CVE, CVSS, KEV, EPSS and 27 more: a sourced security glossary

Twenty-two terms that come up constantly in vulnerability management, threat intelligence and security governance, each defined from the body that owns the term — mostly NIST's Computer Security Resource Center glossary, which aggregates definitions straight from NIST Special Publications, plus CISA, FIRST.org and Microsoft's own documentation for the three terms NIST doesn't define. NIST's glossary itself says it aggregates rather than sets one official definition, and that a term can read differently across different publications; where that happens below, the citation names the specific publication the definition comes from.

What is a CVE?

A CVE, Common Vulnerabilities and Exposures, identifier is a unique name assigned to one publicly known software or hardware vulnerability, drawn from a shared dictionary so that different vendors, scanners and researchers are all referring to the same flaw when they use the same ID. NIST SP 1800-21B describes a CVE dictionary as a set of common names for publicly known information system vulnerabilities, which is why a CVE ID, rather than a vendor's own bug number, is the identifier the rest of this glossary and this site's must-patch page build on.

What is CVSS?

CVSS, the Common Vulnerability Scoring System, is the standard method for scoring how severe a software vulnerability could be if exploited, independent of whether it actually has been. A CVSS score reflects technical severity only — factors like how easy the flaw is to reach and how much damage it could do — not real-world exploitation, which is the gap KEV and EPSS below are built to fill.

What is CWE?

CWE, Common Weakness Enumeration, is a taxonomy of the recurring kinds of coding and design mistakes that produce vulnerabilities in the first place, things like buffer overflows or failing to validate input data. Where a CVE names one specific flaw in one specific product, a CWE classifies the underlying pattern, so a security team can see which categories of mistake keep producing CVEs across a codebase.

What is KEV?

KEV is CISA's Known Exploited Vulnerabilities catalog, a public list of CVEs that CISA has confirmed attackers are actually using, not merely vulnerabilities that could theoretically be exploited. CISA calls it its authoritative source of vulnerabilities exploited in the wild, and recommends every organization, not only federal agencies, use it to prioritize remediation. This site tracks the live catalog on /must-patch.

KEV vs CVE: what's the difference?

A CVE is an identifier assigned to any publicly known vulnerability, whatever its severity and whether or not anyone has ever exploited it; KEV is a much smaller, separate list of CVEs that CISA has specifically confirmed attackers are using right now. Every KEV entry has a CVE ID, but the reverse isn't true: NVD's own CVE API counted 409,954 published CVE records when queried on October 19, 2026, while CISA's KEV catalog, version 2026.10.16 and released October 16, 2026, held 1,748 entries — under half a percent of all CVEs ever assigned have made CISA's confirmed-exploitation list.

CISA names three criteria for adding a CVE to KEV, and a high severity score is not one of them: the vulnerability must have an assigned CVE ID, there must be reliable evidence it has been actively exploited in the wild, and there must be a clear remediation action, such as a vendor-provided update. CISA states plainly that "a vulnerability's exploitability is not considered as criteria for inclusion in the KEV catalog," treating exploitability analysis as an input to CVSS severity scoring instead, a separate measure from the KEV decision itself. In practice, a critical-severity CVE with no confirmed real-world exploitation stays off KEV, while a lower-severity CVE CISA confirms attackers are actively using gets added regardless of its CVSS score.

For prioritization, CVE, CVSS and KEV each do a different job: a CVE names the flaw, CVSS and EPSS below estimate how bad it could be and how likely it is to get used, and KEV confirms it already has been. This site's /must-patch tracks the live KEV catalog against each entry's CVSS and EPSS scores, and /exploit-lag measures how long each KEV entry sat as an ordinary CVE before CISA confirmed exploitation.

What is EPSS?

EPSS, the Exploit Prediction Scoring System, estimates the probability that a given CVE will be exploited in the wild in the next 30 days, expressed as a score from 0 to 1 and published daily for essentially every CVE. FIRST.org, the body that runs it, built the model from observed exploitation data rather than a human analyst's judgment call, which is why it pairs well with CVSS: CVSS says how bad a flaw could be, EPSS says how likely it is to actually get used. /must-patch lists an EPSS score alongside each KEV entry.

What is vulnerability management?

Vulnerability management is the ongoing capability of finding the vulnerabilities on an organization's own devices that attackers are likely to use, so that the ones most likely to lead to compromise get fixed first rather than everything being queued in the order it was discovered. NIST frames it explicitly around CVE-identified vulnerabilities on devices an attacker could use as a foothold to extend compromise further into the network.

What is a vulnerability assessment?

