# Glossary

URL: https://www.deepinfo.com/glossary/

## The Vocabulary of Exposure Management.

Continuous threat exposure management has its own vocabulary, and so does the security work around it. Each entry defines one term, says where it shows up in the Deepinfo Platform, and links to the page that goes further.

[See the platform](https://www.deepinfo.com/platform/) · [Suggest a term](https://www.deepinfo.com/contact/)

### The Ideas the Rest Builds On.

New to the category? Read these first. Many of the other entries build on one of them.

#### [CTEM](https://www.deepinfo.com/glossary/#ctem)

The operating model: scope, discover, prioritize, validate and mobilize, continuously.

#### [Attack Surface](https://www.deepinfo.com/glossary/#attack-surface)

What the model manages: everything an attacker can reach from the internet.

#### [CVSS, EPSS and CISA KEV](https://www.deepinfo.com/glossary/#epss)

The signals that, read together, rank what to fix first.

#### [Issue Lifecycle](https://www.deepinfo.com/glossary/#issue-lifecycle)

The states from first detection to verified resolved, with each decision kept on record.

#### [Reverse Lookup](https://www.deepinfo.com/glossary/#reverse-lookup)

The pivot behind asset discovery and most investigations.

### Terms From A to Z.

### A

- **ASN (Autonomous System Number)**: A number assigned to a network operator, such as an ISP, a cloud provider or a large enterprise, that identifies its network for routing on the internet. Knowing which ASN announces an IP address tells you who operates the network behind it. Deepinfo records the ASN of each monitored IP in the IP WHOIS layer. See [IP WHOIS API](https://www.deepinfo.com/data-api/apis/ip-whois-lookup/) · [BGP](https://www.deepinfo.com/glossary/#bgp)
- **Asset**: An internet-facing entity the Deepinfo Platform monitors: a domain, a subdomain or an IP address. Assets are the units that scanning, issue detection and scoring work on. Each one is scanned on all data layers and carries its own security score. See [External Attack Surface Management](https://www.deepinfo.com/platform/easm/)
- **Asset Inventory**: A catalog of all the internet-facing assets that belong to an organization. Inventories kept by hand drift out of date as subsidiaries, campaigns and projects add infrastructure, and the gaps are what attackers look for. External Attack Surface Management keeps the inventory current by proposing newly discovered assets for your team to approve. See [Asset Discovery](https://www.deepinfo.com/platform/easm/smart-asset-discovery/) · [Attack surface management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/)
- **ATT&CK (MITRE ATT&CK)**: A knowledge base of adversary tactics and techniques, maintained by MITRE and built from real-world observations. Security teams use its technique IDs as a shared language for how threat actors operate, from initial access to impact. See [TTP](https://www.deepinfo.com/glossary/#ttp) · [Threat actor](https://www.deepinfo.com/glossary/#threat-actor)
- **Attack Surface**: Everything an attacker can reach and interact with: systems, applications, services and data. The external attack surface is the part reachable from the internet, including domains, subdomains, IP addresses, cloud services and infrastructure that third parties host on an organization’s behalf. See [External Attack Surface Management](https://www.deepinfo.com/platform/easm/)

### B

- **BGP (Border Gateway Protocol)**: The protocol autonomous systems use to exchange routes, which decides how traffic travels between networks on the internet. In a BGP hijack, a network announces routes for address space it does not hold and draws in traffic meant for someone else. See [ASN](https://www.deepinfo.com/glossary/#asn)
- **Brand Impersonation**: The use of a legitimate brand’s name, logo or visual identity to deceive people. It covers phishing pages, lookalike domains, fake mobile apps, fraudulent social accounts and counterfeit websites. See [Brand Risk Protection](https://www.deepinfo.com/platform/brp/) · [Brand impersonation protection](https://www.deepinfo.com/solutions/use-cases/brand-impersonation-protection/)
- **BRP (Brand Risk Protection)**: Deepinfo’s module for finding brand impersonation. Fraudulent Domain Monitoring matches domains against your brand names, from exact and fuzzy matches to confusable characters, then watches each lookalike’s DNS, mail, certificate and web presence with a risk score over time. The module also covers social platforms, app stores and search engines, and includes Managed Takedown. See [Brand Risk Protection](https://www.deepinfo.com/platform/brp/) · [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/)

