ARTEMIS reports use terms you have no reason to know by heart. Here you'll find every concept explained simply: what it is, why it affects you, and what you can actually do. Links in the PDF reports point straight to the right term. Versiunea în română →
A weak spot in a program, device or configuration that an attacker can use to get in or cause damage. It can be a programming error, a setting left at factory defaults, or an unpatched system.
Why it matters: real attacks don't "hack" systems at random — they exploit specific vulnerabilities, exactly what ARTEMIS hunts for before someone else does.
The concrete method or code that turns a vulnerability into an actual attack. The vulnerability is the unlocked door; the exploit is the act of turning the handle.
Why it matters: for many known vulnerabilities, public exploits exist ready to use — the window between disclosure and attack is often days.
The international numbering system for known vulnerabilities. Each one gets a unique code like CVE-2024-12345, so everyone talks about the same problem.
Why it matters: if your report cites a CVE, the issue is public and documented — and attackers know it just as well as defenders do.
A score from 0 to 10 measuring how serious a vulnerability is: how easily it can be exploited and how much damage it does. Scores translate to severities: critical (9–10), high (7–8.9), medium (4–6.9), low (0.1–3.9).
Why it matters: you can't fix everything at once. The score gives you the order: criticals today, mediums on a schedule.
A test where your own systems are attacked in a controlled way, with your consent, using the same techniques a real attacker would — so you learn your weak points before they do.
Why it matters: it's the difference between learning from a report and learning from an incident. ARTEMIS automates this process to make it affordable for small businesses too.
Everything an attacker could try to get in through: websites, IP addresses, open ports, e-mail accounts, connected devices, employees who can be tricked.
Why it matters: you can't protect what you don't know is exposed. Many incidents start at a "forgotten" server or an old subdomain.
The threat is who or what may attack you (criminals, automated bots, malicious insiders). Risk combines three factors: the threat (who attacks), the vulnerability (the way in) and the impact (what you lose).
Why it matters: most attacks on small businesses are automated — bots scanning the whole internet. You don't need to be an "interesting" target to get hit.
A modern security principle: grant no automatic trust to anyone or anything — not even devices inside your own network. Every access is verified, every time. It pairs with "assume breach": design your defences as if the attacker is already inside.
Why it matters: the old model ("everything inside my network is trusted") collapses at the first infected laptop brought into the office.
Messages (e-mail, SMS, WhatsApp) that imitate a trusted source — your bank, a supplier, a colleague — to trick you into giving passwords, card details, or opening an infected file.
Why it matters: it's the most common way into small businesses. It doesn't attack the technology — it attacks the person in a hurry.
The attacker places themselves between you and the service you're talking to — on public Wi-Fi, for example — and can read or modify the traffic without either side noticing.
Why it matters: if your site accepts unencrypted connections, your customers can be diverted to a clone that steals their data — and that's on you.
Automatically trying thousands or millions of password combinations until one fits. Modern tools test entire lists of common passwords in seconds.
Why it matters: every login form exposed to the internet gets bombarded with these attempts daily, automatically, without exception.
Attackers take passwords leaked in breaches at other services and try them on your systems automatically, betting on people reusing the same password in several places.
Why it matters: if an employee uses the same password at work as on a site breached 3 years ago, their account is effectively wide open.
The attacker slips database commands into form fields or the page address. If the application doesn't validate its inputs, the commands execute — and the database answers to them, not to you.
Why it matters: it's one of the oldest and still most common ways entire customer databases get stolen.
An attacker manages to inject code (JavaScript) into your website's pages — code that then runs in your visitors' browsers, where it can steal sessions, passwords, or alter what the page shows.
Why it matters: the direct victim is your customer, but the reputation and the liability are yours.
The attacker tricks your server into making requests on their behalf — usually to internal resources not reachable from outside (admin panels, cloud metadata services, other servers on the network).
Why it matters: your server becomes the attack's accomplice: it is the one knocking on internal doors, and the firewall lets it through because it's one of the family.
