# SecOps glossary

Plain-language definitions of the terms used in SecOps. The linked guides explain the app's counting rules and what the evidence can establish.

| Term | Meaning |
| --- | --- |
| SecOps | Security operations: the work of identifying, assessing and following up security concerns |
| Finding | A reported issue on a particular target |
| Vulnerability | A specific flaw that can be exploited to harm a system or its data |
| Weakness | A type of underlying condition that can lead to vulnerabilities |
| CVE | A shared identifier for a publicly disclosed vulnerability |
| CWE | A classification of security weakness types |
| Severity | The source's normalised Critical, High, Medium, Low or Info label |
| CVSS | A system for describing vulnerability severity with a numerical score |
| EPSS | An estimate of exploitation in the wild over the next 30 days for a published CVE |
| Percentile | A relative rank; an EPSS percentile differs from its probability |
| KEV | CISA's Known Exploited Vulnerabilities catalogue, based on exploitation evidence |
| Exposure | Whether and how a relevant target can be reached or affected |
| Triage | Checking relevance, impact, evidence and ownership before choosing an action |
| Target | The repository, resource or other affected system named by a finding |
| Remediation | A change addressing the reported issue |
| Fixed-in version | A version the advisory identifies as containing the relevant fix |
| Fix group | Findings grouped around one remediation change |
| Workstream | A collection of fixes needing a similar kind of action |
| SLA | In SecOps, the internal time allowance for remediation by severity |
| Breach | A finding remaining open after its remediation deadline |
| Risk acceptance | A temporary decision to retain a real risk, with a reason and recheck date |
| False positive | A report assessed as not applying to the target, with evidence to revisit |
| Owner team | The team responsible for following up a vulnerability finding |
| Provider | A connected system supplying accounts, roles or audit events |
| Service identity | An account or credential used by automation rather than a person |
| Privilege | Authority to perform sensitive or administrative actions |
| MFA or 2FA | Authentication using different factors; 2FA uses two |
| Audit trail | The access events providers recorded and SecOps holds |
| Expected activity | A matching rule suppressing certain event-based attention without deleting the events |
| Access review | A recorded inspection of changes over a stated period, with coverage and follow-up |

## Guides

- [Vulnerabilities, severity and exploit likelihood](/docs/secops/vulnerabilities)
- [Working findings](/docs/secops/findings)
- [Remediation deadlines](/docs/secops/deadlines)
- [Exceptions](/docs/secops/exceptions)
- [Access](/docs/secops/access)

## Official references

- [CVE Program glossary](https://www.cve.org/ResourcesSupport/Glossary?activeTerm=glossaryRecord)
- [MITRE CWE frequently asked questions](https://cwe.mitre.org/about/faq)
- [FIRST CVSS documentation](https://www.first.org/cvss/)
- [FIRST EPSS documentation](https://www.first.org/epss/)
- [CISA Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NIST authentication guidance](https://pages.nist.gov/800-63-4/sp800-63b.html)

These references explain the broader concepts. SecOps's thresholds, default deadlines and available sources are product rules described in the guides, rather than requirements those references impose on every organisation.