### C

- **CAPEC (Common Attack Pattern Enumeration and Classification)**: A catalog maintained by MITRE that describes how common attacks work, pattern by pattern. Deepinfo classifies EASM issues against CAPEC, among other frameworks, and CVE records carry CAPEC IDs through their CWE. See [Compliance and audit readiness](https://www.deepinfo.com/solutions/use-cases/compliance-and-audit-readiness/)
- **Certificate Transparency**: A system of public, append-only logs that record the TLS certificates issued by publicly trusted certificate authorities. All the names on a logged certificate become public, so CT logs are a source for discovering subdomains and for spotting certificates issued for your domains that nobody on your team requested. See [SSL Lookup API](https://www.deepinfo.com/data-api/apis/ssl-lookup/) · [Subdomain enumeration](https://www.deepinfo.com/glossary/#subdomain-enumeration)
- **CISA KEV (Known Exploited Vulnerabilities Catalog)**: A catalog published by the US Cybersecurity and Infrastructure Security Agency that lists CVEs with evidence of exploitation in the wild. Each entry records the date it was added, the required action and a remediation due date for US federal agencies. Deepinfo checks every CVE found on your assets against KEV and prioritizes with the listing, CVSS and EPSS together. See [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) · [Methodology](https://www.deepinfo.com/methodology/)
- **Confusable Match**: A match that holds once characters that look alike are treated as the same, such as a Cyrillic “а” standing in for a Latin “a”. Plain string comparison misses these domains, because the characters differ even when the rendered name looks identical. The confusable match types in Fraudulent Domain Monitoring are `confusable_exact`, `confusable_contains`, `confusable_fuzzy` and `confusable_fuzzy_contains`. See [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) · [Homoglyph attack](https://www.deepinfo.com/glossary/#homoglyph-attack)
- **CTEM (Continuous Threat Exposure Management)**: A program model introduced by Gartner that manages exposure in five stages: scoping, discovery, prioritization, validation and mobilization. It treats exposure as an ongoing program instead of a once-a-year audit. The Deepinfo Platform supports it from the outside in, with discovery, prioritization and a tracked path from finding to fix. See [Platform](https://www.deepinfo.com/platform/) · [How it works](https://www.deepinfo.com/platform/how-it-works/)
- **CTI (Cyber Threat Intelligence)**: The discipline of collecting and analyzing information about adversaries and what they hold. In the Deepinfo Platform, Cyber Threat Intelligence is the module for exposures that already exist outside your perimeter. It covers email breaches, infostealer infections on employee devices, leaked employee, client and payment credentials, dark web search, threat actor profiles and curated security news. See [Cyber Threat Intelligence](https://www.deepinfo.com/platform/cti/)
- **CVE (Common Vulnerabilities and Exposures)**: The standard identifier for a publicly disclosed vulnerability. Each CVE ID, such as CVE-2021-44228 (the Log4Shell flaw in Apache Log4j), comes with a description, the affected products and severity metadata. Deepinfo’s CVE records add EPSS, CISA KEV, CWE and vDeep enrichment. See [Vulnerability Search](https://www.deepinfo.com/platform/dsi/vulnerability-search/) · [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/)
- **CVSS (Common Vulnerability Scoring System)**: A standard for rating the severity of a vulnerability on a scale from 0.0 to 10.0. CVSS describes how bad a flaw could be, not whether anyone is exploiting it. Deepinfo ranks CVEs by CVSS, EPSS and CISA KEV together, so severity alone does not set the order. See [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) · [EPSS](https://www.deepinfo.com/glossary/#epss)
- **CWE (Common Weakness Enumeration)**: A taxonomy of the weakness classes behind vulnerabilities in software and hardware. A CVE is one specific vulnerability; its CWE names the kind of mistake behind it, such as improper input validation. Deepinfo maps CWEs to the OWASP Top 10 (2021) and uses CWE as one of its compliance classifications. See [Vulnerability Intelligence](https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/)
- **Cybersecurity Rating**: A score for an organization’s security posture, derived from what can be observed from outside: exposed services, certificate hygiene, breach history and patch status. Enterprises use ratings to compare vendors and to track them over time. See [Security risk scoring](https://www.deepinfo.com/solutions/use-cases/security-risk-scoring/) · [Vendor Risk Scoring](https://www.deepinfo.com/platform/tprm/automated-risk-scoring/)

