A working reference spanning identity, cloud, application security, cryptography, threat intelligence, GRC, and every other corner of the space I've built go-to-market motions around, plus the go-to-market vocabulary used to sell security software. Plain-language definitions, no vendor pitch.
This glossary defines 459 cybersecurity and go-to-market terms across 18 categories, covering security product categories, threat and attack terminology, compliance and regulatory frameworks, identity and access concepts, and the marketing and sales vocabulary specific to selling security software. Every entry is server-rendered with its own anchor link and DefinedTerm structured data, so a definition can be cited and deep-linked directly rather than pointing a reader at the top of a long page. It is maintained by Christine Castro, a B2B cybersecurity marketing executive, and updated as new terms enter the category. Anyone can submit a missing term through the form at the bottom of this page.
Unauthorized access to a legitimate user's account, typically achieved using stolen or reused credentials. ATO is the most common outcome of credential stuffing and infostealer infections.
A strategy that focuses marketing and sales effort on a defined list of target accounts, with campaigns and outreach tailored to each account's buying committee. It fits security companies selling high-value deals to a known set of enterprises.
An authentication model that adjusts the required verification steps based on contextual risk signals such as device, location, or behavior, rather than applying the same challenge to every login.
A sophisticated, typically well-resourced threat actor, often state-sponsored, that gains and maintains long-term covert access to a target network for espionage or strategic disruption.
The study and exploitation of techniques that manipulate machine learning models through crafted inputs designed to cause misclassification or unintended behavior.
A phishing technique that places a reverse proxy between the victim and the real login page, relaying the session so the user completes MFA normally while the attacker captures the resulting session cookie. It defeats one-time codes and push approvals, and it is the main reason organizations are moving to phishing-resistant MFA.
An open protocol, launched by Google in April 2025 and moved to the Linux Foundation that June, that lets AI agents built by different vendors discover each other, exchange tasks and share results. Where MCP connects an agent to tools, A2A connects agents to other agents, which raises questions about authentication and trust between them.
Security risk introduced by AI systems that can autonomously take multi-step actions, including calling tools and making decisions, expanding the potential impact of a manipulated or malfunctioning model.
A role that designs, deploys and monitors AI agents across the go-to-market stack, including tool integrations, prompt evaluation, permissions and failure monitoring. It extends GTM engineering into systems that make decisions, not only follow fixed rules.
A structured inventory of the models, datasets, and components used to build an AI system, used to assess and track exposure when a component is found to be risky or compromised.
The policies, oversight structures, and controls an organization uses to manage the development, deployment, and risk of artificial intelligence systems.
Controls placed around an AI model or agent that filter inputs and outputs, restrict which tools and data it can use, and enforce policies such as blocking sensitive data or unsafe content. Guardrails reduce risk but can be bypassed, so they are one layer of defense rather than a guarantee.
The practice of adversarially testing AI systems to uncover vulnerabilities such as prompt injection, jailbreaks, and unsafe outputs before deployment.
Tooling that discovers the AI models, agents, data pipelines and third-party AI services in use across an organization, assesses their configuration and exposure, and enforces policy on how they are used. It plays the same role for AI that CSPM plays for cloud, and Gartner groups it under the broader AI security platform category.
The use of AI agents to triage alerts, gather context and draft or carry out investigation steps that tier 1 analysts usually handle. Gartner placed AI SOC agents at the early, innovation stage of its 2025 Hype Cycle for Security Operations, and claims about accuracy and autonomy vary widely by vendor.
A network security measure that physically isolates a system or network from unsecured networks, including the internet, to prevent remote compromise.
A network physically isolated from other networks, including the internet, historically used to protect industrial control systems, though increasingly bridged by convenience connections.
The desensitization a security team experiences from an excessive volume of alerts, often driven by low-fidelity detections, leading to slower response and missed threats.
A DDoS technique in which an attacker sends small requests with the victim's spoofed IP address to third-party servers, which reply to the victim with much larger responses. Protocols such as DNS, NTP and memcached return far more data than they receive, letting a small amount of attacker traffic become an overwhelming flood.
The chronic stress and fatigue experienced by security operations staff due to alert volume, on-call pressure, and the high-stakes nature of the work, a leading driver of SOC turnover.
The program of briefing and building relationships with industry analysts, such as Gartner, Forrester and IDC, whose research shapes how enterprise buyers build shortlists. For security companies, analyst coverage often decides whether a vendor gets considered at all.
The yearly value of a company's subscription contracts, the main revenue measure for SaaS and security software companies. Investors and boards use ARR and its growth rate to track progress and set expectations for marketing and sales.
Software that detects and removes known malware based on signature matching, forming a baseline but increasingly insufficient layer of endpoint defense.
