A working reference spanning identity, cloud, application security, cryptography, threat intelligence, GRC, and every other corner of the space I've built go-to-market motions around. Plain-language definitions, no vendor pitch.
Unauthorized access to a legitimate user's account, typically achieved using stolen or reused credentials. ATO is the most common outcome of credential stuffing and infostealer infections.
An authentication model that adjusts the required verification steps based on contextual risk signals such as device, location, or behavior, rather than applying the same challenge to every login.
A sophisticated, typically well-resourced threat actor, often state-sponsored, that gains and maintains long-term covert access to a target network for espionage or strategic disruption.
The study and exploitation of techniques that manipulate machine learning models through crafted inputs designed to cause misclassification or unintended behavior.
Security risk introduced by AI systems that can autonomously take multi-step actions, including calling tools and making decisions, expanding the potential impact of a manipulated or malfunctioning model.
A structured inventory of the models, datasets, and components used to build an AI system, used to assess and track exposure when a component is found to be risky or compromised.
The policies, oversight structures, and controls an organization uses to manage the development, deployment, and risk of artificial intelligence systems.
The practice of adversarially testing AI systems to uncover vulnerabilities such as prompt injection, jailbreaks, and unsafe outputs before deployment.
A network security measure that physically isolates a system or network from unsecured networks, including the internet, to prevent remote compromise.
A network physically isolated from other networks, including the internet, historically used to protect industrial control systems, though increasingly bridged by convenience connections.
The desensitization a security team experiences from an excessive volume of alerts, often driven by low-fidelity detections, leading to slower response and missed threats.
A DDoS technique that spoofs a victim's IP address in small requests to third-party servers, which then send disproportionately large responses to the victim. It happens because certain protocols (DNS, NTP, memcached) return far more data than they receive, letting an attacker multiply a small amount of traffic into an overwhelming flood.
The chronic stress and fatigue experienced by security operations staff due to alert volume, on-call pressure, and the high-stakes nature of the work, a leading driver of SOC turnover.
Software that detects and removes known malware based on signature matching, forming a baseline but increasingly insufficient layer of endpoint defense.
The practices and controls that protect application programming interfaces from abuse, including authentication enforcement, rate limiting, and input validation.
A security control that permits only explicitly approved applications to run on a system, blocking everything else by default.
A denial-of-service attack that targets application logic, such as search or login endpoints, rather than raw network bandwidth. It happens because these requests look like normal user traffic and are expensive for the backend to process, so a relatively small volume can exhaust server resources that volumetric defenses aren't tuned to catch.
An attack in which a threat actor sends falsified Address Resolution Protocol messages to associate their own MAC address with a legitimate IP address on a local network, enabling traffic interception.
A security mindset that designs defenses under the assumption an attacker is already inside the environment, prioritizing detection, containment, and limiting blast radius over perimeter prevention alone.
An encryption method that uses a mathematically linked public and private key pair, allowing data encrypted with one key to be decrypted only with the other.
The continuous discovery, inventory, and assessment of an organization's externally exposed assets to identify unmanaged or unknown points of exposure.
A formal statement, often from an auditor or executive, confirming that a control, process, or set of controls meets a specified standard.
An access control model that grants permissions based on a combination of user, resource, and environmental attributes, rather than fixed roles alone.
The process of linking an anonymous online identity, alias, or digital artifact to a verified real-world individual or threat actor group.
A chronological, tamper-evident record of system and user activity used to reconstruct events for security investigations, audits, or compliance verification.
Luring a victim with something enticing, such as a free download or a USB drive left in a parking lot, that delivers malware once used. It happens because curiosity or the promise of something free is often enough to override caution, and it requires no direct interaction with the target beforehand.
The unauthorized manipulation of Border Gateway Protocol routing tables to redirect internet traffic through an attacker-controlled path, often for interception or denial of service.
Verification of identity using a physical or behavioral trait, such as a fingerprint, face, or typing pattern, in place of or alongside a password.
The scope of systems, data, and users affected, or potentially affected, by a security incident once it has occurred.
The defensive security team responsible for detecting, responding to, and defending against simulated or real attacks.
Sending unsolicited messages or data to a nearby device over Bluetooth without the owner's consent. It happens because discoverable Bluetooth devices in range can often receive unsolicited connection requests, and while largely a nuisance rather than a serious compromise, it demonstrates how exposed an unsecured wireless interface can be.
Gaining unauthorized access to data, such as contacts or messages, on a device through a Bluetooth connection. It happens because older or misconfigured Bluetooth implementations allowed data access without proper pairing authentication, letting an attacker in range pull information off the device directly.
A network of compromised devices controlled remotely by an attacker, commonly used to conduct DDoS attacks, distribute spam, or mine cryptocurrency at scale.
A threat actor who specializes in acquiring and reselling breach data or unauthorized access on criminal marketplaces, distinct from those who conduct the original intrusion.
The legally or contractually required disclosure to affected individuals, regulators, or partners following a confirmed data breach, with timelines that vary by jurisdiction and data type.
A vulnerability class in which an application fails to properly enforce restrictions on what authenticated users are allowed to do, consistently ranked among the most exploited application flaws.
Systematically trying large numbers of password or key combinations until one succeeds. It happens simply because weak, short, or reused passwords make exhaustive guessing computationally feasible, especially against accounts without lockout or rate-limiting controls.
A misconfiguration in which a cloud storage bucket is left publicly accessible, exposing its contents to anyone who discovers the address.