Your site is loaded invisibly, inside a frame, on top of a decoy page. The visitor thinks they're clicking the decoy's buttons, but they're actually clicking real buttons on your site — "confirm payment", for instance.
Why it matters: logged-in users can be made to perform actions without knowing it.
X-Frame-Options: DENY header or, more modern, frame-ancestors in CSP.Thousands of compromised computers send traffic to your site simultaneously until it chokes — the service becomes unavailable for real customers.
Why it matters: every hour of downtime means lost sales and customers heading to competitors. Attacks can even be cheaply "rented".
Malicious software that encrypts your files and demands payment for the decryption key. Modern variants steal the data first and also threaten to publish it.
Why it matters: for a small business, ransomware without backups very often means closing down. Paying the ransom guarantees nothing.
The umbrella term for any program built to do harm: viruses, trojans, spyware, ransomware, hidden cryptocurrency miners. It reaches you via attachments, downloads, USB sticks or compromised websites.
Why it matters: a single infected computer can become the beachhead for compromising the entire network.
Sophisticated, long-running attacks run by organized groups (often state-sponsored) that enter quietly, persist for months, and extract strategic information.
Why it matters: even if you're not the direct target, you can be the weak link: small suppliers are used as springboards toward their larger clients.
Faking identity in communication: e-mails that appear sent from your domain, IP addresses or devices posing as others, clone websites. The goal: get someone trusted who isn't who they claim to be.
Why it matters: without protections on your e-mail domain, anyone can send messages "on behalf of your company" to your customers.
The protocol that encrypts communication between a browser and a website (the padlock in the address bar). It guarantees nobody along the way can read or modify the data exchanged.
Why it matters: without TLS, your customers' passwords and data travel in the clear through every intermediate network. Browsers visibly flag non-HTTPS sites as insecure.
The cryptographic "ID card" of a site or service: it proves the server you're talking to is the real one, not a clone. It's issued by a certificate authority (CA) and has an expiry date.
Why it matters: an expired certificate blocks your customers with scary errors and is among the most frequent scan findings.
A header through which your site tells browsers: "you only ever talk to me encrypted". After the first visit, the browser itself refuses any unencrypted connection to you.
Why it matters: without HSTS, a visitor's first request can be intercepted on public Wi-Fi and diverted to a clone site (MITM) before the padlock ever appears.
Strict-Transport-Security: max-age=31536000; includeSubDomains on all HTTPS responses.A header telling the browser exactly which sources of scripts, styles and images your page may load. Anything not on the list is blocked.
Why it matters: it's the safety net against XSS: even if an attacker injects code, the browser refuses to run it.
unsafe-inline — it cancels most of the protection.Systems left on default settings, missing security headers, admin panels exposed publicly, listable directories, error messages leaking technical detail, forgotten test accounts still active.
Why it matters: it's the #1 category of problems found in practice. It takes no "hacker" talent — just an automated scanner and careless configuration.
The system reveals more than it should: exact software versions in headers, error messages with internal details, accessible configuration files, directory listings, sensitive data in page comments.
Why it matters: every leaked detail is a piece of the attacker's puzzle — an exact software version tells them precisely which exploit to use.
Session cookies must carry the attributes Secure (HTTPS only), HttpOnly (unreadable by page scripts) and SameSite (protection against forged requests).
Why it matters: a stolen session cookie = the attacker becomes that user, no password needed.
The rules by which your site decides which other websites may read its data from your visitors' browsers. A CORS policy "open to everyone" on an authenticated API lets any foreign site read data on your users' behalf.
Why it matters: the * configured out of convenience is common — and turns a protection into a breach.
* together with authentication.Data needs protection on two journeys: in transit (moving across networks — TLS) and at rest (sitting on disks, in databases, in backups). Data found unencrypted on either journey is a serious finding.
Why it matters: a stolen laptop or lost backup with unencrypted data is a reportable GDPR breach; the same incident with encrypted data is just a hardware loss.