The practices and controls that protect application programming interfaces from abuse, including authentication enforcement, rate limiting, and input validation.
A security control that permits only explicitly approved applications to run on a system, blocking everything else by default.
A platform that pulls findings from SAST, SCA, DAST, secrets scanning and other tools into one view, removes duplicates and prioritizes them by business risk and exploitability. It helps development and security teams decide what to fix first across many applications.
A denial-of-service attack aimed at application functions, such as search or login, rather than raw bandwidth. The requests look like normal user traffic but are expensive for the backend to process, so a relatively small volume can exhaust servers that volumetric defenses are not tuned to protect.
An attack in which a threat actor sends falsified Address Resolution Protocol messages to associate their own MAC address with a legitimate IP address on a local network, enabling traffic interception.
A security mindset that designs defenses under the assumption an attacker is already inside the environment, prioritizing detection, containment, and limiting blast radius over perimeter prevention alone.
An encryption method that uses a mathematically linked public and private key pair, allowing data encrypted with one key to be decrypted only with the other.
The continuous discovery, inventory, and assessment of an organization's externally exposed assets to identify unmanaged or unknown points of exposure.
A formal statement, often from an auditor or executive, confirming that a control, process, or set of controls meets a specified standard.
An access control model that grants permissions based on a combination of user, resource, and environmental attributes, rather than fixed roles alone.
The process of linking an anonymous online identity, alias, or digital artifact to a verified real-world individual or threat actor group.
A chronological, tamper-evident record of system and user activity used to reconstruct events for security investigations, audits, or compliance verification.
Luring a victim with something enticing, such as a free download or a USB drive left in a parking lot, that delivers malware when used. It needs no prior contact with the target, only curiosity or the appeal of something free.
A short sales enablement document comparing a product with a specific competitor, covering strengths, weaknesses, common objections and how to respond. Battlecards go stale quickly and need regular updates from win and loss data.
The unauthorized manipulation of Border Gateway Protocol routing tables to redirect internet traffic through an attacker-controlled path, often for interception or denial of service.
Verification of identity using a physical or behavioral trait, such as a fingerprint, face, or typing pattern, in place of or alongside a password.
The scope of systems, data, and users affected, or potentially affected, by a security incident once it has occurred.
The defensive security team responsible for detecting, responding to, and defending against simulated or real attacks.
Sending unsolicited messages or data to a nearby device over Bluetooth without the owner's consent. It is mostly a nuisance rather than a compromise, but it shows how exposed a discoverable, unsecured wireless interface can be.
Pulling data such as contacts or messages from a device over Bluetooth without authorization. Older or misconfigured Bluetooth implementations allowed this without proper pairing, letting an attacker within range copy information directly.
The routing protocol that internet service providers and large networks use to exchange information about which IP address ranges they can reach. It relies heavily on trust between networks, so misconfigurations or deliberate false announcements can redirect or black-hole traffic, which is what BGP hijacking exploits.
A network of compromised devices controlled remotely by an attacker, commonly used to conduct DDoS attacks, distribute spam, or mine cryptocurrency at scale.
Tooling that safely and continuously runs simulated attack techniques against an organization's environment to test whether security controls detect and block them. It supplies the validation step in CTEM and shows where controls have drifted or failed.
A threat actor who specializes in acquiring and reselling breach data or unauthorized access on criminal marketplaces, distinct from those who conduct the original intrusion.
The legally or contractually required disclosure to affected individuals, regulators, or partners following a confirmed data breach, with timelines that vary by jurisdiction and data type.
A technique in which an attacker with administrator access installs a legitimately signed but vulnerable kernel driver, then exploits it to gain kernel-level control. It is commonly used to switch off endpoint security before ransomware is deployed.
A vulnerability class in which an application fails to properly enforce restrictions on what authenticated users are allowed to do. It holds the number one spot in both the 2021 and 2025 editions of the OWASP Top 10.
Systematically trying large numbers of passwords or keys until one works. Short, weak or reused passwords make the guessing feasible, especially on accounts without lockout or rate limiting.
A misconfiguration in which a cloud storage bucket is left publicly accessible, exposing its contents to anyone who discovers the address.
Writing more data into a block of memory than it was allocated to hold, overwriting adjacent memory. In languages that do not enforce memory boundaries, a carefully crafted overflow can redirect program execution to attacker-supplied code, which is a major reason for the shift toward memory-safe languages.
A program that pays independent security researchers for responsibly reporting vulnerabilities in an organization's products or services. It extends testing beyond internal teams, and the rules of scope and safe harbor determine what researchers may test.
An attack that infiltrates the automated systems used to build and deploy software, allowing malicious code to be inserted before it reaches customers.
