Adversarial exposure validation is a Gartner category for tools that test exposures by emulating attacker behavior, confirming which ones are exploitable in a given environment. It covers automated pentesting, breach and attack simulation, and similar approaches, and is also called security validation.
AI penetration testing has two meanings. Most often it means using AI to perform penetration tests, from AI assisted tools to autonomous agents. It can also mean penetration testing of AI systems themselves, such as large language model applications. Check which meaning a vendor or article uses.
How XBOW handles it
The first meaning describes XBOW.
AI red teaming tests AI models and the applications built on them for harmful, unsafe, or insecure behavior, such as leaking data, following injected instructions, or producing prohibited content. It is testing of AI, which is different from using AI to test applications.
API penetration testing attacks an application's programming interfaces directly, testing authentication, authorization on every object and function, input handling, and rate limits. Many API flaws, such as broken object level authorization, never show up in a user interface, so they need testing at the API itself.
How XBOW handles it
Enterprise users can upload API specifications as assessment guidance.
An attack path is a sequence of steps an attacker could chain, often through several individually minor weaknesses, to reach a valuable target. Chained paths are how many serious breaches happen, and they are what single checks and point-in-time tests often miss.
An attack surface is every point where an attacker could try to get into or extract data from a system: applications, APIs, domains, cloud services, exposed ports, credentials, and the people with access. It grows every time a team ships a new service or endpoint.
Attack surface management is the continuous discovery, inventory, and monitoring of an organization's Internet-facing and internal assets, so security teams know what they have and what is exposed. ASM tells you what exists; testing tells you what is exploitable.
An attack trace is the step-by-step record of how a tester or agent reached a finding: each request, response, decision, and piece of evidence. It lets a reviewer reproduce the finding and check exactly what was done to the target.
How XBOW handles it
Every XBOW finding comes with the full trace log of the agents' actions, including the logic behind them and the commands they ran.
Authenticated testing runs attacks as a logged-in user, so the test reaches the features, data, and roles behind the login page. Most of an application's attack surface sits behind authentication, which is why testing only the public pages misses much of the risk.
How XBOW handles it
XBOW can sign in with a username and password, time-based one-time passwords from an authenticator app or email, single sign on, magic links, GitHub or Microsoft logins, bearer tokens and HTTP basic authentication.
Automated penetration testing uses software to run attack steps that a human tester would otherwise run by hand, usually from predefined playbooks or rules. It speeds up repeatable tests, but how far a tool can go beyond its playbook, and whether it proves each finding, varies widely between tools.
Autonomous offensive security applies AI agents to offensive security work, so attacks are planned, run, and validated by software that reasons about each target, at a pace and scale human teams cannot staff.
How XBOW handles it
XBOW is the autonomous offensive security platform that proves what attackers can actually exploit.
Autonomous penetration testing uses AI agents that plan, run, and adapt attacks on their own, deciding the next step from what they observe, the way a human tester would. It differs from automated testing because the agents reason about the target rather than follow a fixed script.
How XBOW handles it
Thousands of specialized XBOW agents attack web applications and APIs in parallel within the scope you set; independent validators confirm each vulnerability with reproducible evidence before it reaches your team.
These terms describe how much a tester knows before starting. Black box testing starts with no inside knowledge, like an outside attacker. Gray box testing adds some context, such as user credentials or API documentation. White box testing gives full access to source code and architecture.
Breach and attack simulation runs libraries of known attack techniques, usually mapped to MITRE ATT&CK, against an organization's security controls to check whether they block or detect them. BAS validates controls against known behavior; it does not look for new vulnerabilities in an application.
Broken object level authorization is the API form of IDOR and the first risk on the OWASP API Security Top 10: an API endpoint does not verify that the caller may act on the specific object requested.
A bug bounty program pays independent security researchers for valid vulnerabilities they report in an organization's systems, under published rules. Coverage depends on which researchers choose to look and what they choose to test, so it complements planned testing rather than replacing it.
A canary is a planted marker, such as a unique string or file, that a tester must retrieve to prove access. Retrieving it is unambiguous evidence of exploitation without touching real data.
