Glossary

This page explains the terms you meet in Soveryne, in alphabetical order. Each entry links to the page that explains the term in full.

Active reconnaissance. ATLAS scanning that sends traffic to your systems, such as port scans and service checks. ATLAS runs it only for scope you have proved you own and only while a signed mandate is on file. See ATLAS scans.

Adversary. A threat group, such as an APT group, described in SPECTER with its country, motive, targeted sectors and the techniques it uses. See SPECTER threat intelligence.

Approver. In BAIT, a person on your programme team who is marked as allowed to approve campaigns. Nobody can approve a campaign they created. See BAIT campaigns.

Asset. Something your organisation owns or runs, such as a server, an application or a cloud resource. Every asset lives in the shared asset register in MESH, and you manage it in Command under Assets. See Command assets.

Attack path. In ATLAS, a route from the internet, hop by hop, to one of your crown jewels. See Findings and attack paths.

Attestation. In ATLAS, a record by an administrator that ownership of a domain, address or range was proved outside DNS, for example in a signed scope document. The posture report shows who attested. See Scope and consent.

Audit log. Command's record of who changed what and when. See Audit log.

Campaign. In BAIT, one phishing simulation: a goal, the groups who receive it, the simulated email and a schedule. Every campaign moves through the same stages: Draft, Awaiting approval, Scheduled, Live and Completed, and it can be Paused. See BAIT campaigns.

Connected source. A cloud, directory or CMDB that MESH imports from, such as Microsoft Azure, Microsoft Entra, Amazon Web Services, Google Cloud, Google Workspace or ServiceNow. MESH only reads from it and never writes back. See Connecting sources.

Content language. The language a Command workspace uses for AI-written drafts and chat answers, and the language people start in. An Admin sets it. See Command settings.

Context entity. In MESH, something that matters to your organisation but is not imported, such as a team, a business service or an office. An administrator adds it by hand to give your assets business context. See MESH.

Control. A security measure your organisation commits to, written as a short document in Command, for example on access management or backups. A control has a stage (Draft, In review, Active or Published), a risk level, framework mappings, evidence and an implementation score. See Controls.

CPE. A standard way to name a product and version, such as a particular release of a web server. In SPECTER you can search the CVE catalogue by CPE to find the vulnerabilities that apply to a product. See SPECTER CVEs.

Criticality. How much it would hurt your organisation if an asset failed or were compromised, from Low to High (Command also offers Critical). A person always sets it; an import or a scan never changes it. See Command assets.

Crown jewel. An asset your organisation cannot afford to lose. ATLAS ranks attack paths by whether they lead to a crown jewel. You mark crown jewels on the ATLAS map, and Command shows the mark on the asset. See ATLAS map.

Cut point. On an ATLAS attack path, the hop where fixing one issue removes the whole path. See Findings and attack paths.

CVE. A publicly listed vulnerability with its own identifier, for example CVE-2021-44228. SPECTER lets you look up any CVE, and ATLAS uses the same catalogue to add CVE details to its findings. See SPECTER CVEs.

Data Protection Officer. In BAIT, the named person whose approval is needed before anyone can identify the individual behind a result. Until one is named, every reveal request is refused. See BAIT setup.

Department. A group of people in Command, such as Finance or IT. Departments decide who receives a published policy and who can be sent an evidence request. See People and departments.

Enrolment. Switching a framework on in Command, so that your controls are tracked against it and it appears in gap analysis. See Frameworks.

Evidence. A document that shows a control works in practice, such as a signed policy, meeting minutes or a configuration export. See Evidence.

Evidence check. An AI review of one evidence file against its control, started with Check as auditor. The verdict is Sufficient, Incomplete, Rejected or Not readable. It advises; it does not block anything. See Evidence.

Evidence request. A request from Command to a person or a department for evidence for a control. The recipient answers it in Counsel under Knowledge › Requests, and the requester accepts it or sends it back. See Evidence requests in Counsel.

Finding. In ATLAS, a weakness found on one of your hosts, such as a known vulnerability or a configuration problem. A finding is Open, ticketed, Risk accepted or Fixed. See Findings and attack paths.