Writing more data into a fixed-size block of memory than it was allocated to hold, overwriting adjacent memory in the process. It happens because some languages and legacy code don't automatically enforce memory boundaries, and a carefully crafted overflow can corrupt program execution enough to run attacker-supplied code.
An attack that infiltrates the automated systems used to build and deploy software, allowing malicious code to be inserted before it reaches customers.
A social engineering attack in which a threat actor impersonates a company executive or trusted partner via email to redirect payments or exfiltrate sensitive information.
A vulnerability that exploits the intended workflow of an application in an unintended way, such as manipulating a checkout process, rather than a traditional code-level bug.
A California state law that grants consumers rights over the personal data collected about them by businesses, including access, deletion, and opt-out of sale.
A trusted entity that issues digital certificates, verifying the identity of the certificate holder and enabling secure, authenticated communication.
A security technique that hardcodes an application's trust to a specific certificate or public key, preventing acceptance of a fraudulent certificate even if it is signed by a trusted CA.
The documented, unbroken record of how digital evidence was collected, handled, and stored, required to preserve its admissibility in legal or regulatory proceedings.
Tricking a user into clicking something other than what they perceive, typically by overlaying an invisible malicious button or link on top of a legitimate page. It happens because browsers allow one site to be framed inside another by default, and without protections like frame-busting headers, an attacker can hijack a genuine click for an unintended action.
A control point between users and cloud service providers that enforces security policies such as visibility, data protection, and threat prevention across sanctioned and unsanctioned cloud apps.
A credential issued to authenticate and authorize programmatic access to cloud resources, valuable to attackers because it can often bypass interactive login controls entirely.
A security capability focused on detecting and responding to active threats within cloud environments in near real time, complementing the preventive focus of CSPM.
A discipline focused on identifying and right-sizing excessive permissions across cloud identities and services, reducing the blast radius of a compromised credential.
A consolidated platform category that combines CSPM, CWPP, CIEM, and related capabilities to secure cloud-native applications across their full lifecycle.
Tools and processes that continuously identify misconfigurations and compliance risks across cloud environments before they are exploited.
The uncontrolled proliferation of cloud accounts, services, and resources across an organization, making consistent security governance difficult.
Security tooling focused on protecting individual cloud workloads, such as virtual machines, containers, and serverless functions, at runtime.
The cryptographic signing of software to verify its publisher and confirm it has not been altered since release, a control frequently targeted by supply chain attackers who steal signing certificates.
A compiled file of username and password pairs, typically aggregated from multiple breach sources, used as raw input for credential stuffing tools.
The infrastructure and channels an attacker uses to communicate with and control compromised systems after initial infection.
Inserting operating system commands into an application's input so they're executed by the underlying server. It happens because the application passes unsanitized input directly to a system shell, giving the attacker the same command-line access as the application itself.
The risk created when an organization relies heavily on a single vendor, platform, or supplier, such that a disruption to that one party has an outsized impact.
The practice of securing containerized applications across build, deployment, and runtime, including image scanning, orchestration hardening, and runtime threat detection.
An access model that evaluates real-time contextual signals, such as device health, location, and behavior, before granting or denying a request.
An authentication approach that continually verifies a user's identity throughout a session based on ongoing behavioral and contextual signals, rather than only at login.
The practice of securing the automated pipelines that build, test, and deploy software, a frequent target for supply chain attacks given their privileged access to source code and production systems.
The ongoing, automated assessment of a vendor's security posture over the life of the relationship, rather than relying solely on a point-in-time assessment.
A structured set of security and governance controls, such as NIST CSF or ISO 27001, used to organize, implement, and assess an organization's risk management program.
Tampering with the contents of a cookie to escalate privileges, bypass validation, or impersonate another user. It happens because some applications trust cookie values as authoritative without re-validating them server-side, so a modified cookie can walk straight through a weak access check.
The practice of silently dropping affiliate tracking cookies into a victim's browser without their knowledge, usually via hidden iframes or redirects. It happens because affiliate programs pay out on whichever cookie is present at checkout, so stuffing lets an attacker claim commission on sales they had no real part in.
A logic rule within a SIEM or detection platform that identifies a threat pattern by connecting multiple related events that would not be significant on their own.
The condition where a user's login credentials have appeared in a breach dataset, infostealer log, or dark web listing and may be known to unauthorized parties.
The mass collection of usernames and passwords through fake login pages, malware, or breached databases, typically for resale or later use in credential stuffing. It happens because stolen credentials remain one of the most reliable ways into an account, and harvesting at scale is more efficient than targeting individuals one at a time.
An automated attack that tests large volumes of stolen username-password pairs against many services, exploiting password reuse across accounts.
Systems and assets, such as power grids, water treatment, and transportation, considered essential to public safety and economic stability, and a priority target for nation-state threat actors.
An attack that tricks an authenticated user's browser into submitting an unwanted request to a web application in which they are currently logged in.
A vulnerability that allows an attacker to inject malicious scripts into content served to other users, executing in their browser session.
The ability of a system to swap out cryptographic algorithms or key sizes without major redesign, an increasingly important property as quantum-resistant standards emerge.
The unauthorized use of a victim's computing resources to mine cryptocurrency, typically through malware or a compromised browser script.
The portion of the internet accessible only through specific software, such as Tor, that is not indexed by standard search engines and hosts many criminal marketplaces and forums.
The continuous surveillance of dark web marketplaces, forums, and paste sites for stolen credentials, data, or intelligence tied to a monitored organization or individual.