How XBOW handles it
Enterprise assessments can include custom canaries for validation.
Continuous penetration testing tests an application every time it changes, or on a frequent schedule, instead of once or twice a year. It closes the gap between point in time tests, when new code, endpoints, and configuration changes go untested.
How XBOW handles it
Test on your cadence: on demand, after changes, or through the API, and retest fixes.
Continuous threat exposure management is a program model defined by Gartner with five stages: scoping, discovery, prioritization, validation, and mobilization. Validation is the stage that tests whether an exposure can really be exploited before the organization spends effort fixing it.
Cross-site scripting is a vulnerability in which an application includes attacker-controlled content in a page without neutralizing it, so the attacker's script runs in another user's browser. It can expose sessions, data, and actions of that user.
A CVE is a public identifier for a specific, disclosed vulnerability in a specific product, such as CVE-2021-44228. The CVE program assigns the IDs so that vendors, scanners, and security teams can refer to the same flaw.
CVSS is an open standard for scoring the severity of a vulnerability from 0 to 10, based on how it can be exploited and what exploiting it affects. Severity is not the same as risk: a high score on an unreachable system can matter less than a medium one on a public application.
How XBOW handles it
Validated XBOW findings include a CVSS score and CWE.
CWE is a catalog of software and hardware weakness types, maintained by MITRE, such as CWE-89 for SQL injection. A CVE is an instance; a CWE is the class of mistake behind it.
How XBOW handles it
XBOW reports results by top-level CWE.
The Digital Operational Resilience Act is an EU regulation for financial entities that has applied since 17 January 2025. It requires a digital operational resilience testing program, and entities identified by their authorities must run threat-led penetration testing at least every three years.
DAST tests a running application from the outside by sending crafted requests and watching the responses, without access to the source code. It finds classes of runtime flaws quickly; it usually follows set checks rather than chaining steps the way an attacker does.
An exploit is the technique or code that takes advantage of a vulnerability. Exploitability is whether that can actually happen in a specific environment, given its configuration, controls, and reachability. A vulnerability that is present but not exploitable carries far less risk than one that is.
Exposure management is the practice of continuously finding, prioritizing, and reducing the ways an attacker could reach an organization's important assets, across vulnerabilities, misconfigurations, and identities. It moves the question from how many vulnerabilities exist to which exposures matter.
External attack surface management focuses on what an outside attacker can see: domains, subdomains, IP addresses, certificates, cloud assets, and exposed services. It often finds assets the organization did not know it had.
A false negative is a real, exploitable vulnerability that a test fails to report. False negatives are harder to measure than false positives because nobody sees them until someone else finds the flaw.
A false positive is a reported vulnerability that turns out not to exist or not to be exploitable. False positives cost triage time and erode trust in a tool's results, which is the main complaint security teams raise about scanners.
The HIPAA Security Rule requires covered entities and business associates to protect electronic health information, including a risk analysis and periodic evaluation of their safeguards. Its text does not set a penetration testing requirement or frequency; many organizations use pentests as part of that evaluation. Check the current rule, since changes have been proposed.
An insecure direct object reference is an access control flaw in which an application exposes a reference to an object, such as an account or invoice ID, and does not check that the user is allowed to access it. Changing the reference returns someone else's data.
ISO/IEC 27001 is the international standard for an information security management system. Its Annex A controls include management of technical vulnerabilities and security testing in development. The standard does not require a penetration test by name; a pentest is common evidence for those controls.
A letter of attestation is a short, signed statement from a testing provider confirming that a penetration test took place, including its scope and dates, without disclosing vulnerability details. Auditors, customers, and procurement teams ask for it when they need proof of testing, but not the full report.
How XBOW handles it
XBOW provides a letter of attestation signed by XBOW for auditors and procurement.
LLM penetration testing attacks an application that uses a large language model, looking at the model's inputs and outputs, the tools and data it can reach, and the permissions it acts with. The riskiest flaws are usually in what the model is allowed to do, not in the model itself.
Local file inclusion is a vulnerability in which an application loads a file from its own server based on user input, letting an attacker read files such as configuration or credentials, and sometimes execute code.
