Glossary
Short definitions of the terms used on this site and in every TrustSek report, with the primary source for each standard.
Last reviewed
The scoreBack to index
- Band
The label a score falls into: Low, Medium, High or Critical. The thresholds are fixed and published on the methodology page.
- Baseline
The starting point for the score: a 2% chance that an average organisation has a cyber incident in a year. It is a policy choice, not a measurement, and every score records the policy version that used it.
- Confidence
How strong the evidence behind a finding is, from 0 to 1. A run's confidence is the average of its findings' confidences, weighted by how much each contributes, and is shown as High, Medium or Low.
- Finding
One thing the scan found, with what was tested, why it matters, the impact and how to fix it. Each finding has a severity, a confidence and belongs to one module.
- Not checked
The state of a source that could not be consulted, for example because no licence key is configured. It adds nothing to the score and is never counted as a clean result; it shows up as coverage instead.
- Outside-in
Assessing an organisation only from what is publicly visible on the internet, without agents, credentials or access to its systems.
- Risk multiplier
The score itself: how much higher an organisation's risk is than the baseline. It starts at 1.0×, where a domain with no findings lands, and findings only add to it. 3.0× is roughly three times as likely to have an incident in a year.
- Severity
How serious a finding is, from 0 to 100. Critical starts at 90, High at 70 and Medium at 40.
Email and DNSBack to index
- CAA record
A DNS record that says which certificate authorities may issue certificates for a domain. Without one, any public authority may issue.
- DKIM
DomainKeys Identified Mail. The sending server signs outgoing mail with a key whose public half is published in DNS, so receivers can check the message was not altered and came from an authorised sender.
- DMARC
A DNS policy that tells receiving mail servers what to do with messages that fail SPF and DKIM checks: nothing (p=none), quarantine, or reject. Only quarantine and reject actually stop spoofed mail.
- DNSSEC
Signatures on DNS records that let resolvers check an answer really came from the zone's owner and was not changed on the way.
- MTA-STS
A policy that tells sending mail servers to deliver to your domain only over authenticated, encrypted connections, so mail cannot be quietly downgraded to plain text.
- SPF
Sender Policy Framework. A DNS record listing the servers allowed to send mail for a domain. How it ends matters: -all rejects other senders, while +all allows anyone.
- TLS-RPT
A DNS record that asks sending mail servers to report problems they had establishing encrypted connections to you, so failures do not go unnoticed.
Web and TLSBack to index
- Certificate transparency
Public, append-only logs of the TLS certificates that authorities issue. Because every certificate is logged, they reveal a domain's subdomains to anyone who looks.
- Content Security Policy (CSP)
A response header that tells browsers which sources a page may load scripts, styles and other content from. It limits the damage of injected code.
Source: W3C CSP Level 3Read more about Content Security Policy (CSP)
- HSTS
HTTP Strict Transport Security. A header that tells browsers to only ever connect to a site over HTTPS, which closes the gap an attacker could use to downgrade a connection.
Attack surface and threatsBack to index
- Attack surface
Everything an organisation exposes to the internet: domains, subdomains, hosts, open ports and the services behind them. The larger and less tidy it is, the more likely something on it is forgotten.
- CISA KEV
The Known Exploited Vulnerabilities catalogue kept by the US Cybersecurity and Infrastructure Security Agency. A vulnerability on it has been seen exploited in the wild, which is why it ranks first.
- CVE
A public identifier for a disclosed security vulnerability, such as CVE-2024-3094. It lets everyone refer to the same flaw.
- EPSS
The Exploit Prediction Scoring System from FIRST. It estimates the probability that a vulnerability will be exploited in the next 30 days, which says more about urgency than a technical severity score.
- Lookalike domain
A registered domain that resembles yours closely enough to fool a reader, for example with a swapped or added character. It can be used for phishing in your name.
- Ransomware leak site
A site where a ransomware group publishes the names of organisations it claims to have attacked, often with stolen data. Independent trackers collect these claims.
- Subdomain
A name under your domain, such as mail.example.com. Each live one is part of your attack surface, and forgotten ones are a common weak point.
RegulationBack to index
- NIS2
Directive (EU) 2022/2555 on a high common level of cybersecurity across the EU. Article 21 lists the risk-management measures essential and important entities must take, including supply-chain security.