Source: https://sprinto-test.docs-staging.pageloop.ai/data-library/vulnerabilities/glossary

# Glossary

This glossary defines key terms used throughout the _Vulnerabilities_ section in Sprinto. Use it as a reference to better understand the terminology related to vulnerability management, compliance, and evidence tracking.

| Term                              | Definition                                                                                                                                                                     |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Vulnerability**                 | A flaw or weakness in a system that could be exploited to compromise security, such as unpatched code, misconfigurations, or exposed endpoints.                                |
| **Pentest** (Penetration Test)    | A security test conducted by a certified external party to identify vulnerabilities in a product or infrastructure.                                                            |
| **Monitoring Source**             | An integrated tool or service that detects vulnerabilities and sends findings to Sprinto (e.g. AWS Inspector, GitLab, SonarCloud).                                             |
| **System-status Check**           | An automatic compliance check triggered when a vulnerability is detected by an integrated source. It is resolved automatically when the vulnerability is closed at the source. |
| **Workflow Check**                | A manual compliance check that must be configured by the user. It requires periodic action and evidence submission.                                                            |
| **SLA (Service Level Agreement)** | A predefined time window within which a vulnerability must be resolved. SLA tracking ensures timely remediation and compliance.                                                |
| **Evidence**                      | Documentation (such as scan reports, screenshots, or logs) uploaded to confirm completion of a workflow check or remediation activity.                                         |
| **Special Case**                  | A designation for vulnerabilities that are not applicable or cannot be resolved. Marking a special case prevents check failure while retaining audit visibility.               |
| **Due/Critical/Failing**          | Status indicators for system or workflow checks. A check becomes _Critical_ as the SLA approaches expiry and _Failing_ once overdue.                                           |
| **Passing**                       | Indicates that a vulnerability has been resolved or a check has been successfully completed with valid evidence.                                                               |
| **VPAT**                          | Vulnerability and Penetration Assessment Test. A certified pentest report uploaded to Sprinto as part of regular compliance.                                                   |