See what a validated finding and its full trace look like on your own application.
Get a DemoNetwork penetration testing attacks the infrastructure layer: hosts, services, ports, network devices, and the paths between them, internal or external. It looks for exposed services, weak configurations, and routes an attacker could use to move from one system to another.
NIS2 is the EU directive on the security of network and information systems, applied through each member state's national law. It requires essential and important entities to manage cybersecurity risk, including policies to assess whether their measures work. It does not name penetration testing as a mandatory control.
Offensive security is the practice of attacking your own systems, with permission, to find and prove weaknesses before real attackers do. It includes penetration testing, red teaming, bug bounty programs, and exploit research, and it complements defensive security, which detects and blocks attacks.
An open redirect is a flaw in which an application sends users to any URL supplied in a parameter. Attackers use it to make malicious links look like they point to a trusted domain, and sometimes to steal authentication tokens.
The OWASP API Security Top 10 lists the most critical risks specific to APIs, led by broken object level authorization. It exists because APIs fail in ways web pages do not, especially in authorization checks on individual objects and functions.
The OWASP Top 10 is the Open Worldwide Application Security Project's ranked list of the most critical web application security risks, updated every few years from industry data. It is the most common reference for what a web application test should cover.
How XBOW handles it
XBOW's comprehensive assessment tests all OWASP Top Ten vulnerability classes.
The OWASP Top 10 for Large Language Model Applications lists the most critical security risks in applications built on LLMs, led by prompt injection. It is the common reference for scoping a test of an AI-powered application.
Requirement 11.4 of PCI DSS v4.0.1 covers penetration testing: internal and external penetration tests at least once every 12 months and after any significant infrastructure or application change, a documented methodology, correction of exploitable vulnerabilities followed by a retest, and segmentation testing where segmentation is used.
Penetration testing is an authorized, simulated attack on an application, network, or system to find vulnerabilities an attacker could exploit and to show what exploiting them would achieve. A pentest differs from a scan because it attempts the attack and proves the impact, rather than listing possible weaknesses.
Penetration testing as a service delivers pentests through a platform on a subscription or credit model, usually with human testers doing the testing and a portal for scoping, findings, and retests. It shortens scheduling compared with a traditional engagement; the testing itself is still largely manual.
A penetration testing report documents what was tested, how, what was found, and how to fix it. A useful report gives each finding its severity, evidence, reproduction steps, and remediation advice, plus an executive summary for readers who don’t read the details.
How XBOW handles it
XBOW generates a penetration testing report for each successful assessment, a new version after each verified fix, and an executive summary without exploit detail.
Production-safe testing proves vulnerabilities in live systems without damaging data, disrupting users, or leaving harmful changes behind. It relies on benign ways to demonstrate impact, strict scope, and controls that stop unsafe actions before they run.
How XBOW handles it
Non-destructive execution, audit trails, and review before findings surface. A separate safety model and deterministic rules check every command the agents propose, and XBOW pauses if the target shows signs of disruption.
Prompt injection is an attack in which input, typed directly or hidden in content the model reads, overrides an LLM application's instructions and makes it act against its purpose. It matters most when the model can call tools or read sensitive data.
A proof of concept is a minimal demonstration that a vulnerability is exploitable, such as a request that returns data the tester should not see. In a pentest report it is the evidence that turns a suspected flaw into a confirmed one.
Purple teaming runs attack and defense together: the offensive team shares each technique as it runs so the defensive team can tune detection and response in real time. The output is improved detections rather than a list of vulnerabilities.
Red teaming is an objective-based exercise in which a team emulates a real adversary to test an organization's detection and response, often combining technical attacks, social engineering, and physical access. A pentest asks what is exploitable in a scope; a red team asks whether the defenders notice.
Remediation removes a vulnerability, for example by fixing the code or applying a patch. Mitigation reduces the risk without removing the flaw, for example by adding a WAF rule or restricting access. Mitigation buys time; remediation closes the issue.
How XBOW handles it
Validated findings include mitigation guidelines, and a retest confirms the fix.
