Glossary

External attack surface, in plain language.

The terms security leaders, auditors, and boards use when they talk about what's exposed — defined without the jargon. Jump to a term:

Attack surface

The full set of points where an attacker could try to get into — or pull data out of — your systems. The external attack surface is everything reachable from the public internet: domains, subdomains, APIs, cloud storage, exposed services, and leaked credentials.

Attack Surface Management (ASM)

The continuous practice of discovering, inventorying, and monitoring the assets that make up your attack surface — so you find exposures before an attacker does, not in a once-a-year review.

Certificate Transparency (CT)

Public logs of every TLS certificate issued. Security teams (and attackers) mine them to discover subdomains and hosts an organization owns — including ones it has forgotten.

Credential exposure & stuffing

When usernames and passwords leak through breaches and end up on the dark web. "Credential stuffing" is replaying those logins against your systems — reused employee credentials are a common path straight to admin portals.

CVE (Common Vulnerabilities and Exposures)

A public catalog of known security vulnerabilities, each with a unique identifier (e.g. CVE-2024-12345), so everyone can refer to the same flaw unambiguously.

CVSS (Common Vulnerability Scoring System)

A 0–10 score expressing how severe a vulnerability is, factoring in how easy it is to exploit and how much damage it can do.

Dark-web exposure / monitoring

Watching underground forums, breach dumps, and criminal markets for mentions of your organization, employees, credentials, or data — so you hear about a leak early, not after it's weaponized.

DORA (Digital Operational Resilience Act)

An EU regulation requiring financial entities to manage their ICT and third-party risk — including a clear handle on their digital attack surface.

External Attack Surface Management (EASM)

ASM focused specifically on internet-facing assets, discovered from the outside in — the way an attacker actually sees you, rather than from an internal asset list. TRaViS is an EASM platform.

Exposed AI infrastructure

Internet-reachable LLM endpoints, model APIs, and MCP servers — a fast-growing attack surface that almost nobody is watching, and one TRaViS surfaces by default.

MCP (Model Context Protocol)

An open protocol that lets AI assistants connect to external tools and data. Exposed or unauthenticated MCP servers can leak data or be abused — which is why they belong on your attack surface inventory.

Misconfiguration

A security weakness caused by incorrect settings rather than a software bug — like a public cloud storage bucket, an open database, or an overly permissive service.

NYDFS 500

The New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500), which requires covered financial firms to run a documented cybersecurity program.

Penetration test vs. ASM

A penetration test is a deep, point-in-time assessment of specific systems. ASM is broad, continuous discovery and monitoring of everything you expose. They complement each other — ASM tells you what to point a pen test at.

Posture score

A single, rolled-up measure of how exposed an organization is — TRaViS uses a 0–1000 score, benchmarked against your sector. It's the quick, board-ready answer to "are we exposed?"

Public bucket

A cloud object-storage container (such as an Amazon S3 bucket) misconfigured to allow public access — a frequent source of leaked customer data.

Reconnaissance

The attacker's first move: quietly mapping a target's assets and weaknesses before striking. EASM runs the same reconnaissance — on your behalf, continuously.

Shadow API

An undocumented, deprecated, or forgotten API endpoint that's still answering requests — outside the security team's visibility, and a favorite attacker entry point.

Shadow IT

Systems, apps, or cloud assets stood up or used without the security/IT team's knowledge or approval — you can't protect what you don't know you own.

SSRF (Server-Side Request Forgery)

A vulnerability that tricks a server into making requests on an attacker's behalf — often used to reach internal-only systems or steal cloud metadata credentials. An exposed internal machine plus an SSRF is a classic breach chain.

Subdomain takeover

When a subdomain's DNS still points to a cloud service that's no longer claimed, letting an attacker register that service and take control of the subdomain — to phish, serve malware, or steal cookies.

Zero-day

A vulnerability unknown to the vendor — and therefore unpatched — at the time it's discovered or exploited. The window before a fix exists is the most dangerous.

Book a call →  or  see how TRaViS works →