Security Glossary

A real technical security condition that the organization has chosen to accept through governance. In Securitain, suppressed and exception-approved findings leave the active work queue while still remaining part of gross technical risk.

See also: Exceptions & Risk Acceptance, Accepted status group

The three possible outcomes when Securitain evaluates a specific authorization question across policy layers. Allowed: all required layers agree the action is permitted. Denied: at least one layer explicitly denies the action. Indeterminate: the relevant layer exists but could not be fully evaluated — for example, an incomplete SCP hierarchy or unresolvable conditions. Indeterminate is a real answer, not a fallback.

See also: Decision states

A long-lived credential associated with an IAM user for programmatic AWS access. An access key has an Access Key ID and a secret access key. Securitain security views may display metadata such as age and last-used context.

Securitain should never expose the secret access-key value.

A sequence of permissions, trust relationships or security transitions connecting a source principal to a target capability or resource.

See also: Attack path, Privilege escalation

The supported policy, trust or resource relationship represented as contributing to an access relationship. Use this term when exact policy attribution is not guaranteed.

A human-readable name associated with an AWS account inside Securitain (example: “Production”). The underlying AWS account ID remains unchanged.

The AWS account population currently selected for a Securitain view. Examples: one AWS account; All Accounts.

A finding in the active lifecycle group: Open, In Progress, Pending Approval or Pending Verification.

See also: Active status group

The findings currently requiring operational attention (Open, In Progress, Pending Approval). Do not confuse with gross technical risk, which also includes Accepted findings.

An IAM identity represented by Securitain as having broad administrative capability under supported analysis. The exact technical evidence should be reviewed.

A security-relevant supported capability chain through which privilege can increase. Detecting an attack path does not prove compromise occurred or that the path was used.

See also: Privilege Escalation & Attack Paths

A native AWS account identified by a twelve-digit AWS account ID.

The AWS Organizations hierarchy containing roots, Organizational Units and member accounts. Do not confuse with a Securitain organization.

The potential security consequence or reach associated with control of an identity. Blast radius can consider supported context such as administrative capability, assumable roles, passable roles, sensitive-service and resource reach, and security-control modification.

Blast radius is not probability of compromise.

See also: IAM Blast Radius

See Permission boundary.

A supported Securitain assessment function that depends on specific AWS data or permissions. Examples: IAM Inventory, CloudTrail evidence, Identity Center, Organizations, Resource Policies.

A Securitain component that retrieves supported AWS security and configuration metadata. Do not use this term to imply content-level data extraction.

A control used to reduce or manage risk when the original technical condition remains. A compensating control does not mean the original finding is remediated.

A relationship between a supported Securitain technical finding and a relevant security or control framework reference. Compliance mapping is not certification.

An AWS policy or trust restriction that applies contextual rules to an authorization statement. Examples can include source, principal, organization, MFA and token claims.

A qualifier on derived intelligence results — such as blast-radius reachable targets and access-path queries — that reflects how complete and recent the underlying graph and collection data was. High: data was complete and recent. Medium or Low: data was partial, stale or the scope was bounded. Confidence does not equal probability of compromise.

See also: Reachable targets, Reachable target

Security risk associated with authentication credentials and interactive identity posture. Examples: old access key, unused key, root key, missing MFA, weak password policy.

See also: Credential Risk

Access involving more than one AWS account. Cross-account access is common in legitimate enterprise architecture and is not automatically a vulnerability.

See also: Cross-Account Access

Whether the data collection for a given analysis is complete, partial or unknown. Completeness affects how broadly conclusions can be drawn. A partial or unknown result means Securitain could not collect the full scope — not that no issue exists outside the collected scope.

See also: Confidence, Reachable target

How old the assessment evidence currently displayed by Securitain is. Current scan status and displayed-data freshness are different concepts.

See also: Scan Status & Freshness

Securitain's supported resource-posture analysis for services such as S3, KMS, RDS and DynamoDB, subject to the current Supported AWS Services & Coverage reference.