The process of categorizing data based on sensitivity and business value, forming the basis for applying appropriate handling and protection controls.
The process of identifying and cataloging where sensitive data lives across an organization's systems, including data an organization may not know it holds.
The unauthorized transfer of data out of an organization's environment, typically the objective stage of a targeted breach or insider theft.
A website operated by a ransomware group to publish stolen data from victims who refuse to pay, used as leverage in double extortion schemes.
The governance of data from creation through storage, use, archival, and secure deletion, ensuring appropriate protection is applied at each stage.
A set of tools and policies that detect and prevent sensitive data from leaving an organization's control, whether by accident or malicious intent.
A technique that obscures sensitive data with realistic but fictional values, allowing systems to be tested or used without exposing the underlying real data.
A logical boundary defining where an organization's sensitive data is permitted to move and be accessed, enforced through policy rather than physical network location.
An attack that corrupts the training data used to build a machine learning model, intentionally degrading its accuracy or embedding a hidden malicious behavior.
A legal contract between a data controller and a data processor that defines how personal data will be handled, secured, and protected on the controller's behalf.
A structured process for identifying and mitigating privacy risks before launching a project or system that processes personal data, required under GDPR for high-risk processing.
The requirement or practice of storing data within a specific geographic or jurisdictional boundary, often driven by regulatory obligations.
The principle that data is subject to the laws of the country in which it is collected or stored, a key driver of data residency requirements.
A formal request by an individual for an organization to disclose, correct, or delete the personal data it holds about them, as provided under privacy regulations such as GDPR and CCPA.
An attack that overwhelms a target system or network with traffic from many distributed sources, degrading or denying service to legitimate users.
An identity model in which individuals hold and control verifiable credentials directly, rather than relying on a central authority or identity provider to vouch for them.
Security tooling that plants decoy assets, credentials, or data within an environment to detect and mislead attackers who interact with them.
The portion of the internet not indexed by public search engines but accessible without special software, including private databases and closed forums.
AI-generated synthetic media, typically audio or video, that convincingly impersonates a real person and is increasingly used in fraud and social engineering.
An attack that exploits package manager resolution logic to trick a build system into pulling a malicious public package instead of an intended internal one with the same name.
The risk introduced by relying on third-party code libraries or components, which may contain vulnerabilities or be compromised without the consuming organization's knowledge.
The discipline of designing, building, testing, and tuning detection logic to reliably identify malicious activity while minimizing false positives.
An assessment of a device's security state, such as patch level, encryption status, and running software, used to determine whether it should be granted access.
A measure of confidence in a device's security posture, used as a gating factor for access decisions independent of the identity attempting to connect.
An operating model that integrates security practices directly into development and operations workflows, rather than treating security as a separate, later-stage gate.
The discipline of collecting, preserving, and analyzing digital evidence to reconstruct what happened during a security incident.
A security category focused on monitoring and remediating threats to an organization's external digital presence, including credential exposure, impersonation, and brand abuse.
A cryptographic mechanism that verifies the authenticity and integrity of a message or document, confirming it came from a specific sender and was not altered.
The full network of software, services, and vendors an organization depends on to build and deliver its products, each representing a potential point of compromise.
The protection of virtual replicas of physical systems used for simulation and monitoring, which can themselves become an attack vector back into the physical system they model.
Manipulating file path input, often using sequences like '../', to access files outside a web application's intended directory. It happens because the application builds file paths from user input without properly validating or sanitizing it, letting an attacker walk up the directory tree to reach sensitive files.
An email authentication standard that adds a digital signature to outgoing messages, allowing receiving servers to verify the message was not altered in transit and came from an authorized sender.
An email authentication policy that builds on SPF and DKIM, telling receiving mail servers how to handle messages that fail verification and enabling domain owners to see abuse of their domain.
Corrupting a DNS resolver's cache with a forged record so it keeps returning a malicious IP address for a legitimate domain until the entry expires. It happens because resolvers historically accepted the first matching response without strong verification, and poisoning the cache is more persistent and higher-impact than spoofing a single query.
An attack that corrupts DNS resolution to redirect users from a legitimate domain to a malicious one, often to harvest credentials or distribute malware.
An EU regulation that establishes uniform requirements for the operational resilience, incident reporting, and third-party risk management of financial entities.
A ransomware tactic in which attackers both encrypt a victim's data and threaten to publish it publicly, applying pressure to pay even if backups make decryption unnecessary.
Forcing a connection to fall back to an older, weaker protocol or cipher suite that's easier to break. It happens because many systems keep legacy versions enabled for compatibility, and an attacker positioned in the network path can exploit that fallback to negotiate weaker encryption than either endpoint would normally choose.
Malware that is automatically downloaded and installed on a victim's device simply by visiting a compromised or malicious website, without any further action required.
The length of time an attacker remains undetected inside a compromised environment between initial access and discovery.
A testing method that analyzes a running application from the outside, simulating attacker behavior to find exploitable vulnerabilities without access to source code.
A public-key cryptography approach based on the algebraic structure of elliptic curves, offering equivalent security to older algorithms with smaller key sizes.
The forging of an email header so a message appears to come from a trusted sender other than its actual origin.
The practice of securing purpose-built computing devices embedded within larger machinery, often constrained by limited processing power and infrequent update cycles.
The encryption of stored data, protecting it from unauthorized access if the underlying storage medium or system is compromised.
The encryption of data as it moves across a network, protecting it from interception between sender and recipient.
