Scanner terms describe steps in one pipeline. Inventory lists components, matching compares them with advisories, enrichment adds context, triage decides what to do, and remediation fixes it. This glossary gives each term a one sentence definition and shows where it sits, so reports and vendor pages become easier to read.
Glossary
| Term | Plain definition |
|---|---|
| Inventory | The list of components in a project or image |
| SBOM | A software bill of materials: a formal, shareable inventory |
| Package URL (purl) | A standard URL-style identifier for a package, independent of ecosystem |
| Advisory | A published record of a vulnerability and the versions it affects |
| Alias | Another database's identifier for the same vulnerability |
| Affected range | The versions an advisory says are vulnerable, built from introduced and fixed events |
| Match | A decision that a component version falls in an advisory's affected range |
| False positive | A reported finding that is not actually a problem |
| False negative | A real problem the scan did not report |
| Enrichment | Extra facts attached to a finding, such as scores and fix versions |
| CVSS | A framework for scoring severity |
| EPSS | A daily probability estimate of exploitation in the next 30 days |
| KEV | CISA's catalog of vulnerabilities with evidence of exploitation |
| Reachability | Whether your code can actually call the vulnerable code |
| Triage | Deciding, for each finding, to fix, defer, accept or dismiss |
| VEX | A statement about whether a vulnerability is exploitable in a given product |
| Baseline | A previous scan used to label results new, unchanged or absent |
| Gate | A rule that passes, warns or blocks a change based on findings |
| Remediation | The act of fixing, usually by upgrading or replacing a component |
Terms people confuse
SBOM versus scan report. An SBOM lists what is in the software. A scan report lists what is wrong with it. One feeds the other.
CVSS versus EPSS versus KEV. CVSS describes how severe a flaw is, EPSS estimates how likely exploitation is, and KEV records that exploitation has been seen. FIRST notes that EPSS lacks environmental context, and public CVSS data is typically Base only.
Advisory versus CVE. A CVE is one kind of identifier. An advisory is the full record, and it can have several identifiers. The OSV schema captures this with an aliases field.
VEX versus advisory. An advisory says a component version is affected. CycloneDX describes VEX as conveying whether a vulnerability in a component can actually be exploited in the context of the product that uses it. A VEX statement can say "not affected" even when an advisory says "affected".
Triage versus prioritization. Prioritization orders the work. Triage decides what the work is for each item. They overlap, and many tools run them together.
How the terms fit together
inventory -> match -> enrich -> prioritize -> triage -> remediate -> rescan
The loop closes with a baseline: the rescan is compared with the previous run to show what is new and what is gone.
Try it yourself
Click through it at your own pace, or open it full screen.
Find the components, their versions and identifiers, which are the raw material for every term above.
Where Safeguard fits
Safeguard covers this pipeline with SBOM and dependency scanning, reachability analysis, policies and gates, and fix pull requests that stay off until you enable them. Try the free scan.
Quick check
Is an SBOM the same as a vulnerability scan?
No. An SBOM is an inventory of components. A scan compares that inventory with advisory data to find problems.
What is the difference between match and finding?
A match is the raw comparison result. A finding is a match after enrichment and checks, ready for a person to act on.
Sources
- OSV schema specification
- FIRST EPSS FAQ
- CISA Known Exploited Vulnerabilities catalog
- CycloneDX VEX capability
- Package-URL (purl) specification
Last reviewed: 19 October 2026.
