No terms match "". Try a shorter or more general term.

Access Control

The discipline of deciding who or what may use a resource, and enforcing that decision. Access control combines identification, authentication, and authorization, and is implemented through mechanisms ranging from file permissions and network ACLs to enterprise identity platforms. Most breaches involve a failure of access control at some layer.

Access Control List (ACL)

A set of rules that specifies which users, systems, or processes are permitted or denied access to a particular resource, and what operations they may perform on it. ACLs are used in operating systems, network devices, and file systems to enforce the principle of least privilege.

Adversarial Machine Learning

Techniques that manipulate or exploit machine learning models by crafting inputs designed to cause misclassification, extract training data, or degrade model performance. It is a growing concern as AI systems are increasingly integrated into security and business-critical decisions.

AI

Artificial Intelligence — Software systems that perform tasks normally requiring human intelligence, such as pattern recognition, language understanding, or decision-making. In cybersecurity, AI is used both defensively (anomaly detection, automated triage) and offensively (AI-assisted phishing, malware generation, vulnerability discovery).

AI Agent

An AI system, typically built on a large language model, that can autonomously plan and execute multi-step tasks — such as browsing the web, calling APIs, or running code — with limited human oversight. Their ability to take real-world actions raises distinct security concerns around prompt injection, excessive permissions, and unpredictable behavior.

AI Security

The practice of protecting machine-learning systems and the applications built on them, covering threats such as prompt injection, model theft, data poisoning, and adversarial inputs, as well as the misuse of AI by attackers. It spans both securing AI (defending models and pipelines) and AI for security (using models defensively).

Air Gap

A security measure that physically isolates a computer or network from unsecured networks, including the public internet, so no direct electronic connection exists. Air-gapped systems protect highly sensitive environments like industrial control systems and classified networks, though they can still be breached via removable media or supply chain compromise.

Anti-Virus (AV)

Software designed to detect, block, and remove known malware, traditionally relying on signature-based matching against a database of known malicious file hashes and patterns, though modern products add heuristic and behavioral detection. It remains a baseline endpoint control but is increasingly supplemented or replaced by EDR for detecting novel threats.

API

Application Programming Interface — A defined set of rules and protocols that lets separate software systems communicate and exchange data with each other. Because APIs often expose data and functionality directly, insecure APIs (weak authentication, excessive data exposure, lack of rate limiting) are a major modern attack surface.

Application Security (AppSec)

The discipline of finding, fixing, and preventing security vulnerabilities within software applications throughout their development lifecycle, using practices like code review, static/dynamic analysis, and secure coding standards. It is a foundational pillar of DevSecOps.

APT

Advanced Persistent Threat — A prolonged, targeted cyberattack where an intruder gains access to a network and remains undetected for an extended period.

Attack Surface

The complete set of points where an unauthorized user could attempt to enter or extract data from a system, including software, hardware, network interfaces, and human users. Reducing the attack surface — by disabling unused services, closing unnecessary ports, and limiting exposed endpoints — is a core defensive strategy.

Attack Surface Management (ASM)

The continuous process of discovering, inventorying, and monitoring all internet-facing assets an organization owns, including forgotten or unknown ('shadow') systems, to identify exposure before attackers do. ASM tools typically combine external scanning with asset discovery to maintain an up-to-date map of what is publicly reachable.

Attack Vector

The specific path or method an attacker uses to gain unauthorized access to a system or network, such as a phishing email, an exposed remote-access service, or an unpatched vulnerability. Identifying likely attack vectors is a core part of threat modeling.

Attribution

The process of identifying the individual, group, or nation responsible for a cyberattack, typically based on technical indicators (malware code reuse, infrastructure overlap), tradecraft (TTPs), and geopolitical context. Attribution is inherently difficult and often expressed with varying confidence levels because attackers can plant false flags.

Authentication and Authorization

Authentication is the process of verifying that a user or system is who it claims to be, typically via a password, certificate, or biometric. Authorization is the separate process of determining what an authenticated identity is permitted to do; conflating the two is a common source of access-control vulnerabilities.

Authorization

The process of determining what an authenticated identity is allowed to do — which resources it can read, change, or delete. Authorization failures, such as missing object-level checks in APIs, are among the most common and damaging web vulnerability classes.

Backdoor

A hidden method of bypassing normal authentication or encryption in a system, allowing an attacker (or, in some cases, a vendor) covert remote access. Backdoors can be planted by malware, inserted during development, or introduced through a compromised supply chain.

Bastion Host

A hardened server deliberately exposed to an untrusted network, such as the internet, to provide a single, tightly controlled entry point for administrative access to internal systems. Because it is intentionally exposed, it is configured with minimal software and aggressive monitoring to reduce its own risk.

Beaconing

Periodic outbound communication from a compromised host to an attacker-controlled command-and-control server, used to check in, receive instructions, or exfiltrate data. Because beaconing often follows a regular time interval, network defenders look for it as a behavioral indicator of compromise.

Biometric Authentication

Verifying a user's identity using unique physical or behavioral characteristics, such as a fingerprint, face, or iris scan, instead of, or alongside, a password. It is a form of 'something you are' authentication and is increasingly combined with other factors in multi-factor authentication.

Blast Radius

The scope of systems, data, or users that could be affected if a specific component or account is compromised. Minimizing blast radius — through segmentation, least privilege, and short-lived credentials — is a core goal of modern security architecture, since it limits how far a single breach can spread.

Blue Team

The defensive security professionals responsible for detecting, responding to, and mitigating attacks against an organization, typically staffing the SOC and running day-to-day defenses. Blue team work is contrasted with the offensive, simulated-attacker role of a red team.

Botnet

A network of internet-connected devices infected with malware and controlled collectively by an attacker, often without the owners' knowledge. Botnets are used to launch DDoS attacks, send spam, mine cryptocurrency, or serve as proxy infrastructure for other attacks.

Broken Access Control

A vulnerability class in which an application fails to properly enforce restrictions on what authenticated users are allowed to do, letting them view or modify data or functionality outside their permissions. It has topped the OWASP Top 10 list of web application security risks in recent years.

Brute Force Attack

An attack that systematically tries every possible combination of characters, or a large list of candidate values, to guess a password, encryption key, or hidden resource. Defenses include account lockouts, rate limiting, and strong password or passphrase policies.

Bug Bounty

A program in which an organization pays independent security researchers for responsibly disclosing vulnerabilities they find in its systems, rather than requiring an internal-only testing process. Bug bounty platforms like HackerOne and Bugcrowd act as intermediaries between researchers and organizations.

Business Continuity Plan (BCP)

A documented set of procedures an organization follows to keep critical operations running during and after a disruptive event, such as a cyberattack, natural disaster, or outage. It works alongside a disaster recovery plan, which focuses specifically on restoring IT systems and data.

Business Email Compromise (BEC)

A scam in which an attacker impersonates an executive, vendor, or trusted contact — often via a spoofed or compromised email account — to trick an employee into making a fraudulent wire transfer or disclosing sensitive information. It has consistently ranked among the costliest categories of cybercrime by dollar losses.

BYOD

Bring Your Own Device — A workplace policy that allows employees to use their personal smartphones, laptops, or tablets to access corporate systems and data. It introduces security challenges around device management, data separation, and inconsistent patch levels that organizations typically address with mobile device management tools.

C2

Command and Control — Infrastructure used by threat actors to communicate with and control compromised systems.

CASB

Cloud Access Security Broker — A security policy enforcement point, deployed on-premises or in the cloud, that sits between cloud service users and cloud applications to monitor activity and enforce security policies such as encryption, access control, and data loss prevention. CASBs give organizations visibility into cloud usage that traditional network security tools cannot see.

CCPA

California Consumer Privacy Act — A California state law that gives consumers rights over the personal data businesses collect about them, including the right to know, delete, and opt out of the sale of their data. It was one of the first comprehensive U.S. state privacy laws and influenced similar legislation elsewhere.

Certificate Authority (CA)

A trusted entity that issues digital certificates, which cryptographically bind a public key to an identity such as a website or organization and are used to establish secure, encrypted TLS connections. Browsers and operating systems maintain lists of trusted root CAs; a compromised or misissuing CA can undermine trust across the entire web.

Certificate Pinning

A security technique in which an application is hardcoded to trust only a specific, known certificate or public key for a given server, rather than any certificate signed by a trusted CA. It defends against man-in-the-middle attacks that rely on a fraudulently issued or CA-compromised certificate.