### D

- **Dark Web**: Parts of the internet that standard search engines do not index and that need specific software, such as Tor or I2P, or an invitation to reach. Forums, markets and leak sites there trade stolen data and access. Deepinfo’s Dark Web Search queries these sources by free text or by an indicator, such as an email address, an email domain, an IP address or a card number. See [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/) · [Dark web monitoring](https://www.deepinfo.com/solutions/use-cases/dark-web-monitoring/)
- **DNS (Domain Name System)**: The system that translates names into IP addresses. DNS records also route email (MX), delegate zones (NS), prove domain control (TXT) and point names at other names (CNAME), so they reveal a great deal about an organization’s infrastructure. See [DNS Lookup API](https://www.deepinfo.com/data-api/apis/dns-lookup/) · [DNS History API](https://www.deepinfo.com/data-api/apis/dns-history/)
- **Domain Squatting**: Registering domain names close to a legitimate brand to profit from mistyped traffic, sell the name back to the brand or stage attacks. The practice includes typosquatting, combosquatting (a brand name plus an extra word) and cybersquatting in general. See [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) · [Typosquatting](https://www.deepinfo.com/glossary/#typosquatting)
- **DSI (Deep Search & Insights)**: Deepinfo’s module for querying the index directly: Domain Intelligence, Domain Search, Vulnerability Intelligence, Vulnerability Search and Instant Lookups. It is the data the other modules run on, and that data is also available as Deepinfo API Services and Data Feeds. See [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) · [Data & API](https://www.deepinfo.com/data-api/)

### E

- **EASM (External Attack Surface Management)**: The category of security tooling that discovers, monitors and assesses what an organization exposes to the internet. Deepinfo’s EASM module covers asset discovery, continuous scanning across all data layers, risk detection, remediation tracking and risk scoring. See [External Attack Surface Management](https://www.deepinfo.com/platform/easm/)
- **EPSS (Exploit Prediction Scoring System)**: A model maintained by FIRST that estimates the probability a CVE will be exploited in the wild in the next 30 days. Scores run from 0 to 1, and FIRST publishes new scores daily. Deepinfo enriches every CVE with its EPSS score and percentile, and keeps each CVE’s EPSS history. See [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) · [EPSS History API](https://docs.deepinfo.com/reference/vulnerability/epss-history/)

### F

- **FERPA**: The US Family Educational Rights and Privacy Act, which governs the privacy of student education records. It shapes how schools and universities handle the data their systems hold and expose. See [Education](https://www.deepinfo.com/solutions/industries/education/)

### G

- **GDPR**: The EU General Data Protection Regulation, which governs how personal data about people in the EU is processed. Deepinfo processes personal data under the GDPR and Türkiye’s KVKK. See [Privacy Policy](https://www.deepinfo.com/privacy/) · [KVKK](https://www.deepinfo.com/glossary/#kvkk)

### H

- **HIPAA**: The US Health Insurance Portability and Accountability Act, which governs how protected health information is handled. HIPAA is one of the frameworks Deepinfo classifies EASM issues against. See [Healthcare](https://www.deepinfo.com/solutions/industries/healthcare/)
- **Homoglyph Attack**: Registering a domain with characters from another script that render like the Latin letters of a real brand, so the fake name reads as the real one. Internationalized domain names make this possible. The confusable match types in Fraudulent Domain Monitoring exist to find these domains. See [Confusable match](https://www.deepinfo.com/glossary/#confusable-match) · [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/)