Remote code execution is a vulnerability that lets an attacker run their own commands or code on a target system over a network. It is among the most severe outcomes, because it can hand an attacker control of the server.
A retest checks whether a fixed vulnerability is really fixed by attempting the original exploit again. A good retest also tries ways around the fix, since a patch that blocks one payload can leave the underlying flaw open.
How XBOW handles it
An XBOW retest reproduces the original exploit, and if that is blocked, applies other exploitation techniques to check the fix cannot be bypassed.
Scope defines what a test may attack: which domains, applications, APIs, and accounts, and what is off limits. Rules of engagement add how: timing, intensity, forbidden actions, and who to call if something goes wrong. Both are agreed before testing starts.
How XBOW handles it
You define what XBOW can test; XBOW operates within the scope you set. Domains are marked Attackable or Allow visit, and sensitive URLs Auth-only or Blocked.
Security misconfiguration covers insecure settings rather than code flaws: default credentials, exposed admin panels or configuration files, verbose errors, weak TLS settings, and unnecessary services. It appears on the OWASP Top 10 and is among the most common findings in real applications.
Server-side request forgery is a vulnerability in which an attacker makes the server send requests to a destination of the attacker's choosing, often internal services or cloud metadata endpoints the attacker could not reach directly.
SOC 2 is an attestation report in which an independent auditor assesses a service organization's controls against the AICPA Trust Services Criteria. It does not make penetration testing mandatory, but auditors and customers commonly look for a recent pentest as evidence that controls are tested.
How XBOW handles it
Auditor-ready reporting that meets SOC 2 and ISO 27001 pentest requirements.
SQL injection is a vulnerability in which input sent to an application changes the database query the application runs, letting an attacker read, change, or delete data they should not reach. Parameterized queries are the standard fix.
SAST analyzes an application's source code, bytecode, or binaries for insecure patterns without running it. It catches flaws early in development and points to the exact line; it cannot tell whether a pattern is reachable or exploitable in the deployed application.
Threat-led penetration testing is a controlled test that mimics the tactics of real threat actors against an organization's live production systems, guided by threat intelligence. Frameworks such as TIBER-EU define how it runs, and DORA requires it of financial entities selected by their authorities.
A validated finding is a vulnerability whose exploitability has been confirmed with evidence, rather than inferred from a signature or a version number. Validated findings let a team spend its time fixing real risk instead of triaging possibilities.
How XBOW handles it
Independent validators confirm exploitability before a finding reaches your team; issues that cannot be proven are reported separately as informational.
A vulnerability is a weakness in software, configuration, or design that an attacker could use to break a security property: confidentiality, integrity, or availability. Not every vulnerability is exploitable in a given environment, which is why testing matters as much as finding.
A vulnerability assessment identifies, ranks, and reports the weaknesses in a set of systems, usually by combining scans with analysis. It answers what is weak and how severe it looks. A penetration test goes a step further and proves which weaknesses an attacker can exploit.
Vulnerability scanning uses automated tools to check systems for known weaknesses, such as missing patches, outdated components, and common misconfigurations. Scanners are fast and broad, but they report what might be vulnerable without attempting the exploit, so their results need confirming.
A web application firewall filters HTTP traffic to block common attacks before they reach an application. During a test, a WAF can block the tester, so teams usually allowlist the tester's IP addresses or a bypass header to test the application rather than the firewall.
How XBOW handles it
XBOW recommends a custom bypass header, which also makes its traffic easy to identify in your logs.
Web application penetration testing attacks a web application the way an outside attacker would: its pages, forms, sessions, authentication, and the APIs behind it. The goal is to find exploitable flaws such as injection, broken access control, and misconfiguration, and to prove each one with evidence.
How XBOW handles it
XBOW tests web applications and their APIs, including behind a login.
Web cache poisoning is an attack in which a harmful response is stored by a cache and then served to other users who request the same page. It turns one malicious request into an attack on everyone who receives the cached response.
A zero-day vulnerability is a flaw that the software's maker does not yet know about or has not yet fixed, so no patch exists when it is found or exploited. In custom applications, most vulnerabilities are effectively zero-days, because no public advisory will ever describe them.