Chief Information Security Officer (CISO)

The executive responsible for an organization's information-security strategy, risk posture, and security operations. The CISO role bridges technical teams and the board, owning decisions about controls, incident response, and security investment.

CI/CD

Continuous Integration / Continuous Delivery — A software development practice that automates building, testing, and deploying code changes frequently and reliably. CI/CD pipelines are a high-value attack target because a compromise there can inject malicious code into every downstream build.

CIA Triad

A foundational security model describing the three core goals of information security: Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized users can access data and systems when needed). Most security controls can be mapped to protecting one or more legs of the triad.

CIS Benchmarks

Vendor-specific, prescriptive configuration guidelines for operating systems, cloud platforms, and applications, published by the Center for Internet Security, detailing the exact settings needed to harden a system securely. They are more granular and product-specific than the broader CIS Controls.

CIS Controls

A prioritized set of cybersecurity best practices, published by the Center for Internet Security, designed to help organizations defend against the most common and impactful attacks. Unlike broader risk-management frameworks, the CIS Controls are organized as a concrete, actionable checklist.

Cloud Security

The practices, controls, and technologies used to protect data, applications, and infrastructure hosted in cloud environments, addressing the shared-responsibility split between the cloud provider, which secures the underlying infrastructure, and the customer, who secures what they configure and put in it. Misconfiguration on the customer side of that split is the leading cause of cloud breaches.

Cloud Security Posture Management (CSPM)

Tools that continuously scan cloud environments for misconfigurations, such as publicly exposed storage buckets or overly permissive identity policies, and compare them against security and compliance benchmarks. Misconfiguration remains the most common cause of cloud data breaches.

Code Injection

A vulnerability class in which attacker-supplied input is executed as code by the target application — SQL injection, command injection, and template injection are common forms. It arises when untrusted input reaches an interpreter without proper separation between code and data.

Command Injection

A vulnerability that allows an attacker to execute arbitrary operating system commands on a host by inserting malicious input into an application that passes user input to a system shell. It is typically prevented by avoiding shell calls with user input entirely or through strict input validation and parameterization.

Common Platform Enumeration (CPE)

A standardized naming scheme, maintained by NIST, for identifying classes of applications, operating systems, and hardware devices, used alongside CVE and CVSS to precisely describe which products a vulnerability affects. Vulnerability scanners rely on CPE identifiers to accurately match discovered software to known vulnerabilities.

Container Security

Practices and tools for protecting containerized applications, such as Docker containers, and their orchestration platforms, such as Kubernetes, across the build, deployment, and runtime stages, including image scanning for vulnerabilities and enforcing least-privilege runtime configurations. Because containers share the host kernel, a container escape can potentially compromise the underlying host.

Content Security Policy (CSP)

A browser security standard that lets a website specify, via an HTTP header, which sources of scripts, styles, and other content are allowed to load, significantly reducing the impact of cross-site scripting attacks even if an injection flaw exists. A strict CSP is one of the most effective single mitigations against XSS.

Credential Harvesting

The collection of usernames, passwords, or other authentication material, typically through phishing pages that mimic legitimate login portals, malware-based keylogging, or scraping data from breaches. Harvested credentials are frequently resold on dark web marketplaces or reused in credential stuffing attacks.

Credential Stuffing

An automated attack that tries username and password pairs leaked from one breach against other websites, exploiting the fact that many people reuse passwords across services. It is highly effective at scale and is a primary reason security guidance discourages password reuse and recommends MFA.

Credential Theft

The stealing of authentication material — passwords, session tokens, API keys, or cookies — through phishing, infostealer malware, database breaches, or memory scraping. Stolen credentials are the leading initial access vector in modern intrusions because they let attackers log in rather than break in.

Cross-Site Request Forgery (CSRF)

A web attack that tricks an authenticated user's browser into submitting an unwanted request to a site where they are logged in — changing an email address, transferring funds — by abusing the browser's automatic inclusion of session cookies. Defenses include anti-CSRF tokens and SameSite cookie attributes.

Crown Jewels

A term for an organization's most critical and sensitive assets — data, systems, or intellectual property — whose loss or compromise would cause the most severe business impact. Identifying crown jewels helps focus limited security resources on protecting what matters most rather than spreading them evenly.

Cryptography

The practice of securing information by transforming it so that only authorized parties can access or verify it, encompassing encryption for confidentiality, hashing for integrity, and digital signatures for authenticity. It is the mathematical foundation underlying most modern security protocols, from HTTPS to secure messaging.

Cryptojacking

The unauthorized use of a victim's computing resources to mine cryptocurrency, typically delivered via malware or malicious browser scripts. It is designed to be stealthy, quietly degrading system performance and increasing electricity costs rather than causing obvious damage.

CVE

Common Vulnerabilities and Exposures — A standardized naming system for publicly known cybersecurity vulnerabilities.

CVSS

Common Vulnerability Scoring System — A numerical scoring framework (0-10) for assessing the severity of security vulnerabilities.

CWE

Common Weakness Enumeration — A community-developed, categorized list of common software and hardware weakness types, such as buffer overflow or SQL injection, maintained by MITRE. Where a CVE identifies a specific vulnerability instance, a CWE identifies the underlying class of flaw that caused it.

Cyber Hygiene

The routine practices and precautions — patching systems, using strong unique passwords, enabling MFA, backing up data — that individuals and organizations follow to maintain security and reduce the likelihood of a successful attack. Basic, consistent habits like these prevent a large share of common problems.

Cyber Insurance

An insurance policy that helps organizations offset the financial losses from a cyber incident, such as ransomware payments, breach notification costs, legal fees, and business interruption. Insurers increasingly require applicants to demonstrate baseline security controls, such as MFA, EDR, and backups, before issuing or renewing a policy.

Cyber Kill Chain

A model, developed by Lockheed Martin, that breaks a cyberattack into a sequence of stages — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to identify where in an attack's lifecycle they can detect or disrupt it.

Cybersecurity and Infrastructure Security Agency (CISA)

The United States federal agency responsible for defending civilian government networks and coordinating the protection of critical infrastructure. CISA publishes advisories, the Known Exploited Vulnerabilities (KEV) catalog, and binding operational directives that drive patching priorities well beyond the US government.

Dark Web

A portion of the internet that is intentionally hidden and requires specific software, such as Tor, to access; it is not indexed by standard search engines. It hosts both legitimate privacy-focused use and illicit marketplaces trading stolen data, malware, and drugs.

Data Breach

An incident in which sensitive, protected, or confidential data is accessed, disclosed, or stolen by an unauthorized party. Breach notification laws in most jurisdictions require organizations to inform affected individuals and regulators within a specified timeframe once one is discovered.

Data Classification

The process of organizing data into categories, such as public, internal, confidential, and restricted, based on its sensitivity and the impact of unauthorized disclosure. It underpins decisions about who can access data and what security controls, such as encryption and access logging, apply to it.

Data Exfiltration

The unauthorized transfer of data out of a system or network, typically the final objective of an intrusion, whether carried out by an external attacker or a malicious insider. Detecting exfiltration — often disguised within encrypted or otherwise normal-looking traffic — is a major focus of network security monitoring.

Data Loss Prevention (DLP)

Technology that monitors and controls data in use, in motion, and at rest to prevent sensitive information, such as credit card numbers or intellectual property, from leaving an organization's control, whether accidentally or maliciously. DLP policies typically combine content inspection with contextual rules about where data is allowed to go.

Data Poisoning

An attack against a machine learning system in which an adversary deliberately corrupts the training data to manipulate the model's behavior, such as creating a hidden backdoor or degrading its accuracy. Because models learn from whatever data they are given, poisoning attacks can be difficult to detect after the fact.

DDoS

Distributed Denial of Service — An attack that overwhelms a target with traffic from multiple sources to make it unavailable.

Deception Technology

Defensive tools that plant decoys — fake credentials, files, servers, or network shares — throughout an environment to lure attackers into revealing themselves. Any interaction with a decoy is inherently suspicious, since legitimate users have no reason to touch it, giving deception technology a low false-positive rate.

Deepfake

Synthetic audio, video, or images generated or manipulated using AI to convincingly depict a person saying or doing something they did not. Deepfakes are increasingly used in fraud, such as fake executive voice calls authorizing wire transfers, and disinformation campaigns.

Defense Evasion

A category of adversary techniques used to avoid detection throughout an attack, such as disabling security tools, obfuscating malicious code, or abusing trusted processes. It spans many specific techniques, including living-off-the-land and polymorphic malware.