A vulnerability assessment, which NIST's glossary also calls vulnerability analysis, is a systematic examination of a system to determine whether its security measures are adequate, surface any deficiencies, and predict how effective a proposed fix would be. It is the diagnostic step that precedes vulnerability management's prioritization and penetration testing's hands-on verification.

What is attack surface?

An organization's attack surface is the full set of points, across its systems and environment, where an attacker could try to get in, cause an effect, or pull data out. NIST's definition deliberately covers more than just internet-facing servers: any boundary point on a system or system element counts, which is why reducing attack surface usually means retiring unused services and access paths, not just patching the ones already known to be exposed.

What is enterprise patch management?

Enterprise patch management is the organization-wide process of identifying which patches, updates and upgrades are needed, prioritizing them, acquiring them, installing them, and then verifying the installation actually worked, across every system rather than one machine at a time. NIST's definition is deliberately end-to-end: a patch that was never verified as installed is treated as an open gap, not a closed one.

What is Patch Tuesday?

Patch Tuesday is the trade name for Microsoft's monthly release of security fixes for Windows and other Microsoft products, which lands on the second Tuesday of each month; Microsoft sometimes issues an out-of-band update outside that schedule when a flaw is serious enough and already being exploited. It isn't a NIST or CISA term, since it describes one vendor's release cadence rather than a general security concept, but it structures how most enterprises plan monthly patch cycles. This site's /patch-tuesday hub tracks each month's release against CISA's KEV catalog.

What is a cyber threat?

A cyber threat is any circumstance or event that could adversely affect an organization's operations, assets or people through an information system, whether through unauthorized access, destruction, disclosure, modification of information, or denial of service. That is a deliberately broad definition: a threat does not require an identified attacker or an active campaign, just the potential for one of those outcomes.

What is cyber threat intelligence?

Cyber threat intelligence, CTI, is threat information that has already been gathered, processed, analyzed and interpreted so that it gives the context a decision needs, rather than raw, unprocessed data about potential threats. The distinction matters operationally: a feed of raw indicators is not yet intelligence until someone has done the work of explaining what it means for a specific organization's own risk.

What is an advanced persistent threat?

An advanced persistent threat, APT, is an adversary with enough skill and resources to pursue a goal using multiple attack vectors — cyber, physical and deception together — and to keep pursuing it over an extended period, adapting as defenders push back. NIST's definition emphasizes persistence specifically: an APT typically aims to establish and extend a foothold inside a target's infrastructure for ongoing access, not just a single smash-and-grab.

What is a botnet?

A botnet, short for robot network, is a collection of compromised computers an attacker controls remotely, typically assembled by using a Trojan to breach each machine and fold it into the network of "bots." NIST's own glossary entry traces the term back to exactly those two words, robot and network, which describes both how a botnet is built and what it is used for: coordinated action, such as spam or distributed denial-of-service traffic, run from many machines the owners don't know are involved.

What is malware?

Malware is an application covertly inserted into another piece of software, such as an operating system or a legitimate application, with the intent to steal or destroy data, run destructive or intrusive code, or otherwise compromise the confidentiality, integrity or availability of the victim's system. NIST treats it as a broad umbrella term: ransomware, a botnet's client software, and a backdoor are all malware, distinguished from each other by what they do once installed rather than by how the definition itself is written.

What is an indicator of compromise?

An indicator of compromise, IOC, is a technical artifact or observable — a file hash, an IP address, a registry change — that suggests an attack is imminent, already underway, or has already happened. IOCs are what cyber threat intelligence is built from: a raw IOC becomes useful intelligence once it has been analyzed for what it means to a specific environment.

What is incident response?

Incident response is the remediation or mitigation of violations of an organization's security policies and recommended practices, once something has already gone wrong rather than before. NIST's current definition is narrower than many practitioners expect: it covers the remediation itself, with the earlier detection and triage work usually described under the related term incident handling.

What is penetration testing?

Penetration testing is hands-on testing in which assessors try to actually exploit a system's vulnerabilities, rather than just enumerate them, to reveal what an attacker could really achieve given the system's actual configuration. It follows a vulnerability assessment and uses the information that assessment gathered, rather than replacing it: an assessment finds candidate weaknesses, a penetration test proves which of them are actually exploitable.

What is multi-factor authentication?

Multi-factor authentication, MFA, requires two or more different kinds of proof before granting access: something the user knows, like a password or PIN, something the user has, like a hardware token, or something the user is, like a fingerprint. NIST's definition requires the factors to come from different categories; two passwords, for instance, would not qualify as multi-factor even though it is technically two pieces of evidence.

What is zero trust?

Zero trust is an architectural approach built on the assumption that the network is already compromised, so every access request is checked on its own merits, with the least privilege needed, rather than being trusted automatically because it originated inside a traditional network perimeter. NIST describes it as a collection of concepts rather than a single product category, which is why "zero trust" in vendor marketing can mean very different specific implementations.