Security technology that continuously monitors endpoint activity to detect, investigate, and respond to threats that evade preventive controls.
An integrated suite of preventive endpoint security capabilities, including antivirus, firewall, and device control, delivered from a single agent.
Short-lived compute resources, such as serverless functions or auto-scaled instances, that exist briefly and complicate traditional monitoring approaches built for persistent infrastructure.
A packaged toolkit that automatically scans a visitor's browser and plugins for known vulnerabilities and delivers a matching exploit, often used to distribute malware at scale.
A security architecture that correlates data across endpoint, network, cloud, and identity layers to provide broader detection and response than any single tool alone.
A malicious event that a detection system fails to flag, representing a gap in coverage that allows a real threat to go unnoticed.
A security alert that incorrectly identifies a benign event as malicious, contributing to alert fatigue and wasted analyst time.
A technique that rapidly rotates the DNS records pointing to a malicious domain across a large pool of compromised hosts. It happens because it makes the infrastructure behind phishing sites, botnets, and malware distribution much harder to block or take down, since the underlying IPs are constantly changing.
An open authentication standard that enables passwordless or phishing-resistant login using public-key cryptography and a local authenticator such as a security key or device biometric.
Malware that operates in memory rather than writing a file to disk, using legitimate system tools to avoid detection by traditional signature-based defenses.
A network security control that monitors and filters incoming and outgoing traffic based on a defined set of rules, forming a baseline perimeter defense.
The protection of the low-level software that controls a device's hardware, a persistent and difficult-to-detect target for attackers seeking long-term footholds.
An exact, bit-for-bit copy of a storage device or system created for forensic analysis, preserving the original evidence untouched.
Injecting malicious code into a legitimate website's checkout or form page to silently skim payment details and personal data as visitors type them in. It happens because a single compromised third-party script or plugin can quietly capture form input in real time, often for months before anyone notices.
Risk introduced by the vendors and subcontractors that an organization's own third-party vendors rely on, one layer removed from direct visibility.
An automated testing technique that feeds malformed or unexpected input into a program to uncover crashes, memory issues, and exploitable edge cases.
An EU regulation that governs the collection, processing, and protection of personal data of individuals within the European Union, with significant penalties for noncompliance.
The category of security, privacy, and compliance risks introduced by the use of generative AI tools, including data leakage, hallucinated outputs, and unvetted third-party model use.
Forging a Kerberos ticket-granting ticket to gain persistent, near-unrestricted access across an entire Windows domain. It happens when an attacker has already compromised the account that signs Kerberos tickets, turning a single deep compromise into standing, hard-to-revoke access that survives normal password resets.
An integrated approach to managing an organization's overall governance, enterprise risk, and regulatory compliance activities.
An output from a generative AI model that is fabricated or factually incorrect but presented with confidence, a risk factor when AI outputs inform security or business decisions without verification.
A dedicated physical device that generates, stores, and manages cryptographic keys in a tamper-resistant environment.
A one-way mathematical function that transforms input data into a fixed-length string, used to verify data integrity and, with salting, to protect stored passwords.
A U.S. federal law that sets national standards for protecting sensitive patient health information from disclosure without consent or knowledge.
An encryption method that allows computation to be performed directly on encrypted data without first decrypting it, preserving confidentiality throughout processing.
A decoy system designed to attract and detect attackers, providing early warning of intrusion attempts and intelligence on attacker tactics without exposing real assets.
A composable layer of interoperable identity services (authentication, governance, directory, and access management) that spans hybrid and multi-cloud environments rather than living in a single platform.
The discipline of managing digital identity lifecycles, entitlements, and access certifications to ensure users have the right access at the right time, and nothing more.
A service that creates, maintains, and authenticates user identities, then asserts that authentication to connected applications, most commonly via SSO.
A security category focused on detecting and responding to attacks that target identity infrastructure itself, such as credential theft, privilege escalation, and session hijacking.
A security approach that treats identity, rather than network location, as the primary control point for granting access to resources.
An attack in which a threat actor poses as a trusted individual, brand, or system to manipulate a target into taking a harmful action.
The assumption that a user or device is trustworthy simply because it is inside a network perimeter, the legacy model that zero trust architecture is designed to replace.
The individual designated to lead and coordinate an organization's response during an active security incident, owning decisions and communication until resolution.
A documented, pre-defined set of procedures for detecting, containing, eradicating, and recovering from a security incident.
Behavioral evidence of an attacker's intent and technique in progress, used to detect malicious activity earlier than static indicators of compromise allow.
Forensic artifacts, such as a malicious file hash, IP address, or domain, that indicate a system has potentially been compromised.
Hardware and software systems used to monitor and control industrial processes, encompassing SCADA systems, PLCs, and related technologies.
Malware designed to silently harvest browser-stored credentials, session cookies, and other sensitive data from an infected device and transmit it to an attacker.
The practice of defining and provisioning infrastructure through machine-readable configuration files, which allows security misconfigurations to be scanned and caught before deployment.
A threat actor who specializes in obtaining and reselling initial network access, often to ransomware operators, forming a key link in the modern attack economy.
A class of vulnerabilities in which untrusted input is interpreted as executable commands or code by an application, of which SQL injection is the most well-known example.
A vulnerability that occurs when an application deserializes untrusted data without proper validation, potentially allowing an attacker to execute arbitrary code.