Defense in Depth

A security strategy that layers multiple, independent controls across network, endpoint, application, physical, and administrative domains, so that if one layer fails or is bypassed, others still provide protection. It rejects reliance on any single control as a complete defense.

Dependency Confusion

A supply chain attack technique in which an attacker publishes a malicious package to a public package repository using the same name as an internal, private package, tricking a build system into pulling the attacker's version if it is misconfigured to prefer public sources. It was publicly demonstrated in 2021 against several major tech companies.

Deserialization Attack

An attack that exploits how an application reconstructs, or 'deserializes,' data from a stored or transmitted format back into objects, by supplying maliciously crafted serialized data that triggers unintended code execution. Insecure deserialization is listed among the OWASP Top 10 web application security risks.

Detection Engineering

The discipline of designing, building, and tuning detection logic, such as SIEM correlation rules or EDR behavioral signatures, to reliably identify malicious activity while minimizing false positives. It is increasingly treated as its own specialized engineering practice rather than a side task of SOC analysis.

DevOps

A set of practices and culture that combines software development and IT operations to shorten the development lifecycle and enable continuous delivery. 'DevSecOps' extends this by integrating security practices throughout the pipeline rather than treating security as a final gate.

DevSecOps

An extension of DevOps that embeds security practices — automated vulnerability scanning, secrets detection, dependency checks — directly into the development and deployment pipeline, rather than as a separate stage at the end. The goal is to catch issues earlier, when they are cheaper and faster to fix.

Diamond Model

A framework for analyzing intrusions that maps every event to four core features — adversary, capability, infrastructure, and victim — connected by the event itself. It complements the Cyber Kill Chain by focusing on the relationships between these elements rather than a linear attack sequence.

Digital Forensics

The scientific process of collecting, preserving, and analyzing digital evidence from computers, networks, or devices, typically to determine how a security incident occurred and support legal or disciplinary proceedings. It emphasizes strict chain-of-custody procedures so evidence remains admissible.

Digital Signature

A cryptographic mechanism that uses a private key to sign data, allowing anyone with the corresponding public key to verify both the signer's identity and that the data has not been altered since signing. Digital signatures are used to verify software updates, secure email, and authenticate legal documents.

Directory Traversal

A vulnerability that allows an attacker to access files and directories stored outside a web application's intended root folder by manipulating file path input, such as using '../' sequences. Successful exploitation can expose configuration files, credentials, or source code.

Disaster Recovery (DR)

The processes, policies, and technology an organization uses to restore IT infrastructure, applications, and data after a disruptive event such as a ransomware attack, hardware failure, or natural disaster. Recovery Time Objective and Recovery Point Objective are the key metrics used to define DR goals.

DMZ

Demilitarized Zone — A network segment that sits between an organization's internal network and an untrusted external network, typically the internet, hosting public-facing services like web and email servers. It limits the blast radius if a public-facing server is compromised, since the DMZ is isolated from the internal network by additional firewall rules.

DNS Spoofing

An attack that corrupts DNS resolution data, through cache poisoning or a compromised DNS server, to redirect users from a legitimate domain to a malicious one without their knowledge. It is often used to conduct phishing or man-in-the-middle attacks.

DNS Tunneling

A technique that encodes data from other programs or protocols inside DNS queries and responses, exploiting the fact that DNS traffic is rarely blocked. Attackers use it to exfiltrate data or maintain command-and-control communication through networks that otherwise restrict outbound traffic.

Domain Generation Algorithm (DGA)

A technique used by malware to programmatically generate a large number of pseudo-random domain names on a schedule known to both the malware and its operator, used for command-and-control communication that resists takedown, since defenders would need to block or register every generated domain to fully disrupt it.

DoS

Denial of Service — An attack that attempts to make a system, service, or network unavailable to legitimate users, typically by overwhelming it with traffic or exploiting a resource-exhaustion flaw, from a single source. A DDoS attack pursues the same goal from many distributed sources simultaneously.

Drive-By Download

Malware that installs on a victim's device automatically, without any action beyond visiting a compromised or malicious webpage, typically by exploiting a vulnerability in the browser or a plugin. It requires no click from the victim, making it especially dangerous on outdated software.

Dwell Time

The length of time an attacker remains undetected inside a compromised environment, from initial access until discovery. A longer dwell time gives an attacker far more opportunity to move laterally and exfiltrate data before being caught.

EDR

Endpoint Detection and Response — Security solutions that monitor endpoint devices for threats and provide investigation and response capabilities.

Egress Filtering

Security controls applied to outbound, rather than inbound, network traffic, restricting what internal systems are allowed to connect to on the internet. It is an effective, underused control against data exfiltration and command-and-control communication.

Encryption

The process of converting readable data, or plaintext, into an unreadable format, or ciphertext, using an algorithm and a key, so that only someone with the correct key can reverse the process and read the original data. It protects data confidentiality both at rest and in transit.

End-to-End Encryption (E2EE)

Encryption in which only the communicating endpoints hold the keys, so intermediaries — including the service provider itself — cannot read message content. E2EE protects data in transit against interception and server-side compromise, though endpoints and metadata remain attackable.

Endpoint

Any device — a laptop, desktop, server, mobile phone, or IoT device — that connects to and communicates with a network, and therefore represents a potential entry point for an attacker. Endpoint security tools like antivirus, EDR, and mobile device management collectively aim to protect this class of assets.

EPSS

Exploit Prediction Scoring System — A data-driven scoring system that estimates the probability a given vulnerability will be exploited in the wild within the next 30 days, based on real-world exploitation activity and vulnerability characteristics. It is used alongside CVSS severity scores to help organizations prioritize patching.

Exploit

A piece of code, technique, or sequence of commands that takes advantage of a vulnerability to cause unintended behavior on a system, such as gaining unauthorized access or executing arbitrary code. Exploits range from proof-of-concept research code to fully weaponized tools sold on criminal marketplaces.

Exploit Chain

A sequence of two or more vulnerabilities exploited together to achieve an impact none of them allows alone — for example, a browser sandbox escape chained with a kernel privilege escalation. Modern attacks on hardened targets almost always require chains, which is why vendors patch even 'low-severity' links aggressively.

Exploit Kit

A packaged toolset, typically deployed on compromised or malicious websites, that automatically probes visitors' browsers and plugins for known vulnerabilities and delivers a matching exploit and malware payload. Exploit kits were a dominant infection method in the mid-2010s and have declined as browsers adopted automatic updates and sandboxing.

Extended Security Updates (ESU)

A paid program under which a vendor continues shipping security patches for an operating system or product after its official end of support, typically for a limited number of years. ESU exists because large fleets cannot migrate on schedule; systems without it accumulate unpatched, publicly known vulnerabilities.

False Flag Operation

An attack deliberately designed to mislead investigators about who is responsible, for example by reusing another group's malware, infrastructure, or language artifacts. It is one of the reasons attribution is expressed with confidence levels rather than certainty.

False Positive / False Negative

In security detection, a false positive is an alert that incorrectly flags benign activity as malicious, while a false negative is a failure to flag genuinely malicious activity. Tuning detection systems to minimize both, without missing real threats or drowning analysts in noise, is a central challenge of SOC operations.

Federated Learning

An approach to training machine learning models across multiple decentralized devices or servers holding local data, without that raw data ever leaving its source. While designed to improve privacy, federated learning introduces new attack surfaces, such as poisoning attacks from malicious participants.

FedRAMP

A U.S. government program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. Cloud vendors must achieve a FedRAMP authorization before most federal agencies can adopt their services.

Fileless Malware

Malware that operates primarily in memory and abuses legitimate, already-installed system tools, such as PowerShell or WMI, rather than writing a malicious executable file to disk. Because there is often no file for traditional antivirus to scan, fileless attacks are harder to detect with signature-based tools alone.

Firewall

A network security device or software that monitors and controls incoming and outgoing traffic based on a defined set of rules, acting as a barrier between trusted and untrusted networks. Modern firewalls range from simple packet filters to next-generation firewalls that inspect traffic at the application layer.

Firmware

Low-level software embedded in hardware — from motherboards and network cards to routers and IoT devices — that runs before or beneath the operating system. Firmware compromise is prized by attackers because it survives OS reinstalls and evades most endpoint security tools.

FISMA

Federal Information Security Modernization Act — A U.S. federal law that requires federal agencies, and contractors handling federal data, to develop, document, and implement an information security program, typically assessed against NIST standards. It established the legal framework that programs like FedRAMP build on.

Formjacking

An attack in which malicious JavaScript is injected into a legitimate website's checkout or form pages to silently capture payment card details and other data as a victim types it in, without altering the page's visible appearance. Magecart is the best-known family of formjacking campaigns.

