The product's own user guide. Every screen shows Aldervane Health, a fictional organization. All data is synthetic.
13. Glossary
Every term in this guide, in plain language.
| Term | Meaning |
|---|---|
| Access level | Which TLP markings an account may see (on screen, its clearance). A person sees items marked at or below their level. See TLP |
| Anchor | Something your setup declares (your organization, a supplier, or another organization Ciphren collects on). Entities connected to one, directly or through others, are marked in scope |
| Attack surface | Everything an attacker could reach from the internet without being let in: your websites, portals, gateways and mail servers, and your suppliers' |
| Affiliate | An organization you own or operate, such as a subsidiary or a foundation. Its findings count as your own estate |
| Collection | The separate process that gathers public, observable information about your organization, suppliers and sector, and sends it to Ciphren. Ciphren only receives it |
| Confirmed | A finding where the exact build of the software was compared against the build that fixes the flaw. Most findings are instead inferred from the version a system announces, which is strong evidence but not proof |
| Corroborated | Reported by several independent sources. Single-source means one source |
| Coverage | How much of your estate a collection could see. A rise in findings can mean better coverage rather than a worse estate |
| CPE | The standard name for a software product and version. A CPE match means a system reported a product and version known to be affected |
| CVE | The public identifier given to each known vulnerability, such as CVE-2023-4966 |
| CVSS | The standard severity score for a vulnerability, from 0 to 10 |
| DMARC | A published email record telling receivers what to do with mail that fails authentication. p=none only reports, while quarantine and reject act |
| Data diode | A one-way connection: data flows into Ciphren, and nothing can flow back. See Receive-only |
| DNSSEC | Signatures on a domain's DNS records, so the answers to "where is this site?" can't be forged |
| Entity | A person, organization, government body, technology or threat group that Ciphren tracks |
| Evidenced | On a PIR card, an item you can open and read here, as opposed to one the analysis counted but that isn't shown |
| Exposure Review | The lane for strings in public files that look like credentials. They're candidates to review, not confirmed leaks |
| Finding | One observation on one system, usually a weakness |
| HHI | Herfindahl–Hirschman index: a standard measure of concentration, from near 0 (spread across many providers) to 1 (all on one) |
| Host | One internet-facing system, such as a website, gateway or mail server |
| Incident | A news story, advisory or event that involves you, your suppliers or your sector |
| In scope (◎) | Connected, directly or through others, to something your setup declares: your organization, a supplier, or another organization Ciphren collects on |
| KEV | CISA's catalogue of Known Exploited Vulnerabilities, which are being used in attacks now. They come first |
| Location | A part of your organization (a hospital, campus or office) that findings are attributed to. Your organization may use another word |
| MFA | Multi-factor authentication: a second sign-in step, here a six-digit code from an authenticator app |
| MRI | Mission Resilience Index ("mission": what the organization exists to do). One exposure score for an organization or person, from the findings on the systems they're responsible for. Open-ended: higher means more exposed. 70 or more is the watch tier. It's for ranking attention, not a verdict |
| Narrative arc | A storyline: related incidents grouped and followed over time |
| Nexus | A connection to you. A story has a nexus if it names your organization or one whose systems Ciphren collects on |
| Own estate | Systems you run, including your affiliates', as opposed to your vendors' |
| Posture | The Executive Brief's headline: green, amber or red, from the share of your systems showing a critical finding |
| Patch cadence | How quickly fixes are seen landing between collections, from observed upgrades and closed findings |
| PACS | A hospital's medical-imaging archive and viewer |
| PIR | Priority intelligence requirement: one of the few questions leadership most needs answered, tracked with a traffic light |
| Receive-only | Ciphren receives data from the collection and never reaches back into it, or into your systems |
| Standing exposure | What an attacker could use now, as opposed to what anyone is using. The posture light measures standing exposure |
| Severity | How serious a finding would be if exploited: critical, high, medium, low, or informational (worth knowing, not a weakness) |
| SPF | A published email record listing which servers may send mail as your domain |
| Systemic threshold | The share of your systems showing a critical finding at which posture turns red (5%) |
| TLS | The encryption between a visitor and a site. 1.0 and 1.1 are retired, 1.2 is acceptable, and 1.3 is current |
| TLP | Traffic Light Protocol: sharing markings. CLEAR (anyone), GREEN (community), AMBER (your organization, need to know), RED (named recipients) |
| Upstream | Set by the collection's analysis rather than by anyone using the page, as on a PIR's traffic light |
| Vendor grade | A supplier's standing: Critical, Elevated, Monitor or Clear, from its open findings |
| Watch tier | An MRI score of 70 or more |