Accessing another user's data or resource by directly manipulating an identifier, such as an account or file ID, in a URL or API call. It happens because the application checks that the user is logged in but fails to check that they're authorized to see that specific object, so simply changing a number in the request exposes someone else's data.
A security risk originating from someone with authorized access to an organization's systems and data, whether acting maliciously, negligently, or under compromise.
A monitoring system that analyzes network or host activity for signs of malicious behavior and alerts security teams, without taking direct action to block it.
A security control that monitors network traffic for malicious activity and can automatically block or reject it in real time, extending an IDS with active enforcement.
The practices and controls used to secure internet-connected devices, which often ship with weak default credentials and limited built-in protection.
Forging the source IP address in a packet so it appears to come from a trusted or different host. It happens because many network protocols were designed to trust the source address by default, and spoofing it lets an attacker hide their origin, bypass IP-based access controls, or reflect traffic onto a third party.
An international standard specifying requirements for establishing, implementing, and continually improving an information security management system.
A privileged access model that grants elevated permissions only for the duration a task requires, then automatically revokes them, shrinking the window of standing privilege an attacker could exploit.
The processes and infrastructure used to generate, distribute, store, rotate, and revoke cryptographic keys throughout their lifecycle.
The scheduled or triggered replacement of cryptographic keys to limit the amount of data protected by, or exposed by, any single key.
A model that breaks an attack into sequential stages, from reconnaissance through actions on objectives, used to identify where defenses can intercept an intrusion.
The set of practices and controls that secure container orchestration environments, including cluster configuration, workload isolation, and role-based access within the cluster.
A pre-configured, secure baseline environment for provisioning new cloud accounts or workloads, intended to enforce consistent guardrails from the start.
The practices used to secure applications built on large language models against risks such as prompt injection, data leakage, and insecure output handling.
Techniques an attacker uses to move through a network after gaining initial access, expanding reach toward higher-value systems and data.
The principle that a user, application, or system should be granted only the minimum access necessary to perform its function.
An attack technique that uses legitimate, pre-installed system tools rather than custom malware to carry out malicious activity, making detection significantly harder.
The centralized collection of log data from across an organization's systems into a single platform for analysis, correlation, and retention.
A domain registered to closely resemble a legitimate organization's domain, used to support phishing, brand impersonation, and business email compromise.
The use of online advertising to deliver malware, exploiting ad networks to distribute malicious code to visitors of otherwise legitimate websites.
An attack in which a threat actor secretly intercepts and potentially alters communication between two parties who believe they are communicating directly.
An outsourced security service that provides continuous threat monitoring, detection, and response, typically combining human analysts with detection technology.
The average time it takes a security team to identify that a security incident has occurred, a core metric for measuring detection program effectiveness.
The average time it takes a security team to contain and remediate an incident once it has been detected.
The analysis of a system's volatile memory to uncover evidence of malicious activity, including fileless malware that never touches disk.
A social engineering technique in which an attacker bombards a user with repeated multi-factor authentication push notifications, hoping the user approves one out of frustration or confusion.
The practice of dividing a network into granular, isolated zones down to the individual workload level, limiting lateral movement even after a breach occurs.
An improperly set security control, most commonly in cloud environments, such as an open storage bucket or overly permissive identity policy, and one of the leading root causes of cloud breaches.
A publicly maintained knowledge base of real-world adversary tactics and techniques, widely used to structure threat intelligence, detection engineering, and red team exercises.
Software that allows an organization to configure, monitor, and secure mobile devices used to access corporate resources.
An attack that attempts to reconstruct sensitive training data by analyzing a machine learning model's outputs, potentially exposing private information the model was trained on.
The unauthorized extraction or replication of a proprietary machine learning model's parameters or behavior, often through repeated querying of an exposed API.
A defensive strategy that continually changes system attributes, such as configurations or network addresses, to increase the cost and difficulty of an attacker's reconnaissance.
The use of cloud services from more than one provider, which increases architectural flexibility but multiplies the surfaces a security team must monitor and govern.
An authentication method requiring two or more independent verification factors, typically something you know, something you have, and something you are.
An architecture in which a single application instance serves multiple customers, isolated logically rather than physically, requiring strong controls to prevent cross-tenant data exposure.
A security approach that enforces policy on which devices and users can connect to a network, and what level of access they receive once connected.
Endpoint protection that uses behavioral analysis and machine learning to detect malicious activity, extending beyond signature-based antivirus to catch novel threats.
A firewall that adds application awareness, intrusion prevention, and identity integration to traditional port and protocol filtering.
A voluntary framework developed by the U.S. National Institute of Standards and Technology, organized around functions including identify, protect, detect, respond, and recover.
A machine, workload, service account, API key, or other non-person credential that authenticates and acts within a system. Non-human identities now outnumber human ones in most environments and require separate lifecycle, ownership, and governance controls since they can't do MFA or recognize a phishing attempt.
The cumulative risk introduced across an extended, multi-layered chain of vendor dependencies beyond the third and fourth party.
The security exposure created by using open source components, including unpatched vulnerabilities, unmaintained projects, and intentionally malicious packages.
Hardware and software that monitors or controls physical devices and processes, historically isolated from IT networks but increasingly interconnected.
Intelligence gathered from publicly available sources such as social media, public records, and the open web, used in threat research and investigations.
The growing interconnection of operational technology and traditional IT networks, which improves efficiency but exposes previously isolated industrial systems to IT-borne threats.
A regularly updated industry-standard awareness document from the Open Worldwide Application Security Project listing the most critical web application security risks.