Fuzzing

An automated software testing technique that feeds a program large volumes of malformed, unexpected, or random input to trigger crashes, memory errors, or other unexpected behavior that may indicate an exploitable vulnerability. It is widely used by both security researchers and attackers to discover zero-day flaws.

GDPR

General Data Protection Regulation — A European Union law that governs how organizations collect, process, and protect the personal data of EU residents, granting individuals rights such as access, correction, and deletion of their data. Non-compliance can result in fines of up to 4% of a company's global annual revenue.

Generative AI

Artificial intelligence systems, typically built on large language or diffusion models, that create new content — text, images, audio, code — rather than simply classifying or predicting from existing data. Its accessibility has lowered the skill barrier for producing convincing phishing content, deepfakes, and malware code.

Golden Ticket Attack

An attack against Microsoft Active Directory in which an attacker who has stolen the Kerberos Key Distribution Center service account's password hash forges a Ticket Granting Ticket, granting themselves unrestricted, persistent access to any resource in the domain. Because it forges a legitimate-looking ticket, it is very difficult to detect and typically requires resetting the KRBTGT account to remediate.

GRC

Governance, Risk, and Compliance — An organizational approach that coordinates governance, risk management, and compliance as an integrated discipline rather than three separate silos. GRC platforms help centralize policy tracking, risk registers, and audit evidence.

Hacktivism

Cyberattacks or intrusions motivated by political or social causes rather than financial gain, ranging from website defacement and DDoS attacks to data leaks intended to embarrass or pressure a target. Hacktivist group activity often spikes around geopolitical events.

Hardening

The process of reducing a system's attack surface by disabling unnecessary services, closing unused ports, applying secure configuration settings, and removing default accounts or credentials. It is typically guided by standardized benchmarks, such as those published by CIS.

Hashing

A one-way mathematical function that converts input data of any size into a fixed-length string of characters, or hash, such that even a small change to the input produces a completely different output. Hashing is used to verify file integrity, store passwords without saving them in plaintext, and detect known malware via hash matching.

HIPAA

Health Insurance Portability and Accountability Act — A U.S. law that sets national standards for protecting sensitive patient health information, requiring healthcare providers, insurers, and their business associates to implement specific administrative, physical, and technical safeguards. Its Security Rule specifically governs electronic protected health information.

HMI

Human-Machine Interface — The hardware or software through which an operator monitors and controls industrial equipment, such as touchscreens or dashboards showing sensor readings from a factory floor or power plant. Because HMIs are often the most exposed and least-updated component in an OT environment, they are a frequent target in ICS attacks.

Homograph Attack

A phishing technique that uses visually similar characters, often from a different alphabet such as Cyrillic, to register a domain name that looks nearly identical to a legitimate one. It exploits how internationalized domain names are rendered by browsers.

Honeynet

A network of honeypots deployed together to simulate a full environment, giving security researchers a realistic decoy infrastructure to observe how attackers move laterally, pivot, and behave once inside a network. It provides broader visibility into attacker behavior than a single honeypot.

Honeypot

A decoy system deliberately designed to look like a legitimate, vulnerable target, deployed to attract, detect, and study attackers without risking real assets. Any interaction with a honeypot is a strong indicator of malicious activity, since it serves no legitimate business purpose.

IAM

Identity and Access Management — A framework of policies and technologies that ensures the right individuals have the right access to the right resources at the right time, encompassing authentication, authorization, and the lifecycle management of user accounts. It is foundational to a zero trust security model.

ICS

Industrial Control System — A general term covering the hardware and software used to monitor and control industrial processes, including SCADA systems, distributed control systems, and PLCs, used in sectors like manufacturing, energy, and water treatment. ICS environments prioritize availability and safety over confidentiality, shaping how they are secured differently from traditional IT.

Identity Provider (IdP)

A service that creates, maintains, and authenticates digital identities, and asserts that authentication to other applications, typically as part of an SSO or federated-identity setup. Common examples include Okta, Microsoft Entra ID, and Google Workspace.

Identity Threat Detection and Response (ITDR)

A security category focused specifically on detecting and responding to attacks against identity infrastructure, such as Active Directory or cloud identity providers, including credential theft, privilege escalation, and Kerberos-based attacks. It emerged as identity, rather than the network perimeter, became the primary target in many modern intrusions.

IDS

Intrusion Detection System — A tool that monitors network traffic or system activity for signs of malicious behavior or policy violations and generates alerts, without taking automatic action to block it. It can be network-based, monitoring traffic, or host-based, monitoring activity on an individual system.

Incident Response (IR)

The organized process an organization follows to prepare for, detect, contain, eradicate, and recover from a cybersecurity incident, typically following a documented plan and playbooks. A widely referenced lifecycle defines four phases: preparation, detection and analysis, containment/eradication/recovery, and post-incident activity.

Information Security (InfoSec)

The overarching discipline of protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. 'Cybersecurity' is often used interchangeably with it but technically refers specifically to the digital and network subset of the broader discipline.

Infostealer

Malware specifically designed to harvest credentials, session cookies, cryptocurrency wallets, and other sensitive data from an infected device and send it back to the attacker, typically to enable follow-on access or resale. Infostealer logs traded on criminal marketplaces are a major source of the initial access used in ransomware intrusions.

Initial Access

The first stage of an intrusion: the technique an attacker uses to gain a foothold in a target environment, such as phishing, exploiting an internet-facing vulnerability, or using stolen credentials. MITRE ATT&CK catalogs initial access as its own tactic, and 'initial access brokers' sell footholds to other criminals.

Initial Access Broker (IAB)

A cybercriminal who specializes in breaching organizations and then selling that access — such as stolen VPN credentials or a foothold on a compromised server — to other threat actors, including ransomware operators, rather than carrying out the follow-on attack themselves. IABs have effectively industrialized the early stages of the ransomware supply chain.

Insider Threat

A security risk that originates from someone with legitimate access to an organization's systems or data, such as a current or former employee, contractor, or business partner, whether acting maliciously, negligently, or after being compromised. Insider threats are harder to detect with perimeter-focused tools because the activity originates from an already-trusted account.

IOA

Indicator of Attack — A behavioral signal that an attack is actively in progress, such as a process attempting to disable security tools or an unusual sequence of privilege escalation steps, as opposed to a static artifact left behind afterward. IOAs are intended to detect attacker intent and technique in real time, complementing indicators of compromise.

IoC

Indicator of Compromise — Forensic artifacts that identify potentially malicious activity on a system or network.

IPS

Intrusion Prevention System — A network security tool that monitors traffic for malicious activity and automatically takes action to block or reject it, extending an IDS's passive detection into active prevention. IPS devices are typically deployed inline, directly in the traffic path, so they can drop malicious packets before they reach their target.

ISO 27001

An international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system. Organizations can be independently certified against it, which is often used to demonstrate security maturity to customers and partners.

IT/OT Convergence

The trend of connecting previously isolated operational technology, such as industrial control systems and manufacturing equipment, to IT networks and the internet for benefits like remote monitoring and data analytics. It significantly expands the attack surface of environments that were historically protected primarily by physical isolation.

Jailbreak (LLM)

A prompt or technique designed to bypass an AI model's built-in safety guardrails, tricking it into producing content or taking actions its developers intended to restrict. Jailbreaks are a moving target: as developers patch known techniques, new ones are continually discovered.

Kerberoasting

An attack against Active Directory environments in which an attacker requests Kerberos service tickets for accounts with a Service Principal Name, then attempts to crack the tickets offline to recover the account's plaintext password. It is popular with attackers because it can be performed by any authenticated domain user and generates minimal, easily overlooked log activity.

KEV

Known Exploited Vulnerabilities — A catalog maintained by CISA of vulnerabilities confirmed to have been actively exploited in the wild, along with mandated remediation deadlines for U.S. federal civilian agencies. Because inclusion requires evidence of real-world exploitation rather than theoretical risk, the KEV catalog is widely used across the industry as a prioritization signal beyond CVSS score alone.

Key Management

The processes and systems used to generate, distribute, store, rotate, and revoke cryptographic keys throughout their lifecycle. Weak key management — such as hardcoded keys or keys that are never rotated — undermines even mathematically strong encryption.

Keylogger

Malware or hardware that records every keystroke a victim types, capturing passwords, messages, and other sensitive input, typically transmitting the captured data back to an attacker. Keyloggers are often bundled with other malware or delivered via phishing and trojans.