An AWS account no longer included in Securitain current posture and scanning. Historical data can remain until purged.

The supported permission context represented as remaining available after relevant policy layers and constraints are considered. Attached policy text alone does not always equal effective access.

See also: Effective Permissions

The security information supporting a Securitain conclusion. Evidence can include identity, policy, trust, resource, scan, timestamps and finding details.

The time context of the security evidence supporting a result. See Data freshness.

A specific policy or trust relationship Securitain has identified as contributing to a permission or access relationship — including the policy document name and type (inline, managed, resource policy, SCP). Not every result includes a uniquely attributable single source; where attribution is uncertain, Securitain uses the term access source.

A formal governed decision to accept a real finding for a limited period under documented justification and controls.

See also: Exceptions & Risk Acceptance

A finding or context in which a resource, role trust or policy grants access — directly or conditionally — to principals outside the local AWS account. External exposure does not prove the external entity accessed the resource; it means the technical trust or permission allows it subject to any conditions being met.

See also: Cross-Account Access, Resource Policies

A connection-specific value used in the Securitain cross-account role trust to help protect against confused-deputy risk. Securitain treats the value as security-sensitive connection configuration and does not return it through routine account APIs.

A principal outside the local AWS account or trust boundary represented in an IAM or resource trust relationship.

A closed finding where the organization determined the detection itself is incorrect. False Positive is different from accepted risk — the detection is wrong, not the risk accepted.

See also: False Positive status

AWS access established through an external identity provider or session model rather than a persistent IAM-user credential. Examples: SAML, OIDC, GitHub Actions OIDC.

See also: Federation, OIDC & SAML

A Securitain-detected security-relevant condition backed by supported assessment evidence. A finding can have severity, category, evidence, remediation and a lifecycle status.

See also: Findings & Finding Lifecycle

The type or class of security issue represented by a finding. Examples: credential, cross-account, federation, toxic combination. Category is not severity.

The technical security significance assigned to a finding: Critical, High, Medium, Low or Info.

See also: Finding Severity & Risk Terminology

A Securitain 0–100 IAM prioritization indicator summarizing multiple current IAM risk signals. Higher is worse. It is not probability of compromise.

See also: Gross Risk Score

The set of findings where the underlying technical condition still exists. Conceptually: Active + Accepted. Remediated and False Positive are excluded.

See also: Gross technical risk

AWS Identity and Access Management. The AWS service for users, roles, groups, policies and related authorization controls.

AWS service for centralized workforce access and permission sets across AWS accounts. Previously widely known as AWS SSO. Securitain uses the current AWS name in primary copy.

See also: IAM Identity Center

A Securitain view showing supported relationships between IAM and security objects. The graph answers what is connected — it does not automatically prove exploitability.

See also: IAM Relationship Graph

An AWS security principal or object that can receive or represent permissions. Examples: IAM user, IAM role, federated session context.

A Securitain analysis concept connecting supported principals and actions to sensitive data resources. It answers which identities can reach a supported data resource.

See also: Identity-to-Data Intelligence

The lowest current Securitain finding severity label, primarily used for informational context.

The security principle of granting only the access needed for the intended function. Securitain Least Privilege uses supported permission and usage evidence to identify review opportunities. Unused does not automatically mean unnecessary.

See also: Least Privilege

A credential that persists until rotated, deactivated or revoked rather than expiring automatically. IAM access keys are a common example.

An IAM policy managed as a standalone policy object and attached to supported identities. Can be AWS managed or customer managed.

Multi-factor authentication. Primarily relevant to interactive human authentication. Do not apply human MFA expectations blindly to workload roles.

The default active finding status indicating the finding is currently actionable and investigable.

See also: Open status

A hierarchical container in AWS Organizations used to group AWS accounts.

See also: AWS Organizations & SCPs

An assessment that produced some usable data but did not complete all intended capabilities. Partial does not mean passed.

