What do the common application security acronyms mean?

Most application security acronyms fall into three groups: names for problems (CVE, CWE), ways to rank them (CVSS, EPSS, KEV), and methods or frameworks for finding and preventing them (SAST, DAST, SCA, SBOM, SSDF, SLSA). Here is each one in a sentence or two, and how they fit together.

Which acronyms name a problem?

CVE stands for Common Vulnerabilities and Exposures. A CVE is an identifier, such as CVE-2021-44228, for one specific publicly disclosed vulnerability in specific software. The program that assigns them is described at cve.org.

CWE stands for Common Weakness Enumeration. A CWE is a category of flaw, such as improper input validation, that can show up in many products. One CWE can sit behind thousands of CVEs. If a CVE is a specific bug, the CWE is the type of mistake.

Which acronyms rank how bad it is?

CVSS is the Common Vulnerability Scoring System, maintained by FIRST. It gives a vulnerability a severity score from 0 to 10 based on traits such as how it is attacked and what it affects. It measures severity in general, not how likely it is that someone will attack you.

EPSS is the Exploit Prediction Scoring System, also from FIRST. It estimates the probability that a vulnerability will see exploitation activity in the next 30 days. It answers a different question from CVSS: how likely, not how bad.

KEV is the Known Exploited Vulnerabilities catalog, kept by CISA. It lists vulnerabilities with evidence of active exploitation. Binding Operational Directive 22-01 requires US federal civilian agencies to fix listed items by set deadlines, and many private teams use the list as a priority signal.

A constructed example of using all three. A scanner reports two flaws. Flaw A has CVSS 9.8, EPSS near zero and is not in KEV. Flaw B has CVSS 7.5, high EPSS and is in KEV. Most teams fix B first, because exploitation is documented.

Which acronyms describe methods of finding flaws?

SAST, static application security testing, examines source code without running it. DAST, dynamic application security testing, probes a running application from the outside. SCA, software composition analysis, inventories the open source and third party components in an app and matches them to known vulnerabilities. IAST, interactive application security testing, watches the app from inside while tests run.

Each sees a different slice. SAST finds patterns in your code. DAST finds issues visible only at run time. SCA finds problems you inherited.

Which acronyms describe records and frameworks?

SBOM is a software bill of materials, a nested list of the components that make up a piece of software. CISA publishes guidance on SBOM and its minimum elements.

VEX is the Vulnerability Exploitability eXchange. It is a statement from a supplier that says whether a product is actually affected by a given vulnerability. It cuts noise, since a vulnerable library may not be used in a vulnerable way.

SSDF is NIST's Secure Software Development Framework, SP 800-218, a set of practices for building secure software.

SLSA, pronounced salsa, stands for Supply chain Levels for Software Artifacts. It is a framework for build integrity and provenance.

ASVS is the OWASP Application Security Verification Standard, a list of testable security requirements for web applications.

How to check or apply this

1. Pick one scanner finding in your backlog and note its CVE, CWE and CVSS score.
2. Look up its EPSS score and check whether it is in the KEV catalog.
3. Decide whether it is reachable in your code, and record the decision.
4. Generate an SBOM for one application and read the top level components.
5. Map your current tests to SAST, DAST, SCA and IAST, and mark what is missing.
6. Share this list with new hires so the team uses the same terms.

Quick check

Sources

1. CVE Program
2. CWE, Common Weakness Enumeration
3. FIRST, Common Vulnerability Scoring System
4. FIRST, Exploit Prediction Scoring System
5. CISA, Known Exploited Vulnerabilities Catalog
6. CISA, BOD 22-01
7. CISA, Software Bill of Materials
8. NIST SP 800-218, SSDF
9. SLSA
10. OWASP ASVS

Last reviewed: 18 October 2026.