Kill Switch

A mechanism, sometimes deliberately built into malware, that halts its operation if a specific condition is met, either by design as a safety measure or by accident as a researcher-discovered flaw. WannaCry's accidental kill switch, triggered by registering an unregistered domain, is the best-known example.

Lateral Movement

Techniques attackers use to progressively move through a network after gaining initial access, searching for key data and assets.

Least Privilege

A security principle stating that a user, process, or system should be granted only the minimum access rights necessary to perform its function, and no more. It limits the damage an attacker or compromised account can do, since restricted permissions constrain what can be reached or modified.

Living-off-the-Land (LotL)

An attack technique in which adversaries use legitimate, pre-installed system tools and administrative software, such as PowerShell, WMI, or PsExec, to carry out malicious activity rather than deploying custom malware. Because the tools themselves are trusted and commonly used for legitimate administration, LotL activity blends into normal traffic and is significantly harder to detect than a foreign executable.

LLM

Large Language Model — A type of AI model trained on vast amounts of text to understand and generate human-like language, underpinning tools like chatbots and coding assistants. LLMs introduce novel security risks distinct from traditional software, including prompt injection, data leakage through model outputs, and hallucinated but confidently stated false information.

Log Management

The practice of collecting, storing, and analyzing log data generated by systems, applications, and network devices, forming the raw data foundation that SIEM and threat-hunting tools query against. Retention length and log completeness are frequently the deciding factor in whether an incident investigation can reconstruct what actually happened.

Logic Bomb

Malicious code intentionally inserted into a system that lies dormant until triggered by a specific condition, such as a date, a file deletion, or an employee's termination from HR systems. Because they are often planted by an insider with legitimate access, logic bombs can be difficult to detect through external monitoring alone.

LOLBins

Living-off-the-Land Binaries — Legitimate, often digitally signed executables that ship with an operating system and can be repurposed by attackers to download, execute, or hide malicious activity. The LOLBAS project catalogs known Windows binaries with this dual-use potential.

Malvertising

The practice of injecting malicious code into legitimate online advertising networks, so that ads served on trusted, high-traffic websites redirect visitors to exploit kits or phishing pages. It is dangerous precisely because the website itself is not compromised — the malicious content flows through a legitimate ad exchange.

Malware

A general term for any software intentionally designed to cause damage, gain unauthorized access, or disrupt a computer system, including viruses, worms, trojans, ransomware, and spyware. Malware families are typically distinguished by how they spread and what action they take once installed.

Man-in-the-Browser

A form of man-in-the-middle attack carried out by malware embedded directly in a victim's web browser, often via a malicious extension, letting the attacker intercept or modify web transactions — such as altering a bank transfer's destination account — even over an otherwise properly encrypted HTTPS connection.

Man-in-the-Middle (MitM)

An attack in which an adversary secretly intercepts and potentially alters communication between two parties who believe they are communicating directly with each other. Common techniques include ARP spoofing on local networks and exploiting weak or absent TLS certificate validation.

MCP

Model Context Protocol — An open standard that lets AI applications, including LLM-based agents, connect to external tools, data sources, and services in a consistent way. Because it grants models the ability to invoke real external actions, poorly secured MCP integrations expand an AI agent's attack surface and blast radius if compromised via prompt injection.

MDR

Managed Detection and Response — An outsourced security service in which a third-party provider monitors an organization's environment using EDR/XDR tooling and takes, or recommends, response actions on the customer's behalf, typically around the clock. It is aimed at organizations that lack the in-house staff to run their own SOC.

Mean Time to Detect / Respond (MTTD/MTTR)

Metrics that measure, respectively, how long it takes a security team to discover a threat after it occurs and how long it takes to fully contain and remediate it once detected. Lower values in both generally indicate a more mature security operation, though they must be read alongside detection quality to avoid rewarding fast but incomplete responses.

MFA

Multi-Factor Authentication — An authentication method that requires a user to present two or more independent forms of verification — something they know, something they have, or something they are — before granting access. It is one of the single most effective controls against account takeover, since a stolen password alone is no longer sufficient.

Microsegmentation

A network security technique that divides a data center or cloud environment into small, isolated zones down to the individual workload level, enforcing granular security policies between them. It limits an attacker's ability to move laterally even after breaching one segment, since each workload's communication is explicitly restricted.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques based on real-world observations, used for threat modeling and defense planning.

MSSP

Managed Security Service Provider — A third-party company that provides outsourced monitoring and management of security systems and devices, such as firewalls, intrusion detection, and SIEM, for client organizations. MSSPs are typically broader and less specialized in active threat response than MDR providers.

N-Day

A vulnerability that has already been publicly disclosed and typically has a patch available, as opposed to a zero-day, which is unknown to the vendor. N-day exploitation remains highly effective because a significant percentage of organizations do not patch known vulnerabilities promptly.

Nation-State Actor

A threat actor that is sponsored, directed, or affiliated with a government, typically pursuing espionage, sabotage, or strategic advantage rather than direct financial gain. Nation-state actors generally have significantly greater resources, patience, and technical sophistication than criminal groups.

NDR

Network Detection and Response — Security tools that analyze network traffic, often using machine learning to baseline normal behavior, to detect anomalies, lateral movement, and command-and-control activity that endpoint or perimeter tools might miss. NDR is frequently deployed alongside EDR as a complementary layer of visibility.

Network Access Control (NAC)

Technology that enforces security policy on devices before and while they connect to a network, verifying compliance, such as up-to-date patches or antivirus, and restricting what non-compliant or unauthorized devices can reach.

Network Segmentation

The practice of dividing a computer network into smaller, isolated subnetworks so that a compromise in one segment does not automatically grant access to the rest of the network. It is a foundational defense-in-depth control, distinct from the more granular, workload-level approach of microsegmentation.

NGFW

Next-Generation Firewall — A firewall that goes beyond traditional port- and protocol-based filtering to inspect traffic at the application layer, incorporating intrusion prevention, deep packet inspection, and application awareness. NGFWs can identify and control specific applications regardless of the port they use.

NIS2 Directive

An updated European Union directive that expands cybersecurity requirements — including incident reporting, risk management, and supply chain security — to a broader range of 'essential' and 'important' sectors than its predecessor. It carries potential fines and personal liability for management for non-compliance.

NIST

National Institute of Standards and Technology — A U.S. federal agency that develops widely adopted cybersecurity standards, guidelines, and frameworks, including the NIST Cybersecurity Framework and the Special Publication 800 series. Its publications function as de facto industry best practice, even where not legally mandatory outside government.

NIST CSF

A voluntary framework published by NIST that organizes cybersecurity activities into six core functions — Govern, Identify, Protect, Detect, Respond, and Recover — to help organizations of any size manage and communicate cyber risk. It is outcome-focused rather than prescriptive, letting organizations map their existing controls to a common structure.

NOC

Network Operations Center — A centralized location where IT staff monitor and manage the performance and availability of an organization's network infrastructure. It is focused on operational uptime and performance, distinct from a SOC's focus on security threats, though the two increasingly share tooling and coordinate closely.

Non-Repudiation

A security property ensuring that a party cannot credibly deny having performed an action, such as sending a message or authorizing a transaction, typically achieved through digital signatures and audit logging. It is one of the classic goals of cryptographic security alongside confidentiality, integrity, and availability.

Obfuscation

Techniques used to deliberately make code or data difficult for a human or automated tool to read and understand, used both legitimately to protect intellectual property and maliciously to evade antivirus signatures and slow down reverse engineering.

OSINT

Open-Source Intelligence — Information collected from publicly available sources, such as websites, social media, public records, and code repositories, and analyzed to produce actionable intelligence. Both defenders and attackers rely heavily on OSINT during their respective reconnaissance processes.

OT

Operational Technology — Hardware and software that monitors and controls physical devices, processes, and infrastructure — such as manufacturing equipment, power grids, and pipelines — as distinct from traditional IT, which manages data. OT security prioritizes safety and continuous availability, since an outage or malfunction can cause physical harm, not just data loss.

OT Security

The protection of operational technology — the industrial control systems, PLCs, and SCADA environments that run physical processes in manufacturing, energy, and utilities. OT security differs from IT security because availability and safety outrank confidentiality, patching windows are rare, and equipment lifetimes are measured in decades.

PAM

Privileged Access Management — Tools and policies that secure, control, and monitor accounts with elevated access to critical systems, such as domain administrators or database root accounts. Common capabilities include credential vaulting, session recording, and just-in-time access that grants elevated rights only for a limited window.