The capture and inspection of data packets traveling across a network, used legitimately for diagnostics and maliciously to intercept unencrypted data.
Reusing a stolen password hash to authenticate to a system without ever cracking it into plaintext. It happens because some authentication protocols accept the hash itself as proof of identity, so an attacker who dumps hashes from one compromised machine can move laterally without needing the real password at all.
A historical record of DNS resolution data used in threat investigations to reconstruct domain history and link infrastructure to threat actors.
A phishing-resistant, passwordless credential based on public-key cryptography, synced across a user's devices and tied to a specific website or app to prevent replay on lookalike sites.
Trying one or a few commonly used passwords across many different accounts, rather than many passwords against one account. It happens because most account lockout policies are built to stop repeated guesses on a single username, so spreading the guesses across a wide user base slips under that threshold.
An authentication approach that removes shared secrets like passwords entirely, relying instead on possession-based and biometric factors such as passkeys or hardware tokens.
A web service used to share text content publicly, frequently exploited by threat actors to publish stolen credentials or leaked data.
The process of identifying, testing, and deploying software updates that fix known vulnerabilities, one of the most consistently effective controls against opportunistic attacks.
The Payment Card Industry Data Security Standard, a set of requirements for organizations that handle branded credit card data, designed to reduce payment fraud.
Any data that can be used to identify a specific individual, including name, address, date of birth, and financial or government identification numbers.
A social engineering attack that uses deceptive messages, typically email, to trick recipients into revealing credentials, clicking malicious links, or installing malware.
A predefined, step-by-step set of actions for responding to a specific type of security event, used to ensure consistent and rapid response.
The component in a zero trust architecture that evaluates access requests against policy and determines whether to grant or deny them.
The component in a zero trust architecture that enforces the access decision made by the policy decision point, sitting between the user and the resource.
Malware that continually changes its identifiable code features while keeping its underlying functionality intact, evading signature-based detection.
A reconnaissance technique used to identify open ports and running services on a target system, often a precursor to identifying exploitable vulnerabilities.
A structured evaluation conducted after an incident is resolved to identify root causes, response gaps, and improvements for future readiness.
Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers, which could break widely used current-generation encryption.
A social engineering technique in which an attacker fabricates a plausible scenario or false identity to manipulate a target into disclosing information or granting access.
An approach that embeds privacy protections into the design of systems and processes from the outset, rather than adding them after the fact.
Gaining a higher level of access than was originally granted, either by exploiting a flaw (vertical escalation) or by moving into another account at the same level (horizontal escalation). It happens because an attacker's initial foothold is rarely the level of access they need, so escalating privilege is usually a required step on the way to a valuable target.
A set of controls that secure, monitor, and manage accounts with elevated permissions, reducing the risk that privileged credentials are stolen or misused.
The recording, monitoring, and control of active sessions initiated by privileged accounts, often used to enforce accountability and enable forensic review after an incident.
An industrial computer used to automate physical processes such as assembly lines or utility systems, a frequent target in attacks on industrial environments.
An attack technique that manipulates an AI system's behavior by embedding malicious instructions within its input, potentially overriding intended guardrails.
Health-related information that can be linked to a specific individual and is subject to specific regulatory protection under laws such as HIPAA.
The framework of policies, roles, and technology used to create, manage, distribute, and revoke digital certificates and public keys.
A reference architecture that segments industrial control networks into hierarchical levels, used to design and enforce security boundaries between IT and OT environments.
A collaborative exercise structure in which red and blue teams work together in real time to improve detection and response, rather than operating as adversaries.
The risk that future quantum computers will be able to break widely deployed asymmetric encryption algorithms, driving current migration efforts toward post-quantum standards.
A phishing technique that uses malicious QR codes to direct victims to a fraudulent site, exploiting the fact that scanned links often bypass traditional email link scanning.
Exploiting the timing gap between when a system checks a condition and when it acts on it, short for time-of-check to time-of-use. It happens because that gap gives an attacker a narrow window to change the state of a resource in between, turning a security check that passed a moment ago into one that no longer reflects reality.
Malware that encrypts an organization's files or systems and demands payment for the decryption key, typically following credential theft and network reconnaissance.
A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates in exchange for a share of the ransom payments.
A team that simulates real-world attacker tactics against an organization's defenses to test detection, response, and overall security posture.
A monetary penalty imposed by a regulator for noncompliance with a data protection or security law, scaled in many jurisdictions to the severity of the violation and the organization's revenue.
Malware that provides an attacker with covert remote control over an infected system, often used for surveillance, data theft, or as a foothold for further attacks.
A microprocessor-based device used in industrial environments to interface field equipment with a central control system, commonly found in SCADA deployments.
Capturing valid data in transit, such as an authentication token, and retransmitting it later to trick a system into granting access or repeating a transaction. It happens because some protocols verify that a message is authentic without also verifying that it's fresh, so a legitimately signed message can be reused.
A privacy right, established under GDPR, that allows individuals to request the deletion of their personal data under certain conditions.
Technology that attaches persistent usage controls to a file, such as restricting printing, copying, or forwarding, regardless of where the file travels after it leaves its origin.
A structured, maintained record of identified risks, their likelihood and impact, and the treatment plan assigned to each, used to track enterprise risk over time.
An authentication approach that dynamically adjusts required verification steps based on a calculated risk score for the specific login attempt.
An unauthorized wireless access point installed on a network, either maliciously to intercept traffic or unknowingly by an employee, creating an unmonitored entry point.