Hosting providers that knowingly ignore abuse reports and takedown requests, giving criminals stable infrastructure for malware command and control, phishing sites and leak sites. Several providers have been sanctioned by the U.S. Treasury for supporting ransomware and infostealer operations.
A social engineering attack in which a threat actor impersonates a company executive or trusted partner via email to redirect payments or exfiltrate sensitive information.
A vulnerability that exploits the intended workflow of an application in an unintended way, such as manipulating a checkout process, rather than a traditional code-level bug.
A profile of an individual role involved in a purchase, such as a CISO, security architect or SOC manager, describing their responsibilities, pressures and what they need to see before they say yes. Where the ICP describes the company, personas describe the people inside it.
The group of people who influence or approve a purchase. A security deal often involves the CISO, practitioners who evaluate the product, IT or engineering teams who deploy it, procurement, legal and sometimes the CFO, and each needs different evidence.
A phishing technique, also called telephone-oriented attack delivery, in which an email with no malicious link or attachment, often a fake invoice or subscription renewal, urges the victim to call a phone number. The attacker on the line then talks the victim into installing remote access software or handing over data, which email security tools rarely catch.
A go-to-market strategy that defines a new market category rather than competing inside an existing one, aiming to set the buying criteria and become the default choice. It can pay off when analysts and buyers adopt the category, but it is expensive and slow when they do not.
A California law, expanded by the California Privacy Rights Act (CPRA), that gives consumers rights over personal data businesses collect, including access, deletion, correction and opting out of sale or sharing. It is enforced by the California Privacy Protection Agency, now branded CalPrivacy, whose regulations on cybersecurity audits, risk assessments and automated decision-making took effect January 1, 2026, with compliance deadlines phased in through 2030.
A trusted entity that issues digital certificates, verifying the identity of the certificate holder and enabling secure, authenticated communication.
The discovery, issuance, renewal and revocation of digital certificates across an organization, ideally automated. It became urgent after the CA/Browser Forum voted in 2025 to cut maximum public TLS certificate lifetimes to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029.
A security technique that hardcodes an application's trust to a specific certificate or public key, preventing acceptance of a fraudulent certificate even if it is signed by a trusted CA.
The documented, unbroken record of how digital evidence was collected, handled, and stored, required to preserve its admissibility in legal or regulatory proceedings.
A person inside a prospective customer who wants the purchase to happen and actively sells it internally. Practitioner champions often start security deals, but they need material that helps them make the business case to the economic buyer.
Marketing that drives revenue through partners, such as resellers, distributors, MSPs, MSSPs and systems integrators, by providing campaigns, enablement and incentives. For many security companies, partners reach customers the direct sales team cannot cover.
The Cyber Incident Reporting for Critical Infrastructure Act of 2022, a U.S. law that will require covered critical infrastructure entities to report substantial cyber incidents to CISA within 72 hours and ransom payments within 24 hours. The reporting duties begin once CISA's final rule takes effect.
A social engineering technique that shows a fake error message or CAPTCHA and instructs the user to copy, paste and run a command to fix it, which installs malware. Because the victim runs the command themselves, it slips past many email and download protections, and it became one of the fastest-growing initial access methods in 2025.
Tricking a user into clicking something other than what they see, typically by layering an invisible button or frame over a legitimate page. Sites that allow themselves to be framed by other sites without protective headers, such as X-Frame-Options or a frame-ancestors policy, are exposed.
A control point between users and cloud service providers that enforces security policies such as visibility, data protection, and threat prevention across sanctioned and unsanctioned cloud apps.
A credential issued to authenticate and authorize programmatic access to cloud resources, valuable to attackers because it can often bypass interactive login controls entirely.
A security capability focused on detecting and responding to active threats within cloud environments in near real time, complementing the preventive focus of CSPM.
A discipline focused on identifying and right-sizing excessive permissions across cloud identities and services, reducing the blast radius of a compromised credential.
A storefront run by a cloud provider, such as AWS Marketplace, Microsoft Marketplace or Google Cloud Marketplace, where customers can buy software and often apply committed cloud spend to the purchase. It has become a significant procurement route for security vendors.
A consolidated platform category that combines CSPM, CWPP, CIEM, and related capabilities to secure cloud-native applications across their full lifecycle.
Tools and processes that continuously identify misconfigurations and compliance risks across cloud environments before they are exploited.
The uncontrolled proliferation of cloud accounts, services, and resources across an organization, making consistent security governance difficult.
Security tooling focused on protecting individual cloud workloads, such as virtual machines, containers, and serverless functions, at runtime.
The U.S. Department of Defense program that verifies contractors protect federal contract information and controlled unclassified information, using three levels based largely on NIST SP 800-171. It began appearing in defense contracts in a phased rollout on November 10, 2025, with third-party assessments required for many contractors in later phases.