Pass-the-Hash

An attack technique in which an adversary captures a hashed password, rather than the plaintext, and uses it directly to authenticate to other systems without ever needing to crack it. It exploits how some authentication protocols accept the hash itself as proof of identity.

Pass-the-Ticket

An attack similar to pass-the-hash, but targeting Kerberos authentication: an attacker steals a valid Kerberos ticket from memory and reuses it to impersonate the legitimate user on other systems without knowing their password.

Passkey

A phishing-resistant authentication credential based on public-key cryptography, tied to a specific device and typically unlocked with a biometric or PIN, designed to replace passwords under the FIDO2/WebAuthn standard. Because there is no shared secret transmitted to the server, passkeys cannot be phished, reused, or leaked in a credential-database breach the way passwords can.

Password Spraying

An attack that tries a small number of commonly used passwords against a large number of different user accounts, rather than many passwords against one account. This low-and-slow approach is designed to stay under the threshold that would trigger typical account-lockout defenses.

Patch

A piece of software released by a vendor to fix a bug, close a security vulnerability, or improve functionality in an existing program. Timely patch application is one of the most effective, and most commonly neglected, basic security controls.

Patch Management

The process of identifying, testing, and deploying software updates that fix security vulnerabilities and bugs across an organization's systems. Delays or gaps in patch management are among the most common root causes of successful breaches, since attackers frequently exploit vulnerabilities long after a fix is available.

Patch Tuesday

The unofficial term for the second Tuesday of each month, when Microsoft, and several other vendors that align with it, routinely release security patches. It gives IT teams a predictable schedule for testing and deploying updates, though critical vulnerabilities are sometimes patched out-of-band before the next scheduled release.

Payload

The part of malware or an exploit that carries out its actual malicious action — such as encrypting files, opening a backdoor, or exfiltrating data — as distinct from the delivery mechanism, such as a phishing attachment, that gets it onto the target system.

PCI DSS

Payment Card Industry Data Security Standard — A set of security requirements, maintained by the major card brands, that any organization handling credit card data must follow, covering network security, access control, encryption, and monitoring. Compliance is enforced through the payment processing chain rather than by government regulators.

Penetration Testing

An authorized, simulated cyberattack against a system, network, or application, conducted to identify exploitable vulnerabilities before real attackers do. Unlike an automated vulnerability scan, a penetration test involves a human tester actively chaining weaknesses together to demonstrate real-world impact.

Persistence

A category of attacker techniques used to maintain access to a compromised system across reboots, credential changes, and other interruptions, such as creating a scheduled task, a new user account, or a registry run key. Losing access after the initial compromise would waste the effort of getting in, which is why attackers prioritize it.

Personally Identifiable Information (PII)

Data that can identify a specific individual, directly (name, national ID number) or in combination (date of birth plus postcode). PII is what breach-notification laws and privacy regulations such as GDPR exist to protect, and its exposure is the primary measure of a data breach's severity.

Phishing

A social engineering attack that uses deceptive emails, messages, or websites to trick users into revealing sensitive information.

Phishing-as-a-Service

A criminal offering, similar to ransomware-as-a-service, in which developers sell or lease ready-made phishing kits, hosting infrastructure, and bypass techniques, such as real-time MFA relay, to less-technical affiliates. It has significantly lowered the skill barrier for running convincing, adaptive phishing campaigns.

Physical Security

Controls that protect physical access to facilities, hardware, and infrastructure — locks, badges, cameras, guards — recognizing that an attacker with physical access to a device can often bypass many logical security controls entirely.

Pig Butchering

A long-con scam in which an attacker builds a fake romantic or personal relationship with a victim over weeks or months before persuading them to invest in a fraudulent cryptocurrency platform, gradually increasing the amount before disappearing with the funds. It has become one of the fastest-growing categories of financial cybercrime.

PKI

Public Key Infrastructure — The set of roles, policies, and systems, including certificate authorities, digital certificates, and key pairs, needed to create, manage, distribute, and revoke public and private key pairs used for encryption and digital signatures. PKI underpins HTTPS, code signing, and secure email.

Playbook

A predefined, documented set of steps for responding to a specific type of security incident, such as a ransomware infection or a phishing report, used to ensure a consistent, repeatable response regardless of which analyst handles it. SOAR platforms often automate playbooks directly.

PLC

Programmable Logic Controller — A ruggedized industrial computer that directly controls physical machinery and processes, such as opening a valve or starting a motor, based on sensor input, forming the lowest-level control layer in most ICS environments. PLCs often run on decades-old firmware with limited built-in security, making them a persistent soft target in OT attacks.

Polymorphic Malware

Malware that automatically changes its own code or appearance each time it replicates or executes, while keeping its underlying malicious functionality intact, specifically to evade signature-based antivirus detection. Behavioral and heuristic detection methods are generally more effective against it than static signatures.

Post-Quantum Cryptography

Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers, which are expected to be able to break widely used current algorithms like RSA and ECC. NIST has begun standardizing post-quantum algorithms, and organizations with long-lived sensitive data are starting 'harvest now, decrypt later' risk planning around the transition.

Pretexting

A social engineering technique in which an attacker fabricates a plausible scenario or false identity — posing as IT support, a vendor, or an executive — to manipulate a victim into divulging information or performing an action they otherwise would not. It is often a component of a broader phishing or vishing attack.

Privilege Escalation

The exploitation of a vulnerability to gain elevated access to resources that are normally restricted.

Prompt Injection

An attack against an AI system that embeds malicious instructions within input data, such as a document, webpage, or user message, to manipulate the model into ignoring its original instructions or taking unintended actions. It is considered one of the most significant security risks for LLM-based applications and agents, because it exploits the model's inability to reliably distinguish trusted instructions from untrusted data.

Proof of Concept (PoC)

Code or a demonstration created to prove that a specific vulnerability is genuinely exploitable, typically without the full weaponization needed for a real attack. Public release of a PoC can significantly accelerate real-world exploitation, since it lowers the skill barrier for other attackers to build a working exploit.

Pseudorandom Number Generator (PRNG)

An algorithm that produces number sequences that appear random but are fully determined by an initial seed. Cryptographic systems require cryptographically secure PRNGs; a predictable or poorly seeded PRNG in key or wallet generation lets attackers reproduce 'random' secrets and has caused real-world key-theft incidents.

Purdue Model

A reference architecture that organizes an industrial control network into hierarchical levels — from the physical process at the bottom to enterprise IT systems at the top — to guide network segmentation between IT and OT. It remains a foundational reference for ICS security design even as IT/OT convergence blurs its original strict boundaries.

Purple Team

A collaborative security exercise in which red team and blue team staff work together in real time, sharing attack techniques and detection outcomes, to improve detection and response capabilities faster than either working in isolation.

Race Condition

A software flaw that occurs when the behavior of a system depends on the timing or sequence of uncontrollable events, such as two threads accessing shared data simultaneously; attackers can exploit the resulting timing window to bypass a security check. Time-of-check-to-time-of-use bugs are a common race condition subtype.

RAG

Retrieval-Augmented Generation — An architecture that improves an LLM's responses by retrieving relevant information from an external knowledge source, such as a document database, at query time and providing it as context to the model. It introduces its own security considerations, since retrieved content, including attacker-controlled documents, becomes part of the model's effective instructions.

Ransomware

Malware that encrypts a victim's files and demands payment for the decryption key.

Ransomware-as-a-Service (RaaS)

A business model in which ransomware developers lease their malware and infrastructure to affiliates, who carry out the actual attacks and split the ransom payment with the developer. RaaS has significantly lowered the technical barrier to launching a ransomware attack, driving much of the growth in ransomware incidents over the past several years.

RCE

Remote Code Execution — A vulnerability that allows an attacker to execute arbitrary code on a target system remotely.

Reconnaissance

The information-gathering phase of an attack, in which an adversary studies a target's systems, employees, and defenses — through passive methods like OSINT or active methods like network scanning — before attempting an intrusion. It is the first stage in most attack lifecycle models, including the Cyber Kill Chain.

Red Team

A group of security professionals who simulate real-world adversary tactics, techniques, and procedures against an organization to test its detection and response capabilities under realistic conditions. Unlike a penetration test, which often focuses on finding as many vulnerabilities as possible, a red team engagement typically focuses on achieving a specific objective while evading detection.

Remote Access Trojan (RAT)

A type of trojan malware that gives an attacker covert, persistent remote control over an infected system, typically including capabilities like file transfer, keystroke logging, and webcam or microphone access. RATs are frequently used to establish a long-term foothold for further lateral movement or data theft.