An active finding status indicating an approval-related workflow is pending.

See also: Pending Approval status

An active status indicating a fix is believed to be applied but has not yet been verified by a successful capable scan.

See also: Pending Verification status

An IAM managed policy that limits the maximum permissions available to an IAM user or role. A boundary does not grant permission.

See also: Permission Boundaries

An IAM Identity Center definition used to assign AWS permissions to workforce users or groups in target AWS accounts.

A Securitain dry-run analysis that shows which IAM actions would be added, removed or unchanged for a specific identity if a proposed policy change were applied. It does not execute the change and does not mean the change is safe to apply — it is a permission diff to inform the human decision.

See also: Policy Impact Preview

An identity or entity that can participate in an AWS authorization or trust relationship. Examples: IAM user, IAM role, AWS account, federated principal, service principal.

A security path where an identity uses existing capabilities to obtain stronger permissions or access.

See also: Privilege Escalation & Attack Paths

A resource, service or capability that blast-radius analysis represents as reachable from a specific identity, based on the IAM relationship graph and supported data. Reachable does not mean the target was reached or that access is proven. Each result carries a completeness indicator (complete, partial, unknown) and a confidence level (high, medium, low).

See also: Reachable targets, Confidence, Data completeness

Securitain's customer AWS assessment model designed around non-mutating AWS read, list, get, describe and simulation operations. The current scanner does not require standing customer AWS write authority.

See also: Security Model, Coverage & Limitations

A privilege escalation or attack path detected in the same analysis scope as a finding but not attributed to the specific resource named in the finding. Related privilege paths are not resource-specific — they indicate a privilege concern present in the same identity or policy context.

See also: Finding evidence and permission sources, Privilege Escalation & Attack Paths

A closed finding status set when a successful capable scan verifies the original condition is absent.

See also: Remediated status

Guidance or workflow for changing the technical condition that created a finding. Current Securitain remediation is customer-controlled manual guidance.

See also: Remediation

A policy attached to an AWS resource that can grant or restrict access directly at the resource. Examples: S3 bucket policy, KMS key policy, SQS or SNS policy.

See also: Resource Policies

A numeric Securitain prioritization indicator used in certain product areas. A risk score is not necessarily finding severity and is not probability of compromise.

See also: Entity Risk Score

The IAM role policy that identifies which principals can participate in assuming the role. Trust does not automatically prove successful role assumption.

See also: Trust Policies

A point-in-time Securitain assessment of supported AWS security information.

A group of account-level scan runs triggered together, such as Scan All Accounts.

See Data freshness.

Service Control Policy. An AWS Organizations permission guardrail applied to organization roots, OUs or accounts. An SCP does not grant permission — it constrains what is available.

See also: AWS Organizations & SCPs

The customer or team tenant scope inside Securitain. Do not confuse with an AWS Organization.

An AWS action classified as security-relevant or high-consequence under Securitain's supported taxonomy. Sensitive does not automatically mean exploitable.

See also: Sensitive Permissions

Evidence-based classification, encryption status and public-exposure indicators collected for a data resource. The context is derived from collector evidence only — absence of context data does not mean the resource is not sensitive. Sensitive resource context does not modify the resource's raw technical risk score.

See also: Sensitive resource context, Data Security overview

See Finding severity.

AWS Security Token Service. Securitain uses STS AssumeRole to obtain temporary credentials for customer-controlled AWS assessment roles.

A temporarily accepted or deferred finding status. Suppressed findings leave the immediate active work queue but remain part of gross technical risk.

See also: Suppressed status

A supported combination of permissions that creates a more dangerous capability when the actions are held together. Not every toxic combination is a privilege-escalation path.

See also: Toxic Permission Combinations

See Role trust policy.

A scan-based process used to confirm whether a finding condition still exists after the customer attempts remediation. Verification drives the transition from Pending Verification to Remediated or Open.

See Active work queue.