Glossary
Key terms used in the web interface and this documentation
Selected Scan / Current Scan
Target environments are enumerated through periodic or on-demand scans. The web interface displays data only from the currently selected scan. Users can switch between scans using the Scan selector at the bottom of the left navigation bar. Before analyzing results, ensure that the correct scan is selected. See Navigating the Interface.
Compared Scan
The Dashboard and Issues pages can compare the selected scan with an older scan chosen in the Compare selector, showing what has changed between the two.
Risk / Risk Score
Risk scores are calculated for scans and objects based on multiple metrics and categories. These scores represent the relative security risk of objects or scans within the analyzed environment.
Scans are also scored per scope (for example per domain). Dashboard shows them in Risk by scope. Each scope is scored on its own findings, so scope scores do not add up to the scan score.
Exposure Score / Exposure Point
The Exposure Score shows how exposed the environment is through the findings of the selected scan. It is shown on the Dashboard, and as Exposure Point on issues, objects, impacts and scans.
Provider
A provider is a type of environment that can be scanned: Active Directory, Azure (Entra ID, Azure Resource Management, Microsoft Teams and SharePoint Online), AWS, GCP (including Google Workspace) or GitHub. A scan can include one or more providers.
Object / Entity
The term Object or Entity refers to identity, security, or configuration objects within a supported environment analyzed by Forestall. The scan enumerates and analyzes different object types depending on the environment being scanned.
Relation
The term Relation refers to the connections between objects within an environment as identified and analyzed by Forestall.
Relations represent how one object can affect, control, or gain influence over another object. The scan enumerates and analyzes various types of relations depending on the environment being scanned.
Risky
Risky objects are objects with a risk score greater than 50.
The Risky classification highlights objects that represent a higher security risk within the analyzed environment based on calculated risk metrics.
Issue
An Issue represents a vulnerability, misconfiguration, dangerous privilege, or relationship that can pose a security risk within an environment analyzed by Forestall.
Issues highlight conditions that may lead to privilege escalation, lateral movement, or compromise of critical objects.
Tag
Tags are labels attached to issues to categorize, group, and simplify the understanding of identified security risks.
Tags help organize issues based on their characteristics, affected components, or security themes.
Impact / Forestall Impact Name
Impact (Forestall Impact Name) is a special classification attached to issues to describe their potential effect on the security posture of the environment.
It indicates what type of damage or control an issue may enable if exploited.
Severity
Severity represents the risk level of an issue based on its potential impact and likelihood.
Forestall classifies severity as:
Info
Low
Medium
High
Critical
Ease of Mitigation
Ease of Mitigation indicates the level of effort required to remediate or mitigate an issue.
Ease of Detection
Ease of Detection indicates the level of effort required to detect the exploitation or abuse of an issue.
Ease of Deception
Ease of Deception indicates the level of effort required to implement deceptive countermeasures related to an issue.
Exploitation Privilege
Exploitation Privilege refers to the level of permission or access an attacker must have in order to exploit a specific issue.
This may include standard user access, elevated privileges, or administrative permissions.
Exploitation Certainty
Exploitation Certainty indicates the likelihood that an issue can be successfully exploited based on technical feasibility and environmental conditions.
Path / Attack Path
An Attack Path represents a sequence of relationships that allow one object to compromise or control another object.
Attack paths are identified by analyzing how relationships between objects can be chained together to achieve higher privileges or broader impact.
Dangerous Path
A Dangerous Path is a type of attack path in which lower-privileged objects can ultimately compromise higher-privileged or critical objects through a combination of relationships.
Tier 0 / Tier 2
Tier 0 objects control the whole environment of a provider, such as Domain Admins in Active Directory or Global Administrator in Entra ID. Every object that is not Tier 0 is labeled Tier 2. How each provider assigns Tier 0 is described in the provider glossaries below. Dashboard lists the most exposed and the most dangerous ("blasting") Tier 2 identities.
Shadow Admin
An object that is not a member of an administrative group or role, but can take control of a Tier 0 or admin object through an attack path. On object lists it is marked with a Shadow badge.
Choke Point
An object that many attack paths towards Tier 0 pass through. Removing the dangerous relationships of a choke point cuts many paths at once. Choke points are shown in Tier0 Analysis.
Unified Identity
A single identity that groups the objects of the same person, workload or resource across providers, for example an Active Directory user and its synchronized Entra ID user. Unified identities are listed as Human Identities, Non Human Identities, Resources and Group under Unified Identities.
Merge Rule
A matching rule that decides which objects are combined into one unified identity, for example by email address or by the on-premises SID of a synchronized account. Merge rules are enabled or disabled in Settings > Merge Rules.
Remediation Scan Status
A Remediation Scan re-checks selected findings of a scan. Each re-checked object gets one of these statuses:
Resolved: the finding no longer occurs.
Unresolved: the finding still occurs.
Unverified: the check could not be evaluated, so the finding was not re-tested.
Last updated
Was this helpful?