potential concern while leaving deeper validation to separately authorized work.
FIELD NOTES
- Scope: the agreed question, assets, activities, deliverables, and exclusions for an engagement.
- Rules of engagement: the operating conditions, permissions, communications, and stop criteria governing the work.
- Attack-path validation: authorized investigation of the connections that could lead from an exposure to a defined unwanted outcome.
03 / Glossary
The strength of a finding
A useful report makes its evidence and uncertainty visible. Something directly observed supports a different conclusion from a relationship suggested by public information. These distinctions let reviewers decide whether to act, investigate further, or resolve an ownership question. Confidence should be explained in terms of supporting evidence and limitations rather than conveyed through an unsupported certainty score.
FIELD NOTES
- Observation: a recorded fact supported by a source or an authorized check.
- Finding: an assessed condition with supporting evidence, business context, limitations, and a recommended action.
- Hypothesis: a plausible explanation or connection that still requires evidence or validation.
04 / Glossary
The path to a verified change
Implementation and verification answer different questions. A team can complete a planned change while the original exposure remains, or remove an asset without resolving a broader ownership issue. These terms keep the follow-up precise. Record the condition being addressed, the evidence needed for closure, and whether the work revisits one finding or a wider footprint after meaningful change.
FIELD NOTES
- Remediation: a change intended to address a documented exposure or its underlying cause.
- Retest: a scoped follow-up that checks whether an agreed change addressed a specific finding.
- Reassessment: a new review of an agreed footprint, often after changes to assets, ownership, or business priorities.