### I

- **IAB (Initial Access Broker)**: A threat actor who breaks into organizations and sells that access to other criminals, often ransomware operators, instead of carrying out the attack. Access listings on criminal forums can be an early sign that an organization is being targeted. See [Ransomware exposure monitoring](https://www.deepinfo.com/solutions/use-cases/ransomware-exposure-monitoring/)
- **Incident Response (IR)**: The process of detecting, investigating, containing and recovering from a security incident. IR teams work from defined playbooks and record lessons learned so an incident is not repeated. See [Incident investigation and response](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/)
- **Infostealer**: Malware that harvests saved credentials, session cookies, autofill data and system details from an infected device and sends them to its operator, who uses or sells the resulting logs. One infected laptop can expose all the accounts its user signed into. Compromised Employee Device Monitoring reads infostealer logs for devices tied to your organization. See [Compromised Employee Device Monitoring](https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/) · [Credential exposure management](https://www.deepinfo.com/solutions/use-cases/credential-exposure-management/)
- **IOC (Indicator of Compromise)**: An observable piece of data, such as a domain, an IP address, a file hash or a certificate fingerprint, that points to malicious activity. Analysts use IOCs to hunt through their own logs and to block known malicious infrastructure. See [Threat hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) · [STIX/TAXII](https://www.deepinfo.com/glossary/#stix-taxii)
- **IP (Internet Protocol) Address**: The numeric address of a device or service on a network. IPv4 addresses are 32 bits long and written like 192.0.2.10; IPv6 addresses are 128 bits long, which gives the protocol a far larger address space. See [Reverse IP API](https://www.deepinfo.com/data-api/apis/reverse-ip/) · [IP WHOIS API](https://www.deepinfo.com/data-api/apis/ip-whois-lookup/)
- **Issue Lifecycle**: Deepinfo’s model for tracking an issue through its states: `newly_detected`, `reappeared`, `unresolved`, `marked_as_resolved`, `verified_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive` and `not_applicable`. Instead of a binary open or closed, each state stays on record with its history, which is what an audit trail needs. Every scan sets `verified_resolved` on its own when the signal is gone, and `not_applicable` when it cannot tell; your team can mark an issue resolved, accept the risk, ignore it or mark it a false positive. If a resolved signal returns, the issue reopens as reappeared. See [Remediation](https://www.deepinfo.com/platform/easm/remediation-with-actionable-insights/) · [Methodology](https://www.deepinfo.com/methodology/)

### K

- **KEV**: Short for the CISA Known Exploited Vulnerabilities catalog. See CISA KEV. See [CISA KEV](https://www.deepinfo.com/glossary/#cisa-kev)
- **KVKK**: Türkiye’s Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu), which governs the processing of personal data in Türkiye. Deepinfo processes personal data under KVKK and the EU GDPR. See [Privacy Policy](https://www.deepinfo.com/privacy/) · [GDPR](https://www.deepinfo.com/glossary/#gdpr)

### L

- **Lookalike Domain**: A domain registered to imitate a legitimate one, usually for phishing. Lookalikes use typos, swapped or doubled characters, characters from other scripts and brand names combined with extra words. Fraudulent Domain Monitoring finds them by matching domains against your brand names. See [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) · [Phishing detection and prevention](https://www.deepinfo.com/solutions/use-cases/phishing-detection-and-prevention/)

