# Glossary This glossary defines key terms used throughout the *Vulnerabilities* section in Sprinto. Use it as a reference to better understand the terminology related to vulnerability management, compliance, and evidence tracking.

Term	Definition
Vulnerability	A flaw or weakness in a system that could be exploited to compromise security, such as unpatched code, misconfigurations, or exposed endpoints.
Pentest (Penetration Test)	A security test conducted by a certified external party to identify vulnerabilities in a product or infrastructure.
Monitoring Source	An integrated tool or service that detects vulnerabilities and sends findings to Sprinto (e.g. AWS Inspector, GitLab, SonarCloud).
System-status Check	An automatic compliance check triggered when a vulnerability is detected by an integrated source. It is resolved automatically when the vulnerability is closed at the source.
Workflow Check	A manual compliance check that must be configured by the user. It requires periodic action and evidence submission.
SLA (Service Level Agreement)	A predefined time window within which a vulnerability must be resolved. SLA tracking ensures timely remediation and compliance.
Evidence	Documentation (such as scan reports, screenshots, or logs) uploaded to confirm completion of a workflow check or remediation activity.
Special Case	A designation for vulnerabilities that are not applicable or cannot be resolved. Marking a special case prevents check failure while retaining audit visibility.
Due/Critical/Failing	Status indicators for system or workflow checks. A check becomes Critical as the SLA approaches expiry and Failing once overdue.
Passing	Indicates that a vulnerability has been resolved or a check has been successfully completed with valid evidence.
VPAT	Vulnerability and Penetration Assessment Test. A certified pentest report uploaded to Sprinto as part of regular compliance.