Glossary term
CVE
Also: Common Vulnerabilities and Exposures
Global identifier for publicly known security vulnerabilities in software and hardware. Format CVE-YYYY-NNNN, run by MITRE on behalf of CISA. More than 200,000 CVEs as of 2025.
Each CVE entry contains a short description, affected products and versions, references to patches and PoCs. CVEs are assigned by CVE Numbering Authorities (CNAs), including Microsoft, Cisco, Red Hat, GitHub.
Related: CVSS (Common Vulnerability Scoring System) gives a severity 0-10. CWE (Common Weakness Enumeration) classifies the vulnerability class. KEV (Known Exploited Vulnerabilities) by CISA lists actively exploited CVEs as mandatory patches.
In practice
Practice: a modern vulnerability management programme prioritises by KEV listing, EPSS score (Exploit Prediction Scoring System) and asset criticality, not blindly by CVSS.
Related terms
CVSS
Standardised scoring system for vulnerabilities with a 0-10 score. Current version CVSS v4.0 (2023). Measures Base, Temporal and Environmental Metrics. Often criticised for lack of exploitability signal.
SBOM
Machine-readable inventory of all components in a software incl. versions, licences and dependencies. Formats: SPDX, CycloneDX, SWID. Mandatory in regulated areas; in the US driven by Executive Order 14028.
Supply Chain Risk
Risks from the software and hardware supply chain: compromised open-source packages, build-pipeline attacks, updates with backdoors, sub-suppliers without audit trail. Mandatory under NIS2 Art. 21 (d) and DORA Art. 28 (sub-outsourcing).
CASB
Security layer between users and SaaS providing visibility (shadow IT discovery), data protection (DLP), compliance, and threat protection across SaaS apps. Four functions per Gartner: visibility, compliance, data security, threat protection.
CNAPP
Gartner platform category that combines CSPM, CWPP, CIEM, KSPM, DSPM and IaC scanning into one tool. Answer to tool fragmentation in cloud security stacks.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Confidential Computing
Hardware-based isolation that keeps data encrypted during processing (data-in-use). Complements encryption at rest and in transit. Technologies: Intel SGX, Intel TDX, AMD SEV-SNP, ARM CCA, Nvidia H100 Confidential Computing.
Critical ICT Third-Party Provider (CTPP)
ICT third-party provider designated critical by the European Commission under DORA Art. 31, falling under direct supervision of one of the three European Supervisory Authorities (EBA, EIOPA, ESMA). First CTPP designations expected in 2025/2026.