The Commercial National Security Algorithm Suite 2.0, the NSA's required set of quantum-resistant algorithms for U.S. national security systems. It sets a phased timeline, with new national security system acquisitions expected to comply from January 1, 2027 and the transition to quantum-resistant algorithms targeted for completion by 2035.
The cryptographic signing of software to verify its publisher and confirm it has not been altered since release, a control frequently targeted by supply chain attackers who steal signing certificates.
A compiled file of username and password pairs, typically aggregated from multiple breach sources, used as raw input for credential stuffing tools.
The infrastructure and channels an attacker uses to communicate with and control compromised systems after initial infection.
Inserting operating system commands into application input so the server executes them. When an application passes unsanitized input to a system shell, the attacker gains the same command-line access as the application itself.
The risk created when an organization relies heavily on a single vendor, platform, or supplier, such that a disruption to that one party has an outsized impact.
Protecting data while it is being processed by running workloads inside hardware-based trusted execution environments that keep data encrypted in memory, even from the cloud provider. It closes the gap left by encryption at rest and in transit.
The practice of securing containerized applications across build, deployment, and runtime, including image scanning, orchestration hardening, and runtime threat detection.
A role that builds the production and distribution system for content, covering AI assisted creation with human review, scheduling, repurposing one asset into many formats and performance tracking. It works alongside an editorial lead rather than replacing one.
An access model that evaluates real-time contextual signals, such as device health, location, and behavior, before granting or denying a request.
An authentication approach that continually verifies a user's identity throughout a session based on ongoing behavioral and contextual signals, rather than only at login.
Automated, ongoing testing of whether security and compliance controls are working, using data pulled directly from systems instead of periodic manual sampling. It turns audits from annual scrambles into continuous evidence.
The practice of securing the automated pipelines that build, test, and deploy software, a frequent target for supply chain attacks given their privileged access to source code and production systems.
The ongoing, automated assessment of a vendor's security posture over the life of the relationship, rather than relying solely on a point-in-time assessment.
A program model introduced by Gartner in 2022 for continuously reducing exposure through five stages: scoping, discovery, prioritization, validation and mobilization. It shifts vulnerability work from patching everything a scanner finds to fixing the exposures that matter most to the business.
A structured set of security and governance controls, such as NIST CSF or ISO 27001, used to organize, implement, and assess an organization's risk management program.
Tampering with the contents of a cookie to escalate privileges, bypass validation or impersonate another user. The attack works against applications that treat cookie values as trustworthy instead of re-validating them on the server.
Silently dropping affiliate tracking cookies into a visitor's browser, usually through hidden iframes or redirects, so the attacker earns commission on purchases they had no part in. Affiliate programs typically pay whichever cookie is present at checkout, which is what makes the fraud profitable.
A logic rule within a SIEM or detection platform that identifies a threat pattern by connecting multiple related events that would not be significant on their own.
The condition where a user's login credentials have appeared in a breach dataset, infostealer log, or dark web listing and may be known to unauthorized parties.
Collecting usernames and passwords at scale through fake login pages, malware or breached databases, usually for resale or later credential stuffing. Stolen credentials remain one of the most reliable ways into an account, so harvesting feeds much of the criminal economy.
An automated attack that tests large volumes of stolen username-password pairs against many services, exploiting password reuse across accounts.
Systems and assets, such as power grids, water treatment, and transportation, considered essential to public safety and economic stability, and a priority target for nation-state threat actors.
An attack that tricks an authenticated user's browser into submitting an unwanted request to a web application in which they are currently logged in.
A vulnerability that allows an attacker to inject malicious scripts into content served to other users, executing in their browser session.
The ability of a system to swap out cryptographic algorithms or key sizes without major redesign, an increasingly important property as quantum-resistant standards emerge.
The unauthorized use of a victim's computing resources to mine cryptocurrency, typically through malware or a compromised browser script.
The total sales and marketing spend required to win a new customer, divided by the number of new customers in the period. It is usually compared with customer lifetime value or payback period to judge whether growth is efficient.
The public catalog that assigns a unique identifier, such as CVE-2024-3094, to each disclosed security vulnerability. Run by MITRE with U.S. government funding, it gives vendors, scanners and security teams a shared name for the same flaw.
A standard maintained by FIRST for rating the technical severity of a vulnerability on a scale of 0 to 10. CVSS version 4.0, released in November 2023, is current. A high score describes how bad a flaw could be, not how likely it is to be exploited, which is why it is often paired with EPSS and the KEV catalog.
Insurance that covers financial losses from cyber incidents, such as response costs, business interruption, extortion payments and liability. Insurers increasingly require specific controls, such as MFA, EDR and tested backups, before they will write or renew a policy.