### M

- **Managed Takedown**: Deepinfo’s service for getting fraudulent content removed, such as a lookalike domain used for phishing. Each request goes to the intermediary that can act on it, such as a registrar or a hosting provider, with the evidence the platform collected, and is tracked until it closes. See [Managed Takedown](https://www.deepinfo.com/platform/brp/managed-takedown/) · [Takedown](https://www.deepinfo.com/glossary/#takedown)
- **MDR (Managed Detection and Response)**: A service in which an external provider monitors a customer’s environment, detects threats and responds to incidents. MDR combines tooling, threat intelligence and analysts under one contract. See [MSSPs](https://www.deepinfo.com/audience/mssps/)
- **MSP (Managed Service Provider)**: An organization that runs IT services for its customers, often including security. Deepinfo works with MSPs and MSSPs through its partner program. See [Partners](https://www.deepinfo.com/partners/) · [MSSP](https://www.deepinfo.com/glossary/#mssp)
- **MSSP (Managed Security Service Provider)**: A provider that delivers security operations as a service: monitoring, log management and incident response. MSSPs serve organizations that lack the in-house capacity to run those functions themselves. See [MSSPs](https://www.deepinfo.com/audience/mssps/)

### N

- **NIST CSF (NIST Cybersecurity Framework)**: A voluntary framework published by the US National Institute of Standards and Technology. Version 2.0, released in 2024, organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. See [Compliance and audit readiness](https://www.deepinfo.com/solutions/use-cases/compliance-and-audit-readiness/)

### O

- **OWASP Top 10**: The Open Worldwide Application Security Project’s list of the most critical web application security risks. Deepinfo classifies EASM issues against the 2021 edition, a reference developers and auditors already know. See [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/)

### P

- **Passive DNS**: Historical records of DNS resolutions collected from sensors across the internet. Passive DNS shows what a name resolved to in the past, and which names pointed at an IP address, even after the records changed. Deepinfo’s DNS History API returns the distinct values a record has had, with the times each was observed. See [DNS History API](https://www.deepinfo.com/data-api/apis/dns-history/)
- **Patch Tuesday**: The second Tuesday of each month, when Microsoft releases its security updates. Many other vendors publish on similar predictable schedules, and security teams plan deployment cycles around them. See [Vulnerability management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/)
- **PCI DSS**: The Payment Card Industry Data Security Standard, the compliance framework for organizations that store, process or transmit payment card data. Deepinfo classifies EASM issues against both PCI DSS 4.0 and PCI DSS 3.2. See [Financial services](https://www.deepinfo.com/solutions/industries/financial-services/)
- **Phishing Kit**: A prepackaged set of templates, code and setup instructions that lets an attacker stand up a phishing page quickly. Kits usually imitate a specific brand and capture credentials, payment data or authentication tokens. See [Phishing detection and prevention](https://www.deepinfo.com/solutions/use-cases/phishing-detection-and-prevention/)
- **Pivot (in Investigation)**: Moving from one indicator to related ones during an investigation: from a domain to its IP, from the IP to the other domains it hosts, from a registrant email to the domains registered with it. Deep Search & Insights is built around these pivots, each of which is one API call. See [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/) · [Reverse lookup](https://www.deepinfo.com/glossary/#reverse-lookup)

### R

- **Reverse Lookup**: A query that starts from an attribute and returns everything that shares it. Reverse IP finds the domains that point to an IP, reverse MX the domains that use a mail server, reverse NS the domains on a name server, and reverse WHOIS the domains registered with an email address. Reverse lookups drive investigations in Deep Search & Insights and asset discovery in External Attack Surface Management. See [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/) · [Asset Discovery](https://www.deepinfo.com/platform/easm/smart-asset-discovery/)
- **Reverse-IP Lookup**: Finding every domain that resolves to a given IP address. It reveals related infrastructure and shared hosting, and it is a standard step in asset discovery and investigations. Deepinfo’s Reverse IP API also accepts the /8, /16 or /24 network around an address. See [Reverse IP API](https://www.deepinfo.com/data-api/apis/reverse-ip/)
- **Reverse-WHOIS**: Finding every domain registered with a given registration detail, most often an email address, an organization name or a phone number. It helps uncover subsidiary domains and infrastructure that arrived with an acquisition. Records hidden behind a privacy service cannot be matched this way. See [Reverse WHOIS Email API](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) · [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/)