Using old, already-broken or deprecated cryptographic algorithms and protocols: TLS 1.0, SSLv3, MD5, SHA-1, keys that are too short. Encryption exists — but mostly for show.
Why it matters: weak crypto gives false comfort — the data looks protected, but a well-equipped attacker can decrypt it.
Passwords are never stored as text but as irreversible mathematical "fingerprints" (hashes), computed with special, deliberately slow algorithms (bcrypt, scrypt, Argon2). At login the fingerprints are compared, not the passwords.
Why it matters: if the database is stolen, properly hashed passwords stay practically unrecoverable; plaintext or MD5 ones are read instantly.
Authentication answers "who are you?" (password, code, fingerprint); authorization answers "what are you allowed to do?". A missing login on an exposed service — or authorization that doesn't actually check rights — are among the most serious findings.
Why it matters: an admin panel without authentication, found by a scanning bot, means total takeover within minutes.
Besides the password, the account requires a second factor: a code generated on your phone (TOTP), a hardware key, or an in-app confirmation. A stolen password alone is no longer enough.
Why it matters: it's the most effective measure per unit of effort — it stops password phishing, brute force and credential stuffing almost entirely.
The next generation of authentication, without passwords: a cryptographic key pair tied to your device (phone, laptop, USB key). The site only ever receives proof — never a secret that could be stolen or phished.
Why it matters: passkeys are phishing-proof by construction — there is no password to hand over to anyone.
A good password is long (12–16+ characters), unique per account, and generated/remembered by a password manager — not by your memory. Default, short, or hardcoded passwords are frequent findings.
Why it matters: weak or reused passwords are the direct cause of a large share of compromises — see credential stuffing.
Who has access to what. The golden rule is least privilege: every account (human or application) gets exactly the rights it needs for its job — nothing more. Roles (RBAC) make this manageable: rights attach to roles, not individuals.
Why it matters: when an account is compromised (it happens), the damage is limited to what that account could do. A compromised "all-access" account = everything compromised.
After login, the server hands you an "access wristband" (session cookie or JWT token) which the browser presents with every request. Whoever holds the wristband is, as far as the server is concerned, you.
Why it matters: stolen tokens bypass the password and even MFA entirely — which is why their lifetime and protection matter.
The filter deciding what traffic enters and leaves your network or server, based on rules. The healthy rule is "default deny": anything not explicitly allowed is blocked.
Why it matters: without a configured firewall, every service running on a server is exposed to the entire internet — see open ports.
The numbered "doors" through which a computer's services communicate on the network (80/443 for web, 3389 for RDP, 22 for SSH, 445 for Windows file sharing). Every open port is a service answering — and a potential way in.
Why it matters: bots permanently scan the whole internet for open ports running vulnerable services. An exposed RDP with a weak password is the classic recipe for ransomware.
Splitting the network into separate zones (VLANs): servers apart from workstations, smart devices (cameras, printers, sensors) apart from everything, guests on their own network. Between zones, only strictly necessary traffic.
Why it matters: in a "flat" network, one infected workstation can see and attack everything — including the accounting server. Segmentation turns a building fire into a one-room fire.
An encrypted tunnel between your device and the company network (or a trusted server). All traffic travels protected, no matter how unsafe the network you're on.
Why it matters: it's the correct answer to "how do I reach the office server from home?" — instead of exposing management services to the internet.
The office wireless network must be encrypted with WPA2 or, ideally, WPA3, use a long password, and be separated from the guest network. WEP and the original WPA have long been broken.
Why it matters: Wi-Fi reaches beyond your office walls. A weakly protected network gives anyone in the parking lot direct access to your internal network.
Systems that watch network traffic for known attack patterns. IDS detects and alerts; IPS actively blocks. They're the network's "security cameras".
Why it matters: successful attacks rarely make noise. Without detection, breaches are discovered on average months later — by someone else.
Recording events across your systems: who logged in, from where, what they accessed, what failed. Logs are your infrastructure's black box.
Why it matters: without logs, after an incident you cannot answer the essential questions: how they got in, what they touched, what they took — including for legal notification duties.