Framework. A standard, law or baseline your controls are measured against, such as ISO/IEC 27001, NIS2 or BIO2. Command's frameworks come from SAGE. See Frameworks.

Gap analysis. A view in Command that shows which clauses of an enrolled framework have no control mapped to them yet. See Frameworks.

Identity reveal request. In BAIT, a separate, audited request to identify the person behind a result. It needs a Data Protection Officer on file. See BAIT people and reports.

Implementation score. A percentage on each Command control that shows how far it is implemented: whether it is written, mapped, scoped, approved and backed by evidence that holds up. Command calculates it; nobody types it. See Controls.

Incident. In Command, a confirmed security incident. It moves through Triage, Contain, Eradicate, Recover and Lessons, and can carry reporting clocks. See Incidents.

Intrusive testing authorisation. In ATLAS, a separate, time-limited permission for tests that go beyond observation, such as login attempts. It names the hosts it covers and lasts at most 90 days. The scanning mandate never covers it. See Scope and consent.

Investigation. In Command, a case for a signal you are looking into. It has no reporting clocks. It becomes an incident only when you decide it is one. See Incidents.

Known exploited vulnerability (KEV). A vulnerability on the public list of vulnerabilities known to be exploited in the wild. SPECTER shows whether a CVE is on this list, and ATLAS always reports such a vulnerability as a finding. See SPECTER CVEs.

Launch code. A one-time code from an ATLAS administrator that verifies a domain without a DNS change. It expires after 15 minutes and works once. See Scope and consent.

Mandate. The signed authorisation for ATLAS to scan your systems actively, recorded with the name and role of the signatory. Without it, ATLAS refuses every active scan. See Scope and consent.

Passive reconnaissance. ATLAS research that reads only public records, such as DNS, and sends nothing to your systems. It can run before ownership is proved. See ATLAS scans.

Policy document. A policy Command drafts from your controls, your frameworks and your organisation profile, in Dutch and English. Once approved, you publish it to your staff in Counsel. See Policies.

Programme team. The few people who design, approve and report on your BAIT campaigns. They are the only people who use BAIT. See BAIT.

Published. A control that is part of your live set in Command. A policy document is published when it is sent to your staff in Counsel. See Controls and Policies.

Receiving domain. A domain your staff receive email on. BAIT sends simulations only to addresses on receiving domains you have proved you own with a DNS record. BAIT lists them under Settings › Sending domains. See Domains.

Relationship. In MESH, a link between two records, such as "depends on" or "located in". Each relationship has a business, technical or physical context. See MESH.

Reporting clock. A countdown on a Command incident to a reporting deadline, named after the regulation it relates to, or one you define yourself. See Incidents.

Review queue. The list of questions an import asks instead of guessing, for example whether two records are the same machine, or whether a large number of assets really disappeared. You answer them in Command. See Review queue.

Risk accepted. An ATLAS finding that a person has decided to accept rather than fix. ATLAS records who accepted it and when. See Findings and attack paths.

SAGE. The shared compliance knowledge base of standards and frameworks that Command and Counsel cite.

Scan scope. The domains, IP addresses and ranges ATLAS may examine for an organisation. A range can hold at most 256 addresses. See Scope and consent.

Scenario. In BAIT, a ready-to-send simulated email with the signs that give it away. Scenarios from Soveryne are reviewed and ready; one you write stays in review until a second person approves it. See BAIT scenarios.

Source health. SPECTER's view of when each intelligence source was last imported successfully. See SPECTER sources.

Technique. A method attackers use, as described by MITRE ATT&CK, for example spearphishing. SPECTER shows which adversaries and malware use each technique. See SPECTER threat intelligence.

Template pack. A ready-made baseline in Command, such as "SME — ISO 27001 starter". Applying a pack enrols its frameworks, drafts their controls and queues a policy document per grouping. Packs stack, and you can compose your own. The set-up wizard calls this step Template bundle. See Frameworks.

Users & roles. The Command window where an Admin invites people, changes their role and deactivates accounts. See Roles and permissions.