Glossary · 17 terms
The words in a pentest proposal, in plain English.
In brief
Proposals and reports use a handful of terms that decide what you’re buying: how much the tester knows going in (black, grey or white box), what is in scope, whether a retest is included, and how findings are scored. Each is defined once here and linked to the guide where it matters.
§1Terms
- Black box testing
- The tester starts with no inside information, like an outside attacker. Realistic, but slower to cover an application.
- Grey box testing
- The tester gets some access, typically user accounts for each role and API documentation. The usual choice for web applications.
- White box testing
- The tester gets full access: source code, architecture, admin credentials. Finds the most per testing day.
- Scope
- Exactly what may be tested: applications, API endpoints, IP ranges, cloud accounts, user roles, and what is out of bounds. Read more
- Rules of engagement
- The written terms of a test: dates and hours, allowed techniques, contacts, stop conditions and how sensitive data is handled. Read more
- Retest (remediation testing)
- Testing a finding again after it was fixed, to confirm the fix works. Whether it is included in the price varies by firm. Read more
- Attestation letter
- A short letter from the testing firm summarising scope, dates and results, which you can share with customers or auditors instead of the full report. Read more
- CVSS
- The Common Vulnerability Scoring System, maintained by FIRST: a 0–10 severity score many reports use for each finding. Read more
- Red team
- An objective-based, often covert attack campaign that tests whether your people and tools detect and stop it. Read more
- Blue team
- The defenders: the people and tools that detect and respond to attacks.
- Purple team
- Red and blue teams working together in the open, so every attack becomes a detection improvement.
- PTaaS
- Penetration testing as a service: ordering tests and seeing findings on a platform, usually on a subscription. Read more
- Lateral movement
- Moving from a first compromised machine to others on the network. The heart of an internal network test. Read more
- Privilege escalation
- Turning limited access into more: a normal user into an admin, or a web user into the server. Read more
- Prompt injection
- Instructions hidden in input that make an AI model ignore its rules. The first risk in OWASP’s Top 10 for LLM applications. Read more
- CREST
- An international accreditation body for penetration testing companies and testers. Membership is listed in its public directory. Read more
- PCI QSA and ASV
- A Qualified Security Assessor can assess PCI DSS compliance; an Approved Scanning Vendor runs the required external scans. Both are listed by the PCI Security Standards Council. Read more