What is cybersecurity supply chain risk management?

Cybersecurity supply chain risk management, C-SCRM, is the systematic process of managing an organization's exposure to cybersecurity risk that comes in through its supply chain — hardware, software and services sourced from outside vendors — and developing the response strategies and procedures that exposure requires. It extends vulnerability management beyond an organization's own code to everything it depends on but does not directly control.

What is a risk assessment methodology?

A risk assessment methodology is a defined risk assessment process paired with a risk model, an assessment approach and an analysis approach, so that an organization's risk assessments are repeatable rather than ad hoc each time. NIST SP 800-30 Rev. 1, which supplies this definition, is also the publication most of the network's own federal-sector reporting (such as cybersecurity-expertise disclosures) ultimately traces back to when a company describes its own risk process.

What is ransomware?

Ransomware is an attack in which the intruder encrypts an organization's own data and then demands payment before restoring access, sometimes alongside a second demand not to leak a copy of the stolen data to the public, a competitor or a regulator. NIST's current framework profile treats the data-theft-and-leak threat as a routine second stage of a ransomware attack, not a separate crime, which is why a ransomware incident disclosure increasingly reads like a breach disclosure too. CISA's own catalog flags which must-patch entries have known ransomware use.

What is phishing?

Phishing is an attempt to get someone to hand over credentials or financial information by posing as a legitimate company or contact, typically over email, text message or phone, rather than by breaking into a system directly. The FBI's Internet Crime Complaint Center (IC3) tracks it alongside spoofing, the related tactic of forging a sender's identity, because the two are usually combined in the same scam and reported as one crime type. IC3 logged more complaints about phishing and spoofing in 2025 than any other crime type it tracks.

What is business email compromise?

Business email compromise, BEC, is a scam that targets a company's own payment process, usually by compromising or spoofing an executive's or supplier's email account and then instructing an employee to wire funds to an account the attacker controls. The FBI's IC3 classes it as its own crime type distinct from ordinary phishing because the attacker's goal is a specific fraudulent wire transfer rather than harvesting credentials to use later.

What is a data breach?

A data breach, in the FBI's own framing, is a computer intrusion used to acquire confidential or secure information, a definition that specifically excludes an intrusion against a personally owned device or a private social-media or financial account rather than an organization's own systems. That is a narrower definition than the term's everyday use, and it is why a breach disclosure is usually about organizational, not personal, systems. Sibling site cisonews.net tracks disclosed breaches against the regulatory filings they trigger.

What is an insider threat?

An insider threat is the risk that someone who already has authorized access to an organization's systems or data will use that access to cause harm, whether deliberately or by accident. NIST's definition deliberately covers both intent and accident: a careless employee who mishandles sensitive data and a malicious one who steals it both count as the same category of threat, even though the response to each looks very different.

What is SIEM?

SIEM, security information and event management, is a system that pulls log data from across an organization's systems into one centralized place so it can be searched and correlated, rather than reviewed one log source at a time. NIST's definition keeps it broad and log-focused; most of what today's SIEM products add on top — alerting rules, dashboards, automated response — are built on that same underlying centralized-logging capability.

What is a denial-of-service attack?

A denial-of-service, or DoS, attack is any action that prevents authorized users from reaching a system resource or that delays the system's normal operation, whether by overwhelming it with traffic or by some other means of disruption. A distributed denial-of-service, or DDoS, attack is the same thing carried out from many machines at once, usually a botnet, which is harder to block than traffic from a single source.

What is encryption?

Encryption is the process of transforming readable data, plaintext, into an unreadable form, ciphertext, so that it cannot be understood without the key needed to reverse the process. NIST's glossary keeps the core definition deliberately simple because the same process underlies very different uses, from protecting data stored on a laptop to protecting data moving across a network.

What is a tabletop exercise?

A tabletop exercise is a discussion-based rehearsal of an incident response plan: the people who hold roles in the plan sit down, work through a scenario a facilitator presents, and talk through what each of them would actually do, without touching a live system. It is a cheaper, lower-risk way to find gaps in a plan than a full technical drill, which is why NIST recommends it as a regular, repeatable exercise rather than a one-time event.

This list will grow as the site covers more terms its own reporting depends on; where NIST's glossary gives more than one definition for a term from different publications, this page uses the one from the most current publication NIST's own glossary export lists. A few commonly searched terms — social engineering, threat actor, zero-day, security operations center, endpoint detection and response — are left out of this glossary for now: NIST's own glossary does not define them as standalone terms, and CISA's own prose pages (which might) returned HTTP 403 to this site's required research@example.com User-Agent when checked for this update.