An unauthorized DHCP server on a network that hands out attacker-controlled network settings, such as a malicious DNS server or gateway, to unsuspecting devices. It happens because DHCP has no built-in authentication, so on an open or poorly segmented network, whichever server answers first wins, and clients have no way to know it isn't legitimate.
An access control model that assigns permissions to users based on predefined roles rather than granting access on an individual basis.
The process of identifying the underlying condition or failure that allowed a security incident to occur, distinct from its immediate technical trigger.
Malware designed to gain and conceal privileged access to a system, often modifying the operating system itself to hide its presence from security tools.
A security technology embedded within an application that detects and blocks attacks in real time based on the application's actual runtime behavior.
The practice of adding random data to a password before hashing it, preventing attackers from using precomputed tables to crack multiple passwords at once.
Supervisory Control and Data Acquisition, a control system architecture used to monitor and manage industrial processes across large, geographically distributed sites.
A software-defined approach to managing wide area network connections that centralizes control and can integrate security functions across distributed sites.
The practice of securely storing, rotating, and controlling access to credentials, API keys, and tokens used by applications, rather than embedding them in code or configuration files.
A converged architecture that combines networking and security functions, including SD-WAN, secure web gateway, CASB, and ZTNA, delivered from the cloud.
A security control that filters inbound and outbound email traffic for spam, phishing, malware, and policy violations before messages reach or leave a user's inbox.
A development process that incorporates security requirements, threat modeling, and testing at every phase, from design through deployment and maintenance.
A platform that collects, aggregates, and analyzes security event data across an organization to support detection, investigation, and compliance.
A centralized team and function responsible for continuously monitoring, detecting, and responding to security threats across an organization.
A platform that automates repetitive incident response tasks and orchestrates workflows across security tools, reducing manual analyst workload.
The practice of dividing a network into isolated zones so that a compromise in one segment cannot easily spread to others.
The unintended disclosure of confidential or regulated data, whether through a breach, misconfiguration, or inadequate protection controls.
Tricking a server into making an unintended request on the attacker's behalf, often to internal systems that aren't otherwise reachable from outside. It happens because applications that fetch a URL supplied by the user don't always restrict where that request can go, letting an attacker pivot from the public internet into an internal network.
Security practices tailored to function-as-a-service architectures, addressing risks such as over-permissioned functions, insecure dependencies, and event-source injection.
An attack in which a threat actor steals or replays an active session token or cookie to impersonate an already-authenticated user, bypassing login and MFA controls entirely.
The use of AI tools and services within an organization without the knowledge, approval, or oversight of IT and security teams.
Technology, applications, or cloud services used within an organization without the knowledge or approval of the IT or security team.
The division of security obligations between a cloud provider and its customer, in which the provider secures the underlying infrastructure and the customer secures what they configure and put in it.
The practice of moving security testing and review earlier in the development process, catching vulnerabilities before code reaches production rather than after.
Observing someone's screen, keyboard, or documents, in person or via camera, to steal credentials or sensitive information. It happens because it requires no technical exploit at all, just physical proximity and a moment of inattention from the target, making it one of the lowest-effort ways to capture a password.
Extracting secrets by observing a system's physical or behavioral characteristics, such as timing, power consumption, or electromagnetic emissions, rather than attacking the algorithm directly. It happens because real hardware implementations of even mathematically sound cryptography can leak subtle, measurable signals that correlate with the secret data being processed.
A measure of how much of a security team's alert volume represents genuinely actionable threats versus false positives or low-priority noise.
Fraudulently convincing a mobile carrier to transfer a victim's phone number to a SIM card the attacker controls. It happens because SMS is still widely used as a second authentication factor, and hijacking the number lets an attacker intercept one-time codes and account recovery messages meant for the real owner.
An authentication method that lets a user log in once and gain access to multiple connected applications through a single identity.
A phishing attack conducted via SMS text message rather than email, often used to harvest credentials or deliver malicious links to mobile devices.
An auditing standard developed by the AICPA that evaluates a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy.
A formal, machine-readable inventory of the components and dependencies that make up a piece of software, used to identify exposure when a component is found vulnerable.
Tooling that scans an application's dependencies to identify known vulnerabilities, license risks, and outdated open source components.
The complete set of code, dependencies, tools, and processes involved in developing and delivering a piece of software from origin to end user.
An architecture that hides network resources from unauthorized users entirely, only revealing and granting access after identity and device verification succeed.
A cloud environment operated to meet a specific jurisdiction's data sovereignty, residency, and regulatory requirements, often used by government and highly regulated industries.
A targeted phishing attack customized to a specific individual or organization using researched, personalized details to increase credibility.
An email authentication standard that specifies which mail servers are authorized to send email on behalf of a domain, helping receiving servers detect spoofed messages.
An attack that inserts malicious SQL statements into an application's input fields to manipulate or extract data from its underlying database.
A testing method that analyzes an application's source code, byte code, or binaries for vulnerabilities without executing the program.
High-level intelligence on threat trends, actor motivations, and geopolitical context, intended to inform executive and board-level risk decisions rather than day-to-day defense.
Data organized in a predefined format, such as a database or spreadsheet, that is comparatively straightforward to classify, search, and protect.
An attack that compromises a trusted third-party vendor, software component, or service in order to reach that vendor's downstream customers.
An encryption method that uses a single shared key for both encrypting and decrypting data, generally faster than asymmetric encryption but requiring secure key exchange.
