| Blast Radius | Analysis that shows the hosts, and optionally the subnets, reachable from a source location within the destination subnets you specify. Use it to assess how far an attacker can move laterally from a compromised host. | Blast Radius |
| Collector | The component that logs in to devices, controllers, and cloud APIs with read-only access, gathers configuration and state, and sends it to Forward for modeling. It makes no changes to devices. Self-hosted deployments include a bundled Collector and can also use installed Collectors; SaaS deployments require an installed Collector. | Manage Network Collector |
| Dashboards | Customizable pages of panels that show collection, verification, vulnerability, NQE, and network complexity data. Forward also maintains built-in dashboards, such as Insights and Scorecards & KPIs. | Dashboards |
| Data Connector | An integration that fetches data from an external system with HTTP(S) GET requests during collection and adds it to the snapshot, where NQE can query it. | Data Connectors |
| Deployment Models | The ways to run Forward Enterprise: Forward SaaS, operated by Forward, or self-hosted on VMware, AWS, Azure, or KVM. | Forward Enterprise Deployment Models |
| Diffs | A comparison of two snapshots that shows changes to collected files, inventory, interfaces, routes, VLANs, ACLs, NAT, ARP and MAC entries, links, and Verify check results. | Diffs |
| Digital Twin | The vendor-neutral model of the network that Forward computes from collected configuration and state. Search, Verify, NQE, and Forward AI all run against it. | Introduction to Forward Enterprise |
| Edge Node | An object attached to a device interface that represents an uncollected network at the edge of the model. Adding, editing, or removing an edge node reprocesses the snapshot. | Objects |
| Endpoint Profile | A reusable definition for collecting data over CLI, SNMP, or HTTP(S) from endpoints that Forward does not natively model. The collected data is available in NQE, search results, and host details; Forward does not model endpoint forwarding. | Endpoint Profiles |
| Exposure Analysis | Analysis that combines host vulnerability data from Rapid7 InsightVM or Tenable Security Center with the Forward model to show which vulnerable hosts are reachable from an exposure point, such as the internet. | Exposure Analysis |
| Forward AI | A conversational agent that answers questions about the network in plain English. It runs tools such as path search, NQE, device lookups, and vulnerability queries against the digital twin. | Forward AI |
| Forward Enterprise | The network modeling platform that collects, analyzes, and computes network behavior across on-premises, hybrid, and multi-cloud environments. | Introduction to Forward Enterprise |
| Intent Verification | A Verify check type that tests end-to-end paths in the model: Existence (at least one path is allowed), Isolation (no path is allowed), and Reachability (every matching packet is delivered to the destination). | Intent Verification |
| Inventory | The application that lists the network's devices, hardware, OS versions, interfaces, and other data from built-in and custom NQE queries, normalized across vendors. It also lists cloud objects and endpoints. | Inventory |
| Jump Server | An intermediate SSH host, also called a bastion host, that the Collector connects through to reach devices and APIs it cannot reach directly. | Jump Servers |
| Locations | Named groups of devices and endpoints, organized by site, region, or other criteria. Assign them to a location individually or with a glob pattern on device names. Forward places cloud devices in cloud-region locations automatically. | Locations |
| Logical Network | An object that groups devices and edge nodes into a named portion of the network. The Path Analysis in() clause references it. | Objects |
| Network | The container for one modeled environment within an organization. It holds that environment's sources, most collection settings, locations, and snapshots. | Network Collections |
| Network Collection | The process that creates a snapshot: the Collector gathers configuration and state from each source, and Forward models the result. Start a collection manually, on a schedule, or through the REST API. | Network Collections |
| NQE (Network Query Engine) | A query language over Forward's vendor-neutral model of the network, and over data from endpoint profiles, data connectors, and data files. Use it to build custom verification checks, dashboards, and inventory views. | NQE (Network Query Engine) |
| Objects | Named, reusable network objects (host groups, device groups, interface groups, header sets, edge nodes, and logical networks) that Verify and Search can reference. | Objects |
| Path Analysis (Path Search) | The Search type that traces how traffic moves through the modeled network, applying forwarding, access control, NAT, tunnel encapsulation, and policy rules at each hop. It sends no live traffic. | Path Analysis Overview |
| Predict | The application that evaluates a proposed change (a config change, a firewall rule, or a BGP advertisement) against the model and computes a predicted snapshot. It pushes nothing to devices. | Predict Overview |
| Search | The application for finding network objects and tracing traffic from one search bar. An object query returns matching devices, interfaces, hosts, routes, ACL rules, VLANs, and other elements, plus text matches in collected configuration and state. A path query, such as from A to B, runs Path Analysis. | Search |
| Security Posture | Security matrices that show the connectivity between resource pools you define from VRFs, subnets, cloud security groups, or firewall security zones. Forward computes the matrix for the selected snapshot. | Security Posture Analysis |
| Snapshot | The configuration and state that Forward collects from the network at one point in time, and the model computed from it. Snapshots can also be imported or produced by Predict. | Network Collections |
| Sources | The page for managing everything Forward collects from: classic devices, Cisco ACI and SD-WAN setups, cloud-managed devices, cloud providers, Nexus Dashboard Orchestrator, SASE setups, VM platforms, synthetic nodes, endpoints, data connectors, data files, and end host scanners. | Sources |
| Synthetic Device (Synthetic Node) | A user-defined device that models connectivity Forward cannot collect directly, such as the internet, a leased L3 VPN, a carrier WAN circuit, or an encrypted tunnel. Path Analysis traces traffic through it. | Synthetic Devices |
| Topology | Diagrams of the network computed from a snapshot, with physical, L2, L3, BGP, and OSPF views. Links show their type, such as IPsec, VXLAN, or GRE. | Topology |
| Verify | The application that runs verification checks against each snapshot and reports whether each check passes or fails. Check types are NQE, Predefined, and Intent Verification. | Verify |
| Vulnerability Analysis | Analysis that compares CVE data from vendors and the NIST NVD with the OS versions (and, for some CVEs, the configuration) of your devices, and lists the devices that may be affected. | Vulnerability Analysis |