Glossary¶

NodeZero is heavily involved with the cybersecurity community. As such, we use some industry jargon in our product and documentation. This is where that jargon gets demystified.

Assets¶

An asset is a networked entity (i.e., system host/machine) that has an IP address and is discovered during a scan.

Examples of assets include:

• Servers
• Laptops, desktops, and mobile devices
• Virtual machines
• Printers
• IoT devices
• Switches, routers, access points, endpoints
• Public static IPs
• Lambdas and serverless architecture
• Kubernetes pods and other containerized applications

Attack Path¶

An attack path refers to the sequence of steps or actions an attacker may take to compromise a system or network. It involves identifying vulnerabilities and other weaknesses, exploiting them, and navigating through the network to access valuable information or resources.

BloodHound Data¶

BloodHound data is the reconnaissance information collected and analyzed by the BloodHound tool within an Active Directory and/or Azure environment. NodeZero users have the option to obtain the BloodHound data collected during a pentest.

Context score¶

Horizon3's 0–10 risk score reflecting impact from real exploitability, downstream impact, and business context — not just a CVSS score.

Impact¶

Impacts summarize, in business terms, the effects that NodeZero was able to achieve as a result of exploiting weaknesses in your environment (e.g., Domain Compromise, Critical Infrastructure Compromise, Ransomware Exposure, etc.). One or more weaknesses are typically chained together to become an attack path associated with an Impact.

N-Day¶

An N-day is a software or hardware vulnerability that is already publicly known (N days since disclosure), but there might or might not be a security update available to remediate the vulnerability.

NodeZero Runner¶

The NodeZero Runner enables automated deployment of a NodeZero container. This enables you to provision and deploy pentests from the NodeZero Portal, without having to manually run a NodeZero launch script.

Notable Event¶

A feature of Real-Time View (RTV). These events signify that during the pentest, NodeZero performed actions that would likely lead to a critical Impact.

Proof (also "Proof of Exploit)¶

The artifacts, such as command output or screenshots, that a NodeZero pentest captures to show that a weakness was actually exploited. A Proof records confirmed exploitation, not a theoretical finding: it shows what an attacker can do in the environment, not what a scanner flags as possible.

RAT¶

RAT stands for remote access tool – software that gives a person full control of a tech device, remotely. These tools have legitimate uses, such as technical support, but can also be controlled by attackers with malicious intent. In the context of NodeZero, a RAT is used to provide NodeZero with additional access to further explore attack paths during operations.

Real-Time View (RTV)¶

Real-Time View in NodeZero provides you with real-time information and updates on the progress of your running pentest, including status updates for injected credentials.

Sensitive Data Exposure¶

An Impact that indicates that NodeZero was able to potentially access sensitive information, given the filetype or service that is compromised. Examples include, but are not limited to:

• Business documents in file shares (.docx, .pdf, .xlsx)
• Outlook PST files
• Confluence RCE
• Exchange RCE

States (Pentest)¶

The pentest lifecycle encompasses several stages, each with its unique purpose and characteristics. These stages surface in the NodeZero Portal with words like: "Preparing," "Action Needed," "Running," "Processing," and "Done." Below, you will find a detailed breakdown of these stages and their respective descriptions.

Vulnerability¶

A generic, potential flaw (such as a CVE) that might or might not be exploitable. NodeZero elevates a vulnerability to a weakness only when it proves exploitation.

Weakness¶

A weakness refers to a vulnerability or security flaw that an attacker can exploit to compromise a system, network, or identity. Weaknesses can include misconfigurations, outdated software, default credentials, or other vulnerabilities that can be leveraged to gain unauthorized access or perform malicious actions. In NodeZero, a weakness is a specific instance found in a single pentest, not a theoretical scanner finding. Each pentest is a snapshot in time, and every weakness is scoped to the pentest that found it. Because findings are recorded per pentest, an unremediated weakness appears again as its own finding in every later pentest that encounters it. Two pentests can therefore list the same underlying weakness independently, once in each.

Weakness Series¶

The account-wide, deduplicated view of every unique instance of a weakness tracked across all pentests – used for remediation, regression, and trend tracking. This is what the Portal's Vulnerability Management Hub shows.