An EU regulation, in force since December 2024, that sets cybersecurity requirements for hardware and software products with digital elements sold in the EU, across their whole lifecycle. Manufacturers have had to report actively exploited vulnerabilities and severe incidents since September 11, 2026, and the full requirements apply from December 11, 2027.
The portion of the internet accessible only through specific software, such as Tor, that is not indexed by standard search engines and hosts many criminal marketplaces and forums.
The continuous surveillance of dark web marketplaces, forums, and paste sites for stolen credentials, data, or intelligence tied to a monitored organization or individual.
The process of categorizing data based on sensitivity and business value, forming the basis for applying appropriate handling and protection controls.
The process of identifying and cataloging where sensitive data lives across an organization's systems, including data an organization may not know it holds.
The unauthorized transfer of data out of an organization's environment, typically the objective stage of a targeted breach or insider theft.
A website operated by a ransomware group to publish stolen data from victims who refuse to pay, used as leverage in double extortion schemes.
The governance of data from creation through storage, use, archival, and secure deletion, ensuring appropriate protection is applied at each stage.
A set of tools and policies that detect and prevent sensitive data from leaving an organization's control, whether by accident or malicious intent.
A technique that obscures sensitive data with realistic but fictional values, allowing systems to be tested or used without exposing the underlying real data.
A logical boundary defining where an organization's sensitive data is permitted to move and be accessed, enforced through policy rather than physical network location.
An attack that corrupts the training data used to build a machine learning model, intentionally degrading its accuracy or embedding a hidden malicious behavior.
A legal contract between a data controller and a data processor that defines how personal data will be handled, secured, and protected on the controller's behalf.
A structured process for identifying and mitigating privacy risks before launching a project or system that processes personal data, required under GDPR for high-risk processing.
The requirement or practice of storing data within a specific geographic or jurisdictional boundary, often driven by regulatory obligations.
Tooling that discovers and classifies sensitive data across cloud, SaaS and on-premises stores, then shows who can access it and where it is exposed. It answers the question of where sensitive data lives before deciding how to protect it.
The principle that data is subject to the laws of the country in which it is collected or stored, a key driver of data residency requirements.
A formal request by an individual for an organization to disclose, correct, or delete the personal data it holds about them, as provided under privacy regulations such as GDPR and CCPA.
An extortion attack in which criminals steal data and threaten to publish or sell it, without encrypting the victim's systems. A growing share of ransomware-style cases now skip encryption entirely, so good backups alone no longer remove the pressure to pay.
An attack that overwhelms a target system or network with traffic from many distributed sources, degrading or denying service to legitimate users.
An identity model in which individuals hold and control verifiable credentials directly, rather than relying on a central authority or identity provider to vouch for them.
Security tooling that plants decoy assets, credentials, or data within an environment to detect and mislead attackers who interact with them.
The portion of the internet not indexed by public search engines but accessible without special software, including private databases and closed forums.
AI-generated synthetic media, typically audio or video, that convincingly impersonates a real person and is increasingly used in fraud and social engineering.
The marketing work of creating and capturing interest that turns into qualified pipeline, across paid media, content, events, webinars and outbound programs. Strong demand generation is measured on pipeline and revenue influence, not lead volume.
An attack that exploits package manager resolution logic to trick a build system into pulling a malicious public package instead of an intended internal one with the same name.
The risk introduced by relying on third-party code libraries or components, which may contain vulnerabilities or be compromised without the consuming organization's knowledge.
The discipline of designing, building, testing, and tuning detection logic to reliably identify malicious activity while minimizing false positives.
Managing detection logic the way software teams manage code: in version control, with peer review, automated testing and deployment pipelines. It makes detections easier to audit, reuse and roll back as environments change.
A browser technology, developed by Google with Microsoft and being standardized at the W3C, that cryptographically ties a login session to the device it was created on. A session cookie stolen by an infostealer becomes useless on the attacker's machine, which directly targets the session hijacking that bypasses MFA.
An attack that abuses the OAuth device authorization flow, designed for TVs and other devices without keyboards, by sending a victim a legitimate sign-in page and a code to enter. When the victim signs in, the attacker's session receives valid access and refresh tokens, with no fake website or stolen password involved.
An assessment of a device's security state, such as patch level, encryption status, and running software, used to determine whether it should be granted access.
A measure of confidence in a device's security posture, used as a gating factor for access decisions independent of the identity attempting to connect.
An operating model that integrates security practices directly into development and operations workflows, rather than treating security as a separate, later-stage gate.
The discipline of collecting, preserving, and analyzing digital evidence to reconstruct what happened during a security incident.
A security category focused on monitoring and remediating threats to an organization's external digital presence, including credential exposure, impersonation, and brand abuse.
