Glossary

Plain-language definitions of the terms and acronyms used across this guide. Where a term has its own page, the entry links to it.

Editions & licensing

EndpointOps is sold in tiers. Higher tiers include everything in the ones below them, so a feature that "requires ZiroXpose" also works on EndpointOps.

From the most basic to the most complete:

Edition	Roughly covers
ZiroPatch	Core patching.
ZiroPatchPlus	Patching plus more patch-management capability.
ZiroXpose	Adds exposure/visibility modules — for example FIM and Browsers inventory.
EndpointOps	The full platform, including Device Control, DEX, and Endpoint Vital.

A page that says "requires the EndpointOps edition" or "ZiroXpose edition" is telling you the lowest tier that unlocks it. Your current plan is shown under Settings → Platform License; plans are assigned per tenant under Tenants.

Security & vulnerability terms

• CVE (Common Vulnerabilities and Exposures) — a public ID for a specific known security flaw, e.g. CVE-2024-1234.
• CVSS (Common Vulnerability Scoring System) — a 0–10 severity score for a CVE. Higher is worse. You may see CVSS v2, v3, or v4.
• EPSS (Exploit Prediction Scoring System) — the probability (0–100%) that a CVE will be exploited in the wild in the near term. Use it to prioritise likely attacks, not just severe ones.
• CISA KEV (Known Exploited Vulnerabilities) — the U.S. CISA catalog of CVEs that are already being exploited. "Exploitable / CISA" flags mean a fix is urgent.
• Zero-day — a vulnerability being exploited before a vendor patch exists.
• ZiroScore — EndpointOps's own blended risk score for a vulnerability or endpoint. It combines signals such as CVSS severity, EPSS probability, and known-exploited status into one number so you can act on the highest score first.
• MITRE ATT&CK — a public knowledge base of attacker techniques; referenced for context on how a vulnerability could be abused.
• CWE (Common Weakness Enumeration) — the type of underlying coding weakness behind a CVE.
• KB / KB article — a Microsoft Knowledge Base ID for a patch, e.g. KB5034123.

Endpoints & agent

• Endpoint — a managed computer (laptop, desktop, or server) running the agent.
• Agent — the small program installed on an endpoint that reports data and carries out actions. See Enrolling an Endpoint.
• Enrollment — installing the agent and connecting a machine to EndpointOps.
• Enroll secret — a token that ties a newly enrolled endpoint to the right department. See Enroll Secret.
• Agent approval — an optional gate where new endpoints wait until an administrator approves them. See Agent Approvals.
• SBOM (Software Bill of Materials) — the inventory of all software found across the fleet, one row per software/version. See SBOM.
• EOS / EOL — End of Support / End of Life: the date a software version stops getting fixes (EOS) or is fully retired (EOL).
• DEX (Digital Employee Experience) — a 0–100 score for how good the computing experience is on an endpoint (boot speed, crashes, app launch times, Wi-Fi, battery). See DEX Summary.
• FIM (File Integrity Monitoring) — watches chosen files, config files, and registry keys and records when they change. See FIM Configuration.
• BitLocker — Windows full-disk encryption. EndpointOps stores the recovery key needed to unlock a drive if a user is locked out. See Recovery Keys.
• TPM — a hardware security chip BitLocker uses to protect encryption keys.

Deployment terms

• Scope — the set of endpoints an action targets. You usually pick a filter (department, location, all computers) and optionally specific endpoints. The same Scope picker appears on deployment, policy, exception, and widget forms.
• Deployment Policy — the rules for how and when a deployment runs: immediately or on a schedule, retry behaviour, and how reboots are handled. You choose one on every deploy form. See Deployment Policies.
• Computer group — a named, reusable set of endpoints used for patch targeting and test rings. See Computer Groups.
• Catalog — the library of software (App Catalog) or configurations (Config Catalog) you can deploy.
• Bundle — several catalog items grouped so they deploy together.
• Test & Approve — rolling a patch to a small test group first, then approving it for the wider fleet. See Patch Test & Approve.
• Autonomous deployment — automatically rolling out approved patches that match criteria, with no manual deploy step. See Autonomous Deployment.
• Progressive deployment — releasing to endpoints in stages ("rings"), waiting for each stage to succeed ("soak") before the next, with success/failure gates. See Progressive Deployment.
• Ring — one stage (a group of endpoints) in a progressive rollout.
• Soak — the wait between rings used to watch for problems before continuing.

Roles & access

• Permission — a single capability (e.g. View Patch, Update Inventory). Pages list the permission a screen needs.
• Role — a named bundle of permissions assigned to a user. See User Roles.
• Tenant — an isolated customer/organisation in a multi-tenant deployment. See Tenants.