### S

- **SBOM (Software Bill of Materials)**: A formal list of the components, libraries and dependencies inside a piece of software. When a vulnerability is disclosed in a component, an SBOM tells you which products contain it. Some regulations now require one. See [Supply chain security](https://www.deepinfo.com/solutions/use-cases/supply-chain-security/)
- **Shadow IT**: Internet-facing infrastructure set up by employees, contractors or business units without the security team’s knowledge. Because nobody registered it, shadow IT sits outside the official inventory and outside patching and monitoring. See [Asset Discovery](https://www.deepinfo.com/platform/easm/smart-asset-discovery/)
- **SIEM (Security Information and Event Management)**: Software that collects logs from across an organization, correlates events to detect threats and supports compliance reporting. For most security operations centers it is the main working surface. See [SOC teams](https://www.deepinfo.com/audience/soc-teams/) · [SOAR](https://www.deepinfo.com/glossary/#soar)
- **SOAR (Security Orchestration, Automation and Response)**: Tooling that automates security operations workflows through playbooks, such as enriching an alert, opening a ticket or isolating a host. A SOAR platform acts on the data other tools feed it. See [SOC teams](https://www.deepinfo.com/audience/soc-teams/)
- **SOC (Security Operations Center)**: The team and tooling responsible for monitoring, detecting and responding to security incidents. Many security operations centers work around the clock and combine analysts, tooling and defined response procedures. See [SOC teams](https://www.deepinfo.com/audience/soc-teams/)
- **SSL/TLS (Secure Sockets Layer / Transport Layer Security)**: The protocols that encrypt data between clients and servers. SSL is the older name; TLS is the protocol in use today for HTTPS, email and other secure channels. A certificate ties a TLS key to the names it is valid for, which also makes certificates a record of an organization’s hostnames. See [SSL Lookup API](https://www.deepinfo.com/data-api/apis/ssl-lookup/) · [Certificate transparency](https://www.deepinfo.com/glossary/#certificate-transparency)
- **STIX/TAXII**: Structured Threat Information Expression and Trusted Automated Exchange of Intelligence Information, two OASIS standards. STIX describes threat intelligence as structured objects, and TAXII defines how those objects are exchanged between systems. See [IOC](https://www.deepinfo.com/glossary/#ioc)
- **Subdomain Enumeration**: Discovering the subdomains that belong to a parent domain. Techniques include passive DNS, certificate transparency logs, crawling and brute-force probing of likely names. Deepinfo’s Subdomain Finder API returns the subdomains the index holds for a domain. See [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/) · [Asset Discovery](https://www.deepinfo.com/platform/easm/smart-asset-discovery/)
- **Supply Chain Attack**: An attack that reaches an organization through a trusted supplier, vendor or software dependency instead of attacking it directly. The SolarWinds, Kaseya and 3CX incidents are well-known examples. See [Supply chain security](https://www.deepinfo.com/solutions/use-cases/supply-chain-security/) · [TPRM](https://www.deepinfo.com/glossary/#tprm)

### T

- **Takedown**: Removing malicious content from the internet by submitting evidence to the intermediary that controls it: a registrar, a hosting provider or a platform. A request works best with complete evidence, sent to the party that can act on it. See [Managed takedown services](https://www.deepinfo.com/solutions/use-cases/managed-takedown-services/)
- **Threat Actor**: An individual or group behind malicious cyber activity. Common categories are state-sponsored groups, criminal organizations, hacktivists and insiders. Deepinfo’s threat actor profiles record each actor’s targets by region, country and industry, and the CVEs and tools the actor uses. See [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/)
- **Threat Hunting**: A proactive search for threats that have evaded existing defenses, usually driven by a hypothesis drawn from threat intelligence. It differs from incident response in that it starts without a known compromise. See [Threat hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/)
- **TPRM (Third-Party Risk Management)**: The practice of assessing and monitoring the security of vendors, suppliers and partners. Deepinfo’s TPRM module applies EASM’s discovery, layer-by-layer scanning and scoring to each third party, so vendors and your own assets sit on one scale. It adds a continuous, outside-in view to point-in-time questionnaires. See [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/)
- **TTP (Tactics, Techniques, and Procedures)**: A way of describing how a threat actor operates. Tactics are the goal, techniques are how the actor reaches it, and procedures are the specific implementation. MITRE ATT&CK is the most widely used catalog of techniques. See [ATT&CK](https://www.deepinfo.com/glossary/#attck)
- **Typosquatting**: Registering domains that exploit common typing mistakes, such as `acmebnak.example` registered to catch visitors meant for `acmebank.example`. Typosquats are used for phishing, malware delivery and ad fraud. See [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) · [Lookalike domain](https://www.deepinfo.com/glossary/#lookalike-domain)