A cryptographic mechanism that verifies the authenticity and integrity of a message or document, confirming it came from a specific sender and was not altered.
The full network of software, services, and vendors an organization depends on to build and deliver its products, each representing a potential point of compromise.
The protection of virtual replicas of physical systems used for simulation and monitoring, which can themselves become an attack vector back into the physical system they model.
Manipulating file path input, often with sequences such as '../', to read files outside a web application's intended directory. It works when an application builds file paths from user input without validating them.
An email authentication standard that adds a digital signature to outgoing messages, allowing receiving servers to verify the message was not altered in transit and came from an authorized sender.
An email authentication policy that builds on SPF and DKIM, telling receiving mail servers how to handle messages that fail verification and enabling domain owners to see abuse of their domain.
Inserting a forged record into a DNS resolver's cache so it keeps sending users to a malicious IP address for a legitimate domain until the entry expires. Because one poisoned resolver serves many users for hours or days, the impact is wider and longer-lasting than spoofing a single response.
An attack that corrupts DNS resolution to redirect users from a legitimate domain to a malicious one, often to harvest credentials or distribute malware.
An EU regulation, applicable to financial entities since January 17, 2025, that sets uniform requirements for ICT risk management, incident reporting, resilience testing and third-party risk. It also puts designated critical ICT providers, such as major cloud platforms, under direct oversight by EU financial supervisors.
A ransomware tactic in which attackers both encrypt a victim's data and threaten to publish it publicly, applying pressure to pay even if backups make decryption unnecessary.
Forcing a connection to fall back to an older, weaker protocol version or cipher suite that is easier to break. Systems that keep legacy options enabled for compatibility are exposed, since an attacker in the network path can steer the negotiation toward the weakest option both sides accept.
Malware that is automatically downloaded and installed on a victim's device simply by visiting a compromised or malicious website, without any further action required.
The length of time an attacker remains undetected inside a compromised environment between initial access and discovery.
A testing method that analyzes a running application from the outside, simulating attacker behavior to find exploitable vulnerabilities without access to source code.
The person who controls the budget and has final authority to approve a purchase. In security deals this is often the CISO, but for larger or cross-functional purchases it can be the CIO, CFO or a business unit leader.
Attacks against internet-facing network appliances such as VPN gateways, firewalls and routers. These devices sit outside the reach of EDR, are often patched slowly, and give direct access to the internal network, which has made exploited vulnerabilities in them a leading way in for nation-state and ransomware actors.
A tool built to terminate, blind or unhook endpoint detection and response software before an attacker deploys ransomware or other payloads. Many rely on BYOVD, and they are now a standard part of ransomware affiliates' toolkits.
A public-key cryptography approach based on the algebraic structure of elliptic curves, offering equivalent security to older algorithms with smaller key sizes.
The forging of an email header so a message appears to come from a trusted sender other than its actual origin.
The practice of securing purpose-built computing devices embedded within larger machinery, often constrained by limited processing power and infrequent update cycles.
The encryption of stored data, protecting it from unauthorized access if the underlying storage medium or system is compromised.
The encryption of data as it moves across a network, protecting it from interception between sender and recipient.
Security technology that continuously monitors endpoint activity to detect, investigate, and respond to threats that evade preventive controls.
An integrated suite of preventive endpoint security capabilities, including antivirus, firewall, and device control, delivered from a single agent.
Short-lived compute resources, such as serverless functions or auto-scaled instances, that exist briefly and complicate traditional monitoring approaches built for persistent infrastructure.
A data-driven model maintained by FIRST that estimates the probability a given CVE will be exploited in the wild within the next 30 days. Teams use it alongside CVSS to focus patching on the small share of vulnerabilities attackers actually use.
The European Union's law regulating artificial intelligence by risk level, in force since August 2024. Prohibited practices have been banned since February 2025 and general-purpose AI rules apply from August 2025, while a 2026 amendment moved most high-risk system obligations to December 2027 and August 2028.
A risk, defined in the OWASP Top 10 for LLM Applications, in which an AI agent has more functionality, permissions or autonomy than its task requires. It is least privilege applied to agents: when a manipulated or malfunctioning agent can send email, move money or delete data, the damage scales with the access it was given.
A packaged toolkit that automatically scans a visitor's browser and plugins for known vulnerabilities and delivers a matching exploit, often used to distribute malware at scale.
The practice of finding, prioritizing and reducing every way an attacker could reach important assets, including software vulnerabilities, misconfigurations, identity weaknesses and exposed services, in one view. Analysts now treat it as the successor to traditional vulnerability management.
A security architecture that correlates data across endpoint, network, cloud, and identity layers to provide broader detection and response than any single tool alone.