Remote Desktop Protocol (RDP)

A Microsoft protocol that allows a user to remotely connect to and control another computer's desktop over a network. Exposed, weakly authenticated RDP services are one of the most common initial access vectors for ransomware operators, who scan the internet for open RDP ports and brute-force or purchase valid credentials.

Remote Monitoring and Management (RMM)

Software that IT providers and internal teams use to remotely administer fleets of machines — deploying patches, running scripts, and accessing desktops. Because RMM tools are powerful and trusted, attackers increasingly abuse legitimate RMM software for persistence and remote control, and compromising an MSP's RMM platform yields access to every downstream customer.

Risk Assessment

A systematic process of identifying assets, the threats and vulnerabilities that could affect them, and the likelihood and impact of those risks materializing, used to prioritize security investments. It is a foundational input to any risk management or compliance program.

Role-Based Access Control (RBAC)

An authorization model in which permissions are attached to roles, and users acquire permissions by being assigned roles rather than individually. RBAC simplifies least-privilege administration at scale; misconfigured or overly broad roles are a leading cause of cloud and Kubernetes privilege escalation.

Rootkit

Malware designed to gain and conceal privileged access to a system, often by modifying the operating system's core components to hide its own processes, files, and network connections from standard monitoring tools. Because rootkits can subvert the OS itself, they are among the hardest malware types to detect and remove.

Sandbox

An isolated, controlled environment used to safely execute and observe untrusted or suspicious code, such as a malware sample or an email attachment, without risking the host system or network. Both malware analysts and automated security tools use sandboxing to detect malicious behavior before it can cause harm.

Sandbox Evasion

Techniques malware uses to detect when it is running inside an analysis sandbox — such as checking for signs of virtualization, a lack of user activity, or a shortened analysis window — and altering its behavior, or simply not executing, to avoid revealing its malicious functionality.

SASE

Secure Access Service Edge — A network architecture that converges wide-area networking with security functions like CASB, secure web gateway, and zero trust network access into a single, cloud-delivered service. It is designed for a workforce that connects from anywhere, rather than assuming most traffic passes through a central corporate data center.

SBOM

Software Bill of Materials — A formal, machine-readable inventory of all the components, libraries, and dependencies that make up a piece of software. SBOMs let organizations quickly determine whether they are affected when a vulnerability is disclosed in a widely used component, as happened with Log4Shell.

SCADA

Supervisory Control and Data Acquisition — A category of ICS used to monitor and control geographically dispersed industrial processes, such as pipelines, power transmission, and water distribution, from a centralized control room. SCADA systems were historically designed for reliability and isolation rather than resistance to network-based attacks.

Script Kiddie

A derogatory term for an unskilled attacker who uses existing hacking tools, scripts, or exploits developed by others without understanding the underlying techniques. Despite limited sophistication, script kiddies can still cause real damage, since many publicly available tools are highly effective.

Secrets Management

The practice of securely storing, distributing, and rotating sensitive credentials such as API keys, passwords, and certificates used by applications and automated systems, typically through a dedicated vault rather than hardcoding them into source code. Hardcoded secrets accidentally committed to public code repositories are a recurring, preventable cause of breaches.

Secure Shell (SSH)

The standard protocol for encrypted remote login and command execution on servers and network equipment, replacing plaintext predecessors like Telnet. SSH keys are prized credentials: stolen or unmanaged keys grant durable, often unmonitored access, and exposed SSH services are a constant brute-force target.

Secure Software Development Lifecycle (SSDLC)

A software development process that integrates security activities — threat modeling, secure coding standards, static and dynamic testing — at every phase, rather than testing for vulnerabilities only after the software is built. It is the process-level counterpart to the DevSecOps culture.

Security Awareness Training

Ongoing education programs that teach employees to recognize and respond appropriately to threats like phishing, social engineering, and unsafe data handling. Because human error remains a leading factor in breaches, awareness training is considered a core control alongside technical defenses.

Session Hijacking

An attack in which an adversary takes over a valid, already-authenticated user session, typically by stealing a session cookie or token, to impersonate that user without needing their password. It is often carried out through cross-site scripting, network sniffing on unencrypted connections, or malware.

Shadow AI

The unsanctioned or unmanaged use of AI tools and services by employees, outside of any security review or governance process — for example, pasting confidential company data into a public chatbot. It creates data-exposure and compliance risk similar to shadow IT, but specific to how generative AI tools process and sometimes retain submitted input.

Shadow IT

Hardware, software, or cloud services used within an organization without explicit approval or visibility from the IT or security department. Because these systems bypass standard security review, they often lack proper configuration, patching, or monitoring, creating unmanaged risk.

Shift Left

A software development philosophy that moves security testing and considerations earlier in the development process, rather than treating it as a final check before release. It is a core principle behind DevSecOps.

SIEM

Security Information and Event Management — Software that aggregates and analyzes security data from across an organization's IT infrastructure.

SIM Swapping

An attack in which a fraudster tricks or bribes a mobile carrier into transferring a victim's phone number to a SIM card the attacker controls, allowing them to intercept SMS-based one-time codes and account recovery messages. It is a major reason security guidance now favors app-based or hardware MFA over SMS.

Smishing

Phishing conducted via SMS text message, typically containing a malicious link or a request to call a fraudulent number, exploiting the higher trust and lower scrutiny people often give to text messages compared to email.

SOAR

Security Orchestration, Automation, and Response — A platform that lets security teams define automated playbooks to handle repetitive incident-response and investigation tasks, connecting disparate security tools together. SOAR is typically deployed alongside a SIEM to reduce analyst workload and speed up response times.

SOC

Security Operations Center — A centralized team that monitors, detects, and responds to cybersecurity incidents.

SOC 2

An auditing standard, developed by the AICPA, that evaluates a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy. A SOC 2 report is commonly requested by enterprise customers as evidence that a SaaS vendor handles their data responsibly.

Social Engineering

The psychological manipulation of people into performing actions or divulging confidential information, exploiting trust, urgency, authority, or fear rather than technical vulnerabilities. Phishing, pretexting, and baiting are all forms of social engineering.

Software as a Service (SaaS)

Software delivered and managed by a vendor over the internet, consumed through a browser or API rather than installed locally. SaaS shifts patching and infrastructure security to the provider, but leaves the customer responsible for identity, access configuration, and data-sharing settings — where most SaaS breaches originate.

Spear Phishing

A targeted phishing attack aimed at a specific individual or organization, using personalized information — the target's name, role, or recent activities — to appear more convincing than a generic phishing email. It is significantly more effective than mass phishing precisely because of that customization.

Spoofing

The act of disguising a communication or identity — an email sender, an IP address, a phone number, or a website — to appear as though it comes from a trusted source, in order to deceive a victim or bypass a security control. It underlies many other attack techniques, including phishing, DNS spoofing, and ARP spoofing.

Spyware

Malware that covertly monitors a victim's activity — keystrokes, browsing habits, location, communications — and transmits the collected data to an attacker, typically without any visible sign of infection. Commercial 'stalkerware' and nation-state-grade spyware fall on different ends of the same technical spectrum.

SQL Injection (SQLi)

A code injection technique that exploits insufficient input validation in an application to insert malicious SQL statements into a database query, potentially allowing an attacker to read, modify, or delete data, or bypass authentication entirely. It has remained one of the most common and damaging web application vulnerabilities for over two decades, and is reliably prevented with parameterized queries.

SSO

Single Sign-On — An authentication scheme that allows a user to log in once and gain access to multiple independent applications or systems without re-authenticating for each one. Because a single compromised SSO credential can expose every connected application, SSO is typically paired with strong MFA.

SSRF

Server-Side Request Forgery — A vulnerability that tricks a server into making an unintended network request on the attacker's behalf, often used to reach internal systems that are not directly accessible from the internet, such as cloud metadata services. It has been the root cause of several high-profile cloud data breaches.

STIX/TAXII

STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol used to share it between systems. Together they let threat intelligence platforms and organizations exchange indicators and context in a machine-readable, consistent format.

Supply Chain Attack

An attack that targets less-secure elements in a supply chain to compromise a primary target through trusted software or hardware.

Tabletop Exercise

A discussion-based incident response drill in which stakeholders walk through a simulated security incident scenario to test decision-making, communication, and plans, without actually executing any technical actions against live systems. It is a lower-cost, lower-risk complement to full technical exercises like red team engagements.

