Orizon RECON glossary

This glossary collects the words you come across in Orizon RECON and your Orizon account. Each term is written exactly as the app shows it in English.

How to use this glossary

Terms are grouped by area: external scans, vulnerabilities, probes and internal scans, Active Directory, and account and billing. For step-by-step instructions, open the related articles at the bottom of the page.

The terms

External scans

• External scan: looks at what anyone can see from the internet, starting from a domain such as meccanicaadda.it: subdomains, IP addresses, exposed ports and services, technologies and vulnerabilities. Every domain scanned uses Cyber Tokens. New Mapping: the button that starts a new external scan.
• External Targets: the page where you save and manage your scan targets (a single domain, several domains or a group) so you can reuse them quickly.
• Attack Surface Map: the visual map linking the domain to its subdomains, IP addresses, ports, technologies and the vulnerabilities found.
• Asset Inventory: the list of every asset a scan discovered, with the status, technologies and ports of each host.
• Subdomains: the names below your main domain (for example portale.meccanicaadda.it) that the scan found.
• Technologies: the software detected on your hosts, such as web servers, frameworks and libraries, with the version when it is visible.
• Ports: the open network ports on a host and the services answering on them.
• Web Security: the tab that brings together HTTP Security (security headers), SSL/TLS Certificates, DNS Security (for example SPF, DMARC and DNSSEC) and Cookie Analysis.
• Risk: the industry risk tab, with a risk score from 0 to 100 (higher is better) and a grade from A to F. The score combines five factors: technical posture (30%), exposure (25%), typical risk for the industry (20%), company profile (15%) and proximity to recent breaches in the industry (10%). Recent Breaches: known breaches and ransomware attacks that hit companies in the same industry, shown as context.
• NIS 2: the tab that estimates whether the company falls under the NIS 2 directive and how it is classified: Essential Entity, Important Entity or Not Applicable, based on the industry and the company size (employees and revenue).
• Group: several companies or domains analysed together, for example Meccanica Adda and its subsidiary Adda Servizi. The group tabs show aggregated assets, vulnerabilities, NIS 2 and risk.
• Schedules: recurring scans, external or internal, set to Daily, Weekly, Bi-weekly, Monthly or Quarterly. Each run of a scheduled external scan uses Cyber Tokens per domain.

Vulnerabilities

• Vulnerabilities: known weaknesses, usually identified by a CVE code, linked to a piece of software or a service that was detected.
• Severity: how serious a vulnerability is: Critical High Medium Low Info
• CVSS: the standard 0 to 10 score for the technical severity of a vulnerability.
• EPSS: the probability, as a percentage, that a vulnerability will be exploited in the near term. RECON reads it from FIRST's public EPSS service and uses it for prioritization.
• KEV: the badge for a vulnerability listed in CISA's Known Exploited Vulnerabilities catalog, meaning it has already been exploited in real attacks. RECON also flags when it has been used in ransomware campaigns.
• False positive: you mark that a vulnerability does not actually apply to your system.
• Accepted risk: you mark that you know about the vulnerability and have consciously decided not to fix it for now.
• Resolved: you mark that the vulnerability has been fixed.

Probes and internal scans

• Probe: Scout, the small agent you install on a Linux computer in your network (with systemd, root or sudo access and 50 MB of free disk space). It runs internal scans and talks to RECON outbound only, over HTTPS on port 443: you do not open any inbound port. Internal Probes: the sidebar entry where you create, install and manage your probes.
• Internal scan: the scan the probe runs on its target networks. It finds devices, services and vulnerabilities that cannot be seen from the internet and, if configured, analyses Active Directory. It does not use Cyber Tokens: it uses the probe's license.
• API key: the credential the probe uses to identify itself to RECON. It is shown only once, so save it in your password manager.
• Re-issue install command: creates a new command with an install token that is valid for 24 hours and can be used only once. The probe's API key does not change.
• Probe statuses: Online when the last heartbeat arrived less than 90 seconds ago; Offline (recent) between 90 seconds and 5 minutes; Offline after 5 minutes; Never connected when the probe has not sent any heartbeat yet. Heartbeat: the signal the probe sends to RECON every 30 seconds to show it is alive.
• Target Networks: the networks, written in CIDR notation, that the probe scans.
• CIDR: a compact way to write a range of IP addresses. For example 192.0.2.0/24 covers the 256 addresses from 192.0.2.0 to 192.0.2.255. Subnet: a contiguous slice of a network defined by a CIDR. Devices in the same subnet talk to each other directly; reaching a different subnet requires a router.
• ARP: the protocol the probe uses to ask "who has this IP?" on the local network. It only works within its own segment and does not cross routers.
• Probe group: several probes managed together, with one group scan and a shared license. A device seen by two probes in the group counts only once.
• Network Topology: the interactive map of the network as the probe sees it: subnets, gateways, the probe host, hosts, open ports and applications.
• Internet-connected: a host that can reach the internet outbound. It does not mean the host is reachable from the internet.
• Exposed: a host that can be reached from the internet. RECON shows how certain the check is: Exposed (proven), Likely exposed, Possibly exposed or Exposure undetermined.

Active Directory

• Active Directory: the internal scan tab with the results collected from your domain, for example meccanicaadda.local: identities, misconfigurations, certificates, controls and attack paths.
• Provisioned read-only collector: the probe uses an administrator credential once to create a dedicated read-only account, then discards the administrator credential. The collector account is stored encrypted and reused in later scans. Read-only domain account: alternatively, you provide a domain account that only has read permissions.
• Tier-0: the most critical objects in the domain: privileged groups, all of their members (including indirect ones) and the domain controllers. Whoever controls Tier-0 controls the domain.
• Attack Paths: the chains of permissions and memberships through which a low-privilege account could reach a Tier-0 object.

Account and billing

• Cyber Tokens: the currency for external scans. 1 Cyber Token is worth 1 euro. A domain costs 90 Cyber Tokens at the end-user price and 50 Cyber Tokens at the partner price. When you sign up you receive 270 welcome Cyber Tokens, once per company. Token Bundles: the Cyber Token packages you buy in the Billing section of your Orizon account. Partner: the role reserved for Orizon partners, who pay for external scans at the partner price of 50 Cyber Tokens per domain.
• Probe License: the right to use a probe for 12 months on a set number of devices. The count covers the distinct devices the probe assessed in the last 90 days, excluding personal phones and tablets. You can buy tiers of 100, 500 and 1,000 devices; above that, you contact the sales team.
• Trial: the free 30-day trial with no device limit, available once per company and valid for a single probe.
• Over capacity: the probe sees more devices than the license covers. You have 30 days to add capacity; after that, new scans pause, but existing results stay available.
• Two-Factor Authentication: a second sign-in factor using a time-based code from an authenticator app (TOTP).
• Passkeys: passwordless sign-in with your device's fingerprint, face or PIN.
• Connected Apps: the applications you have authorized to access your Orizon account. You can disconnect them at any time.
• Personal access tokens: bearer tokens for calling the RECON API from scripts, CI pipelines and integrations. The full token is shown only once: RECON stores only its hash.
• Generic Webhook: the integration that forwards scan events to any HTTPS endpoint.
• Owner, Admin, Member: the roles in an Orizon company. The owner and admins can invite new people.

Related articles