A malicious event that a detection system fails to flag, representing a gap in coverage that allows a real threat to go unnoticed.
A security alert that incorrectly identifies a benign event as malicious, contributing to alert fatigue and wasted analyst time.
A technique that rapidly rotates the DNS records for a malicious domain across a large pool of compromised hosts. Because the IP addresses behind phishing sites, botnets or malware downloads change constantly, blocking or taking down the infrastructure becomes much harder.
The Federal Risk and Authorization Management Program, the U.S. government's standard process for security authorization of cloud services used by federal agencies. Its FedRAMP 20x modernization replaces lengthy written control narratives with automated, continuously reported security indicators to speed up authorizations.
An open authentication standard that enables passwordless or phishing-resistant login using public-key cryptography and a local authenticator such as a security key or device biometric.
Marketing run regionally or around specific accounts and sales teams, typically through events, executive dinners, roundtables and partner programs. In cybersecurity it carries much of the in-person relationship building that moves enterprise deals.
Malware that operates in memory rather than writing a file to disk, using legitimate system tools to avoid detection by traditional signature-based defenses.
A network security control that monitors and filters incoming and outgoing traffic based on a defined set of rules, forming a baseline perimeter defense.
The protection of the low-level software that controls a device's hardware, a persistent and difficult-to-detect target for attackers seeking long-term footholds.
An exact, bit-for-bit copy of a storage device or system created for forensic analysis, preserving the original evidence untouched.
Injecting malicious code into a website's checkout or form page to skim payment card and personal data as visitors type it. A single compromised third-party script can capture form input for months before anyone notices, as Magecart campaigns have repeatedly shown.
Risk introduced by the vendors and subcontractors that an organization's own third-party vendors rely on, one layer removed from direct visibility.
An experienced marketing executive who leads a company's marketing on a contracted basis rather than as a full-time employee. Fractional does not necessarily mean part time: the scope is set by the company's gaps, from strategy and team building to repairing RevOps or running a launch.
A person hired for a remote technical role under a stolen or fabricated identity, most notably as part of North Korean schemes that funnel salaries to the regime and sometimes steal data or extort the employer. U.S. authorities have disrupted laptop farms that made these workers appear to be based in the United States.
An automated testing technique that feeds malformed or unexpected input into a program to uncover crashes, memory issues, and exploitable edge cases.
An EU regulation that governs the collection, processing, and protection of personal data of individuals within the European Union, with significant penalties for noncompliance.
The category of security, privacy, and compliance risks introduced by the use of generative AI tools, including data leakage, hallucinated outputs, and unvetted third-party model use.
The plan for how a company reaches, wins and keeps customers: which segments it targets, what it says to them, how it prices and packages, and which channels and teams carry the motion. In cybersecurity, a go-to-market strategy also has to account for long technical evaluations and buying committees that include both practitioners and executives.
Forging a Kerberos ticket-granting ticket to gain persistent, near-unrestricted access across a Windows domain. It requires the attacker to have already compromised the KRBTGT account that signs tickets, and the resulting access survives ordinary password resets until that account's key is rotated twice.
An integrated approach to managing an organization's overall governance, enterprise risk, and regulatory compliance activities.
A go-to-market role that builds the systems behind pipeline, including enrichment, signal monitoring, routing and automated outreach. It is closer to software engineering than to selling, and it sits between RevOps and marketing. See the how-to-hire guide for scope and pay.
A role that owns the thinking above execution: the ICP, positioning, signal orchestration and campaign architecture that outbound, account based marketing and RevOps run on. It usually has little or no direct team.
An output from a generative AI model that is fabricated or factually incorrect but presented with confidence, a risk factor when AI outputs inform security or business decisions without verification.
A dedicated physical device that generates, stores, and manages cryptographic keys in a tamper-resistant environment.
A strategy in which adversaries collect and store encrypted data today, expecting to decrypt it once quantum computers can break current public-key encryption. It is why data that must stay confidential for years, such as health records or state secrets, is driving post-quantum migration now.
A one-way mathematical function that transforms input data into a fixed-length string, used to verify data integrity and, with salting, to protect stored passwords.
Impersonating an employee in a call or chat with the IT help desk to get a password reset or MFA moved to an attacker-controlled device. Groups such as Scattered Spider used the technique in several major 2025 breaches, and the defense is stronger identity verification for support requests rather than more technology.
A U.S. federal law that sets national standards for protecting sensitive patient health information from disclosure without consent or knowledge.
An encryption method that allows computation to be performed directly on encrypted data without first decrypting it, preserving confidentiality throughout processing.
A decoy system designed to attract and detect attackers, providing early warning of intrusion attempts and intelligence on attacker tactics without exposing real assets.