### V

- **Vendor Assessment**: Evaluating a vendor’s security posture before and during a business relationship. Traditional assessments rely on questionnaires; continuous monitoring of the vendor’s external attack surface shows whether the answers still hold. See [Vendor Risk Assessments](https://www.deepinfo.com/platform/tprm/comprehensive-risk-assessments/) · [Third-party risk management](https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/)

### W

- **WASC (Web Application Security Consortium)**: The consortium’s threat classification is a taxonomy of web application attacks and weaknesses. It is one of the frameworks Deepinfo classifies EASM issues against. See [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/)
- **WHOIS**: The protocol and records that describe a domain’s registration: registrar, registration and expiry dates, name servers, status codes and, where published, the registrant. Much registrant data is now redacted or proxied for privacy, and where it is hidden, it stays hidden in Deepinfo’s data. The WHOIS Lookup API returns the current record, raw and parsed, and the WHOIS History API returns the records a domain has had before. See [WHOIS Lookup API](https://www.deepinfo.com/data-api/apis/whois-lookup/) · [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)

### Z

- **Zero-Day**: A vulnerability that attackers exploit before a fix is available, which leaves the vendor zero days to respond. Zero-days are usually reserved for high-value targets. Once one has a CVE ID, confirmed exploitation and remediation guidance, it qualifies for CISA KEV. See [Vulnerability management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/) · [CISA KEV](https://www.deepinfo.com/glossary/#cisa-kev)

### The Platform’s Own Terms as the API Spells Them.

Several entries above name values the Deepinfo Platform stores literally. These are the exact values, for anyone reading an export or writing against the [API](https://docs.deepinfo.com/reference/).

- **Asset types**: `domain`, `subdomain`, `ip`
- **Data layers**: `whois`, `ipwhois`, `dns`, `ssl`, `port_scan`, `webdata`, `http`
- **Issue states**: `newly_detected`, `reappeared`, `unresolved`, `marked_as_resolved`, `verified_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`
- **Severities**: Critical, High, Medium, Low, Information
- **Match types**: `exact`, `contains`, `fuzzy`, `fuzzy_contains`, `confusable_exact`, `confusable_contains`, `confusable_fuzzy`, `confusable_fuzzy_contains`
- **Compliance**: `owasp_tt_2021`, `pci_4_0`, `pci_3_2`, plus HIPAA, CWE, CAPEC and WASC
- **Notification frequencies**: `instant`, `hourly`, `daily`, `weekly`, `monthly`

### From Definitions to the Method.

- [Methodology](https://www.deepinfo.com/methodology/) (Resources): How the data is collected, how assets are scanned and how findings are scored.
- [How it works](https://www.deepinfo.com/platform/how-it-works/) (Platform): The path from one seed domain to a scored, owned finding.
- [Query the index](https://www.deepinfo.com/data-api/) (Data & API): Lookups, reverse lookups, history and vulnerability search over one REST API.

### See the Terms Applied to Your Domain.

Before a demo we run discovery and a first scan against your domain. On the call, terms from this page show up as your own assets, findings and CVEs, ranked by EPSS and CISA KEV.

[Request demo](https://www.deepinfo.com/request-demo/)