Reference library

Terms used in AI penetration testing evaluations

Answer in brief

These definitions explain how the reference uses its core vocabulary. Each term links to the page where it changes an evaluation decision. The sources register identifies the primary technical guidance and company descriptions behind the articles.

A topic reference. The featured-service relationship and evaluation criteria are described in our methodology.

AI-assisted testing

AI contributes to planning, interpreting, or executing an authorized security assessment. The label does not establish how much access the system has or whether it can act without a person's approval. See the category guide.

Assessment target

The application, interface, workflow, or AI component being examined. AI may be the testing method, the target, or both; these scopes need different questions. See choosing a tester.

Execution boundary

The permitted actions, identities, destinations, and time window, together with controls that enforce those limits. A written intention and an enforced restriction are different evidence. See execution boundaries.

Authentication and authorization

Authentication establishes an identity or session. Authorization determines whether that identity may perform a particular action on a resource. A valid login does not imply permission for every operation. See finding evidence and the linked OWASP guidance.

Hypothesis and finding

A hypothesis is a condition worth investigating. A finding is a claim supported by the evidence required for review. Retain an unresolved hypothesis when the relevant action or target outcome has not been established; do not silently promote it into a verified vulnerability.

Authoritative outcome

The application's record of the resulting behavior or state. It may differ from a response message or the testing agent's summary, particularly in an asynchronous workflow. See finding evidence.

Incomplete coverage

A relevant area was not assessed under usable conditions. An unreachable route, expired session, or failed tool does not establish that the application passed a check. See the evaluation checklist.

Retest

A comparable check of the relevant rule after a change. It records both the forbidden behavior and the intended permitted behavior, with meaningful differences in configuration or identity explained. See retesting.

Acceptance criterion

The observable result and evidence needed for the responsible reviewer to accept an evaluation or repair. Define it before interpreting a supplier's preferred result label. See the trial brief.

Continue this reading path

Category guide Featured provider Execution boundaries Resource directory

Cite this entry

AI Penetration Tester. “Terms used in AI penetration testing evaluations.” Reviewed November 12, 2026.
https://aipenetrationtester.com/glossary/