Our Pen Testing Glossary

Assumed breach is a penetration testing method where testers begin with internal access to simulate what attackers could do after getting in. It reveals weaknesses in detection, response, and internal controls, helping organisations strengthen real-world cyber resilience.

Blue teaming is the practice of defending an organisation against cyberattacks by continuously monitoring systems, identifying suspicious activity, and taking action to prevent or mitigate security incidents.

A CREST-accredited SOC is a Security Operations Center that has been independently assessed and certified by CREST to meet high standards of capability, technical competence, and operational security.

A CREST-certified pentester is a cybersecurity professional who has earned accreditation from CREST - demonstrating proven skills, technical expertise, and ethical standards in penetration testing.

Penetration testing is a simulated cyberattack performed by security professionals to uncover vulnerabilities in a system, network, or application before real attackers can exploit them.

Purple teaming is a collaborative security exercise where offensive (red team) and defensive (blue team) experts work together to improve an organisation’s detection, response, and overall security effectiveness.

Red teaming is an advanced, realistic simulation of attacker behaviour designed to test not just technical vulnerabilities but an organisation’s full defensive capability. It evaluates detection, response, and resilience—making it a powerful tool for improving overall cybersecurity maturity.

SOC 2 is a cybersecurity and compliance framework that evaluates how well an organisation protects customer data across five key trust principles.

SOC 2 Type I is an audit that evaluates whether an organisation’s security controls are properly designed and in place at a specific point in time to protect customer data.

SOC 2 Type II is a formal audit that evaluates how well an organisation’s security controls operate over a period of time, typically 3–12 months, to ensure they consistently protect customer data.

A vulnerability assessment is a structured process used to identify, classify, and prioritise security weaknesses in systems, networks, or applications.