A DDoS technique that sends a flood of TCP connection requests but never completes the handshake, exhausting a server's connection table. It happens because the attacker's cost to send a SYN packet is far lower than the target's cost to hold each half-open connection, making it a cheap way to take a service offline.
Content, including images, audio, or video, generated or manipulated by AI, encompassing deepfakes as well as broader AI-generated material used in disinformation.
A discussion-based simulation in which stakeholders walk through their roles and decisions during a hypothetical incident, used to test and refine an incident response plan.
Intelligence on specific adversary tools, techniques, and procedures, used directly by security teams to tune detection and defensive controls.
Following an authorized person through a secured door or checkpoint without presenting credentials of one's own, also called piggybacking. It happens because social norms make people reluctant to challenge someone who looks like they belong, and holding a door for the person behind you feels polite rather than risky.
The evaluation of a vendor or partner's security and compliance posture before and during a business relationship, to understand the risk they introduce.
An individual, group, or organization responsible for conducting cyberattacks, ranging from opportunistic criminals to nation-state operators.
The set of actions taken to limit the spread and impact of an active security incident while investigation and remediation continue.
The proactive search for signs of malicious activity within an environment that has evaded existing detection tools, rather than waiting for an alert.
A system that aggregates, correlates, and operationalizes threat intelligence feeds from multiple sources for use across a security program.
A staffing model that structures a SOC by escalating complexity, with Tier 1 handling initial triage, Tier 2 conducting deeper investigation, and Tier 3 leading advanced response and threat hunting.
A cryptographic protocol that provides encrypted, authenticated communication over a network, and the modern standard underlying HTTPS.
The process of replacing sensitive data with a non-sensitive substitute value, or token, that has no exploitable value if exposed, while the original data is stored securely elsewhere.
The risk that sensitive, proprietary, or regulated data included in a model's training set could be exposed through the model's outputs or through direct compromise of the dataset.
The initial assessment of a security alert or incident to determine its severity, scope, and priority for further investigation.
Malware disguised as legitimate software to trick a user into installing it, at which point it carries out malicious actions without the user's knowledge.
An attack that exploits an established, trusted connection between two organizations, such as a vendor's network access, to reach a target that would otherwise be harder to breach directly.
The behavioral patterns that describe how a specific threat actor operates, used to profile adversaries and build detections independent of any single indicator.
The registration of a domain name that closely resembles a legitimate brand's domain, exploiting common typing errors to conduct phishing or intercept traffic.
A platform that manages and secures a broad range of endpoint device types, including desktops, mobile devices, and IoT, from a single console.
Data without a predefined format, such as documents, emails, and images, which is significantly harder to discover, classify, and protect than structured data.
The process of designing specific detection scenarios within a SIEM or detection platform, mapped to known threats or compliance requirements.
The process of evaluating a prospective vendor's security, financial, and operational posture before entering into a business relationship.
The ongoing program of identifying, assessing, and monitoring the risks introduced by third-party vendors throughout the relationship lifecycle.
A phishing attack conducted over voice calls, in which an attacker impersonates a trusted party to extract sensitive information or manipulate the victim into taking action.
An attack technique that exploits misconfigured switches to send traffic from one virtual LAN into another it should not have access to, bypassing intended segmentation.
Data that exists only in a system's active memory and is lost when the system powers down, requiring specialized live-collection techniques to preserve.
An encrypted tunnel that extends a private network across a public network, commonly used to secure remote access to internal resources.
The ongoing process of identifying, assessing, prioritizing, and remediating security weaknesses across an organization's systems.
An attack that compromises a website known to be frequented by a specific target group, infecting visitors rather than attacking the target directly.
The embedding of identifying information into a document, image, or file, used to trace the source of a leak or deter unauthorized distribution.
A security control that filters, monitors, and blocks malicious HTTP traffic to and from a web application.
A W3C web standard that enables browsers and applications to support public-key-based passwordless authentication, forming the core specification behind passkeys.
A highly targeted phishing attack aimed at senior executives or other high-value individuals within an organization.
Malware designed to permanently destroy or corrupt data on a target system, intended for disruption rather than financial extortion.
Self-replicating malware that spreads across networks and systems without requiring user interaction, often exploiting unpatched vulnerabilities.
Exploiting a misconfigured XML parser to read local files, access internal network resources, or cause denial of service through a crafted XML document. It happens because many XML parsers process external entity references by default, giving an attacker a path into the server's filesystem or internal network through what looks like ordinary input.
A security model built on the principle that no user or device should be trusted by default, regardless of network location, and that access must be continuously verified.
The technical implementation of zero trust principles across an organization's identity, network, device, and application layers.
An access model that grants connectivity to specific applications only after verifying identity and device posture, replacing implicit trust in broad network access such as a traditional VPN.
An attack that exploits a software vulnerability unknown to the vendor and for which no patch yet exists, giving defenders zero days of advance warning.
In plain language, independent of any single vendor's product marketing. Each entry aims to explain what a term means and why it matters operationally, not to sell a specific tool.
New terms get added as the threat landscape and vendor category names shift, particularly around AI security, cloud-native architecture, and identity, which move the fastest.
Yes — use the form below. Every suggestion is reviewed before it's added, so it won't appear on the page immediately.
No. This glossary is independent and reflects terminology across the categories I've worked in as a GTM leader in cybersecurity, not any single company's product suite.
Tell me the term and, if you know it, a rough definition. I review and write every entry myself before it goes live.