PECB LPTP key terms

An authorized, simulated cyberattack on systems or people, performed to discover exploitable weaknesses and to measure how well existing defences and detection capabilities actually hold up in practice.

A systematic, usually non-exploitative review that identifies, classifies, and prioritizes known weaknesses in assets so that remediation can be planned; it does not normally demonstrate whether a weakness can actually be exploited.

A goal-oriented, adversary-simulating engagement that tests an organization's people, processes, and technology together, typically with limited defender knowledge, to evaluate detection and response rather than to enumerate individual vulnerabilities.

A collaborative activity in which offensive operators and defenders work together during or after an exercise, replaying techniques so that detection rules, logging, and response procedures are improved and validated.

A person or group with the intent and capability to attack a target; profiles typically describe motivation, resources, skill, and preferred tools so that testing can be tailored to realistic adversaries.

The sum of all points where an attacker could interact with or influence a system, including exposed services, interfaces, identities, supply chain dependencies, and human targets.

The written agreement defining what testers may and may not do, which targets are in scope, when testing may occur, how emergencies are handled, and who authorizes changes during the engagement.

The process of defining precisely which systems, networks, applications, people, and locations are included in or excluded from testing, together with constraints such as timing, bandwidth, and prohibited techniques.

A contractual document describing deliverables, schedule, effort, assumptions, and acceptance criteria for an engagement; it complements the rules of engagement by covering commercial rather than operational terms.

A short authorization document carried by testers that identifies the engagement, the client contact, and a verification channel, so that law enforcement or third parties can confirm the activity is sanctioned.

A signed statement from an individual with proper authority confirming that testing of named assets is permitted; without it, the same activity would be unlawful intrusion rather than a sanctioned assessment.

A framework contract that sets general legal and commercial terms for an ongoing relationship, allowing individual engagements to be ordered through shorter statements of work or task orders.

A named person and reachable channel agreed in advance so testers can halt activity or escalate immediately if testing causes outage, data loss, or other unintended operational impact.

The gradual, unapproved expansion of testing beyond agreed boundaries, often arising from informal requests; it must be documented and formally authorized to preserve legal protection and accurate reporting.

A documented process for requesting, reviewing, approving, and recording modifications to scope, schedule, or methodology, ensuring all parties share the same current understanding of the engagement.

A structured, repeatable framework of phases, activities, and deliverables that guides an engagement from planning through reporting, giving consistency and traceability to the work performed.

Information gathering performed before or alongside testing, covering public data, domain records, technology fingerprints, and organizational details that help define targets and likely entry points.

Open-source intelligence: information lawfully collected from publicly available sources such as websites, registries, job postings, and social media, used to build a target profile without direct interaction.

The active process of listing valid accounts, shares, services, versions, and other resources on reachable systems, producing the concrete inventory from which exploitation candidates are selected.

The controlled use of a weakness to demonstrate real impact, such as executing code, reading data, or gaining access, while staying within agreed limits and avoiding unnecessary damage.

Activities after initial access that determine the value of a foothold, such as privilege escalation, credential access, lateral movement, and data access, always bounded by the agreed scope.

Techniques used to move from one compromised host to other systems using stolen credentials, trust relationships, or remote services, illustrating how far an intruder could spread inside a network.

Gaining a higher level of access than initially obtained, for example moving from a standard user to administrator or root, thereby demonstrating the potential severity of a foothold.

Manipulating people through deception, such as phishing or pretexting, to obtain information or access; testing it requires explicit approval and careful handling of participants.

Confirming that a reported weakness is genuine and exploitable in the target's actual configuration, distinguishing real risk from scanner noise before it is reported to the client.

A finding reported as a weakness that is not actually present or not exploitable in the tested context; unverified scanner output is a common source and damages report credibility.

A minimal, reproducible demonstration, such as a command transcript or screenshot, showing that a reported weakness can be exploited, giving the client evidence without causing unnecessary harm.

Collecting, labeling, storing, and protecting artifacts from testing so that findings can be substantiated later; it includes sanitizing sensitive data and controlling who may access it.

A structured judgment of finding severity that combines technical impact with likelihood and business context, often using a recognized scoring scheme plus client-specific factors.

A published open framework for scoring the technical severity of vulnerabilities using standardized metrics; it describes intrinsic characteristics and must be contextualized with business factors.

Practical, prioritized advice on how to fix or mitigate each finding, including effort and dependencies, written so that technical owners can act without further interpretation.

The structured communication of engagement results, covering scope, methodology, findings, evidence, risk, and recommendations, written for both technical and executive audiences.

A short opening section that conveys overall security posture, key risks, and priorities in business language, avoiding technical jargon so decision-makers can act on the results.

A follow-up verification, performed after remediation, that confirms which findings are fixed, which remain, and whether any new issues were introduced by the changes.

The obligation to protect client information, credentials, and test artifacts from unauthorized disclosure, typically enforced through agreements, encryption, access control, and secure destruction.

A contract binding testers to keep client information secret and to limit its use to the engagement, often outlasting the project and covering subcontractors and stored data.

The disciplined creation and tuning of monitoring logic, such as signatures and behavioral rules, so that activities performed during testing can be reliably observed and alerted on.

Quantitative measures used to judge programme value, such as findings remediated, time to detect, coverage of critical assets, and repeat findings, guiding investment and improvement decisions.

A staged reference describing progressively stronger capability levels for a testing programme, used to assess current practice, set realistic targets, and plan improvement over time.

The ongoing organizational structure of policy, people, processes, and tooling that governs how testing is requested, approved, executed, tracked, and improved across the enterprise.