The platform that gathers logs from all systems in one place, correlates them, and alerts on suspicious patterns: geographically impossible logins, bursts of failed authentication, data exfiltration.
Why it matters: the signals of an attack are scattered across several systems; only assembled together do they tell the story in time.
The internet's "phone book": it translates names (scanope.com) into IP addresses. Whoever controls your DNS controls your domain: e-mail, website, everything.
Why it matters: hijacking your DNS or your registrar account is a direct way to take over your online identity — website and e-mail included.
In the cloud, security is split: the provider is responsible for the security of the infrastructure (data centres, hardware, platform); you are responsible for security in the infrastructure: your data, accounts, configurations, access rights.
Why it matters: "it's in the cloud, so it's secure" is the most expensive misunderstanding. Nearly all cloud breaches stem from customer misconfiguration, not provider failure.
The cloud's identity-and-rights system: users, roles, access policies. The cloud version of access control — and attackers' first target.
Why it matters: a single over-privileged cloud account without MFA can expose the company's entire infrastructure and data.
Cloud storage services (S3, Azure Blob, GCS) can be made internet-readable with a single checkbox. Entire file containers of major companies have been found public by mistake — customer data included.
Why it matters: search engines specialized in finding public cloud storage exist. The mistake gets found in hours, not years.
Temporary links granting direct access to a file in cloud storage, without authentication — a "hotel room key" valid for a limited time. Anyone holding the link has the access, for as long as it's valid.
Why it matters: presigned links valid for months, sent by e-mail or landed in logs, are forgotten open doors.
Encryption keys, database passwords and application API keys belong in a dedicated vault (Key Vault, Secrets Manager) — not in code, config files or e-mails — and must be rotated periodically.
Why it matters: keys forgotten in code end up on public GitHub with astonishing frequency; from there, bots find them within minutes.
The European regulation for personal-data protection. Among other things, it requires adequate technical measures (encryption, access control), notifying breaches to the authority within 72 hours, and clear rights for data subjects.
Why it matters: a breach involving unprotected personal data brings — on top of the direct damage — fines and notification duties. "Adequate technical measures" means precisely the things in this glossary.
The European directive on network and information security, transposed in Romania through OUG 155/2024. It requires essential and important entities to manage risk, report incidents, and makes management personally accountable.
Why it matters: it covers far more companies than the old directive — including SMEs in sectors like energy, transport, health, digital, manufacturing. Their suppliers feel the requirements too, through contracts.
The European regulation on cyber resilience: products with digital elements (software, connected devices) sold in the EU must be secure by design, with security updates throughout their lifetime.
Why it matters: if you build or resell software or connected devices, CRA requirements become a condition of market access.
Unpatched software accumulates public vulnerabilities with ready-made exploits. "Outdated components" also means the libraries inside your applications, not just the operating system — including a CMS and its plugins.
Why it matters: most successful attacks exploit vulnerabilities for which an update already existed. The patch costs minutes; the incident costs weeks.
The golden rule: 3 copies of your data, on 2 different kinds of media, with 1 in another location (offline or cloud, not directly reachable from your network). A backup that stays permanently connected gets encrypted by ransomware together with the original.
Why it matters: a tested backup is the difference between "unpleasant incident" and "we closed the company". It's the best cost/benefit measure in all of security.
Protection for workstations and servers. Classic antivirus recognizes known malware; EDR (Endpoint Detection & Response) watches behaviour — suspicious processes, mass encryption, lateral movement — and lets you rapidly isolate a compromised device.
Why it matters: employee workstations are the first line of impact: that's where attachments and links land.
The plan written before the bad day: who decides, who isolates systems, whom you call (IT, lawyer, insurer, authorities), how you communicate with customers. Nobody improvises well in a crisis.
Why it matters: the first hours decide the damage. Notification duties (GDPR: 72h, NIS2: 24h early warning) run whether you're prepared or not.
CAI Technology SRL · scanope.com · home · Română · changelog · status