Threat Actor

Any individual, group, or organization that carries out, or has the intent and capability to carry out, actions harmful to an organization's information systems, ranging from lone criminals to organized nation-state units. Categorizing threat actors by motivation and sophistication helps organizations prioritize which defenses matter most for their specific risk profile.

Threat Hunting

A proactive security practice in which analysts actively search through networks and systems for signs of hidden threats that automated detection tools have missed, rather than waiting for an alert. It typically starts from a hypothesis, informed by threat intelligence or unusual telemetry, rather than a known indicator of compromise.

Threat Intelligence

Evidence-based knowledge — including indicators, context, mechanisms, and actionable recommendations — about existing or emerging threats, gathered and analyzed to inform security decisions. It is typically categorized into strategic, operational, and tactical tiers, ranging from executive-level trends to specific indicators and TTPs.

Threat Intelligence Platform (TIP)

Software that aggregates, correlates, and manages threat intelligence data from multiple internal and external sources, helping analysts prioritize and act on it, and often integrating with a SIEM or SOAR to operationalize indicators automatically.

Threat Landscape

The overall collection of threats — active campaigns, prevalent malware families, exploited vulnerabilities, and adversary trends — relevant to an organization, industry, or region at a given point in time. It shifts continuously, which is why threat intelligence reporting is produced on an ongoing basis rather than as a one-time assessment.

Threat Model

A structured process of identifying potential threats to a system, application, or organization, and the corresponding countermeasures, typically performed during design so security is built in rather than bolted on afterward. Common methodologies include STRIDE and PASTA.

Threat Modeling

The structured practice of identifying what can go wrong in a system before it is attacked: enumerating assets, likely adversaries, attack surfaces, and mitigations. Methodologies such as STRIDE give teams a repeatable way to find design-level flaws that code review and scanning cannot see.

TLS/SSL

Transport Layer Security, and its deprecated predecessor Secure Sockets Layer, are cryptographic protocols that encrypt data transmitted over a network, most visibly securing web traffic as HTTPS. TLS ensures confidentiality, integrity, and, via certificates, authentication of the communicating parties.

Traffic Distribution System (TDS)

A malicious redirection service that routes web visitors to different destinations — exploit kits, scam pages, or malware downloads — based on their device, location, and origin. TDS platforms sit between compromised or malicious sites and final payloads, letting criminal operations filter victims and evade researchers.

Transport Layer Security (TLS)

The cryptographic protocol that secures most internet traffic, providing encryption, integrity, and server authentication for HTTPS and many other protocols. TLS replaced SSL; downgrade attacks, certificate mis-issuance, and expired or misconfigured certificates remain its practical failure modes.

Trojan Horse

Malware disguised as, or bundled with, legitimate-looking software to trick a user into installing it, unlike a virus or worm, which do not require the user to be deceived into voluntary installation. Once installed, a trojan can carry out a wide range of malicious actions, from data theft to opening a backdoor.

TTP

Tactics, Techniques, and Procedures — Behavioral patterns used by threat actors to carry out attacks.

Two-Factor Authentication (2FA)

A specific form of multi-factor authentication that requires exactly two independent verification factors, most commonly a password plus a one-time code from an app, SMS, or hardware token. It is one of the most widely deployed forms of MFA, though SMS-based 2FA is considered weaker than app-based or hardware-based methods due to SIM-swapping risk.

Typosquatting

Registering domain names that are deliberate misspellings or close variations of legitimate, popular domains to capture traffic from users who mistype a URL, often to deliver phishing pages or malware. It is also used against software package names in dependency confusion-style supply chain attacks.

UEBA

User and Entity Behavior Analytics — Security tools that establish a baseline of normal behavior for users and devices, then use analytics, often machine learning, to flag statistically anomalous activity. It is particularly effective at catching insider threats and compromised accounts that use valid credentials.

Use-After-Free

A memory-corruption vulnerability that occurs when a program continues to use a pointer after the memory it points to has been freed, which an attacker can exploit to execute arbitrary code or crash the application. It is a common root-cause class for browser and OS-kernel zero-days.

User Account Control (UAC)

The Windows mechanism that prompts for consent before a process gains administrative privileges, limiting silent privilege escalation. UAC bypass techniques — abusing auto-elevating Windows binaries — are a staple of malware seeking admin rights without triggering the prompt.

Vishing

Phishing conducted over a phone call, in which an attacker impersonates a trusted party — IT support, a bank, or a government agency — to manipulate the victim into revealing information or taking a harmful action. AI-generated voice cloning has made vishing significantly more convincing in recent years.

VM Escape

An exploit that breaks out of a virtual machine's isolation to execute code on the host hypervisor or in other guest VMs. VM escapes are among the most severe vulnerability classes in cloud computing, because a single malicious tenant could compromise infrastructure shared by many customers.

VPN

Virtual Private Network — A technology that creates an encrypted tunnel between a device and a network over the public internet, protecting data in transit and allowing remote access to internal resources as though directly connected. Corporate VPN gateways are a frequently targeted attack surface, since a single compromised credential or unpatched appliance can provide broad internal network access.

Vulnerability

A weakness in a system, application, or process that could be exploited by a threat actor to compromise its confidentiality, integrity, or availability. Not every vulnerability is actively exploited or even exploitable in practice, which is why scoring systems like CVSS and EPSS exist to help prioritize remediation.

Vulnerability Disclosure

The process by which a security researcher reports a discovered vulnerability to the affected vendor, ideally coordinated so a fix is available before public details are released. Disagreements over disclosure timelines between researchers and vendors remain a recurring source of friction in the industry.

Vulnerability Management

The continuous, cyclical process of identifying, evaluating, prioritizing, and remediating vulnerabilities across an organization's systems, typically combining automated scanning with a defined patching and risk-acceptance workflow. It differs from a one-time penetration test by being an ongoing program rather than a point-in-time assessment.

WAF

Web Application Firewall — A security control that filters, monitors, and blocks HTTP traffic to and from a web application, defending against common attacks like SQL injection and cross-site scripting at the application layer. Unlike a traditional network firewall, a WAF inspects the content of web requests rather than just ports and protocols.

Watering Hole Attack

An attack strategy in which an adversary compromises a website that its intended victims are known to visit, rather than targeting them directly, and plants malware there to infect visitors. It is named after predators that wait near a watering hole rather than chasing individual prey.

Whaling

A form of spear phishing that specifically targets senior executives or other high-value individuals within an organization, often to authorize fraudulent wire transfers or access highly sensitive information. Its name reflects the size of the target relative to a typical phishing victim.

Whitelisting (Application Allowlisting)

A security control that permits only explicitly approved applications, scripts, or processes to run on a system, blocking everything else by default. It is a stricter, default-deny alternative to traditional blocklist-based antivirus, which only blocks what it already recognizes as malicious.

Wiper Malware

Malware designed to permanently destroy or corrupt data on a target system, rather than steal it or hold it for ransom, with the goal of causing maximum disruption. Wiper attacks are frequently associated with nation-state actors during geopolitical conflicts, sometimes disguised as ransomware to obscure the true motive.

Worm

Self-replicating malware that spreads automatically across networks and systems by exploiting vulnerabilities, without requiring any user interaction, unlike a virus, which needs a host program or user action to propagate. Because they self-propagate, worms can spread extremely quickly once released.

XDR

Extended Detection and Response — A security platform that unifies detection and response data across multiple layers, such as endpoint, network, email, and cloud, into a single correlated view, extending the endpoint-only scope of EDR. The goal is to reduce the number of disconnected alerts an analyst must manually piece together during an investigation.

XSS

Cross-Site Scripting — A web vulnerability that allows attackers to inject malicious scripts into pages viewed by other users.

XXE

XML External Entity — A vulnerability that occurs when a weakly configured XML parser processes untrusted input containing a reference to an external entity, potentially exposing internal files, enabling server-side request forgery, or causing denial of service. It is mitigated by disabling external entity processing in the parser configuration.

YARA

A pattern-matching language and tool that analysts use to identify and classify malware by describing textual and binary signatures in 'YARA rules'. YARA rules are the lingua franca of malware research — vendors, CERTs, and researchers publish them so defenders can hunt for the same families across their own environments.

Zero Trust

A security model that requires strict identity verification for every person and device attempting to access resources, regardless of network location.

Zero-Click Exploit

An exploit that compromises a target device without requiring any interaction from the victim, purely by exploiting a flaw in how the device processes incoming data. Zero-click exploits are especially prized, and expensive on exploit markets, because they leave the victim with no opportunity to avoid the attack.

Zero-Day

A vulnerability that is unknown to the software vendor and has no available patch, making it highly valuable to attackers.