Reference

Glossary

Every definition below points back to the platform page that implements it. Nothing here is broader than what that page already claims.

Findings, lifecycle and policy

Finding: One vulnerability, in one package, in one scanned artifact. A finding's identity is derived from its content — never from severity, installed version or report position — so it survives a rescan, a re-rating, or even a change of scanning engine.
Finding lifecycle: The state machine a finding moves through: open, triaged, suppressed, resolved, reopened. Every transition writes to an append-only timeline naming the kind of actor responsible — a person, a scan, a scheduled task, or an API key.
Triage / Triaged: The state a finding enters once someone has read it and accepted it into the backlog, distinct from having decided anything about it yet.
Suppression: A recorded decision to accept a risk, with a required reason, an owner, and an expiry of at most two years. A suppressed finding still appears in every policy verdict as a warning by default — suppressing is not the same as making a finding disappear.
Resolved: The state meaning a scan that would have found this vulnerability did not. Resolution can only be produced by evidence from a rescan — no person can mark a finding resolved by hand.
Reopened: The state recording that a finding was fixed once and came back. It stays permanently distinguishable from a finding that was never fixed, so a regression cannot quietly disappear from the record.
Policy (in TRUSTIVAN): A declarative, versioned rule set — conditions on severity, finding kind, lifecycle status, fixability, advisory identifier, age and match count, each rule carrying exactly one effect: fail, warn or ignore. There is no embedded expression language and no customer-supplied code to evaluate.
Verdict: The recorded, immutable output of evaluating a policy against a set of findings at a point in time: pass, warn or fail, plus the reasoning behind it. Verdicts are append-only and replayed rather than recomputed on a repeat request.
Fixability: Whether a fixed version of the vulnerable package is available, used as a policy condition — a rule can, for example, fail only on findings that are both critical and fixable.

Container and vulnerability scanning

Container image scanning: Pulling a container image from its registry — public, or private with a stored credential — and analysing its packages for known vulnerabilities. The scanner asks for no Docker socket and no container runtime, and never touches the build host.
SBOM (Software Bill of Materials): A structured inventory of the packages and components inside a piece of software. TRUSTIVAN both generates an SBOM as a scan output and can accept an already-produced SBOM as its own scan target.
CVE / Advisory: A published vulnerability record (a CVE identifier, or a vendor advisory) that a scanner matches against the packages it finds in an image, a repository or an SBOM.
Repository scanning: Analysing a source repository directly for known vulnerabilities in its declared dependencies, as a scan target alongside container images and SBOMs.
Known-exploited vulnerability: A vulnerability enriched with evidence that it has been observed exploited in the wild, distinct from — and not to be confused with — reachability analysis, which asks whether the vulnerable code path is actually called by your application.

Non-human identity and AI agent security

Non-human identity (NHI): Any credentialed identity that is not a person: a cloud IAM role, a Kubernetes service account, a CI/CD robot, an API key, or an AI agent acting on a system's behalf. In most estates these outnumber human accounts.
Service account: A non-human identity created for a system or automation to authenticate as, rather than for a person. Kubernetes ServiceAccounts are non-human by construction, which is why TRUSTIVAN's Kubernetes connector can inventory them without guessing.
AI agent (in the NHI sense): An automated actor whose action against a system TRUSTIVAN NHI Security can authorize at runtime, once that agent already exists in its inventory. NHI Security authorizes agents it has been told about; it does not discover agents on its own.
Runtime authorization (for agents): The decision — allow, challenge or deny — made when an inventoried AI agent attempts an action, evaluated against declared tool entitlements and runtime rules, and recorded immutably.
Just-in-time (JIT) access: A temporary access grant, bounded at seven days in TRUSTIVAN, where the person requesting it cannot also be the one who approves it.
Quarantine (identity): A reversible action that restricts what an identity — human-controlled or non-human — can currently do, used when an identity is under investigation without permanently revoking it.

Platform and API

API key / Machine credential: A credential for a caller that is not a person. It is shown once at creation and never readable again, carries a mandatory expiry (a year at most), and has no inherited authority beyond the scopes explicitly granted to it.
Scope (API key scope): One specific permission grantable to an API key. Certain scopes — minting new keys, managing policies, managing webhooks — cannot be held by any key, regardless of who created it, because a credential able to grant itself more power or rewrite the rules it is graded against defeats the point of scoping.
Idempotency key: A caller-supplied key that reserves a request before any work happens, so two concurrent retries cannot both execute it. A completed request replays its stored response verbatim on a repeat.
Signed cursor: An opaque, signed pagination token used instead of a numeric offset, which is unreliable under concurrent writes. Every paginated response states whether traversal through it is exhaustive.
Webhook: An HTTP callback TRUSTIVAN sends when one of a fixed set of events occurs (scan completion, a verdict, a finding state change), signed with a rotatable secret and announced only from inside the transaction that caused it.
Tenant isolation / Row-level security (RLS): Database-enforced separation between organizations' data, using PostgreSQL row-level security policies rather than relying on application code to remember to filter every query by tenant.