A description of the type of company a product is built to serve, usually defined by industry, size, security maturity, regulatory exposure and existing technology stack. The common failure is an aspirational ICP: the profile a company says it sells to, which its closed-won data does not support.
A composable layer of interoperable identity services (authentication, governance, directory, and access management) that spans hybrid and multi-cloud environments rather than living in a single platform.
The discipline of managing digital identity lifecycles, entitlements, and access certifications to ensure users have the right access at the right time, and nothing more.
A service that creates, maintains, and authenticates user identities, then asserts that authentication to connected applications, most commonly via SSO.
Tooling that continuously finds and prioritizes weaknesses across identity systems, such as dormant accounts, missing MFA, excessive privileges and risky configurations in directories and identity providers. Where ITDR detects attacks in progress, ISPM reduces the openings attackers would use.
A security category focused on detecting and responding to attacks that target identity infrastructure itself, such as credential theft, privilege escalation, and session hijacking.
A security approach that treats identity, rather than network location, as the primary control point for granting access to resources.
An attack in which a threat actor poses as a trusted individual, brand, or system to manipulate a target into taking a harmful action.
The assumption that a user or device is trustworthy simply because it is inside a network perimeter, the legacy model that zero trust architecture is designed to replace.
The individual designated to lead and coordinate an organization's response during an active security incident, owning decisions and communication until resolution.
A documented, pre-defined set of procedures for detecting, containing, eradicating, and recovering from a security incident.
Behavioral evidence of an attacker's intent and technique in progress, used to detect malicious activity earlier than static indicators of compromise allow.
Forensic artifacts, such as a malicious file hash, IP address, or domain, that indicate a system has potentially been compromised.
A form of prompt injection in which malicious instructions are planted in content an AI system later processes, such as an email, document, web page or calendar invite, rather than typed in by the user. It is a common route for real-world attacks on enterprise copilots, including zero-click data exfiltration flaws disclosed in 2025.
Hardware and software systems used to monitor and control industrial processes, encompassing SCADA systems, PLCs, and related technologies.
Malware designed to silently harvest browser-stored credentials, session cookies, and other sensitive data from an infected device and transmit it to an attacker.
The practice of defining and provisioning infrastructure through machine-readable configuration files, which allows security misconfigurations to be scanned and caught before deployment.
A threat actor who specializes in obtaining and reselling initial network access, often to ransomware operators, forming a key link in the modern attack economy.
A class of vulnerabilities in which untrusted input is interpreted as executable commands or code by an application, of which SQL injection is the most well-known example.
A vulnerability that occurs when an application deserializes untrusted data without proper validation, potentially allowing an attacker to execute arbitrary code.
Accessing another user's data by changing an identifier, such as an account or file ID, in a URL or API call. The flaw exists when an application confirms a user is logged in but never checks that they are allowed to see that particular object.
A security risk originating from someone with authorized access to an organization's systems and data, whether acting maliciously, negligently, or under compromise.
Signals that suggest a company is researching a topic or category, gathered from content consumption across publisher networks, review sites or a vendor's own website. It helps prioritize accounts, but signals vary widely in quality and should be checked against fit and real engagement.
A monitoring system that analyzes network or host activity for signs of malicious behavior and alerts security teams, without taking direct action to block it.
A security control that monitors network traffic for malicious activity and can automatically block or reject it in real time, extending an IDS with active enforcement.
The practices and controls used to secure internet-connected devices, which often ship with weak default credentials and limited built-in protection.
Forging the source IP address in a packet so it appears to come from a different or trusted host. Attackers use it to hide their origin, slip past IP-based access controls, or reflect traffic onto a third party, taking advantage of protocols that trust the source address by default.
An international standard specifying requirements for establishing, implementing and continually improving an information security management system (ISMS). The 2022 edition is current, and the transition period for certificates issued against the older 2013 version ended on October 31, 2025.
An international standard, published in December 2023, specifying requirements for an AI management system that governs how an organization develops, provides or uses AI responsibly. It is the first certifiable AI governance standard and is often paired with ISO 27001.
A prompt or sequence of prompts crafted to get an AI model to ignore its safety training or usage policies and produce output it is designed to refuse. Jailbreaks target the model's own guardrails, while prompt injection usually targets the application built around the model.
A privileged access model that grants elevated permissions only for the duration a task requires, then automatically revokes them, shrinking the window of standing privilege an attacker could exploit.
The processes and infrastructure used to generate, distribute, store, rotate, and revoke cryptographic keys throughout their lifecycle.
The scheduled or triggered replacement of cryptographic keys to limit the amount of data protected by, or exposed by, any single key.
A model that breaks an attack into sequential stages, from reconnaissance through actions on objectives, used to identify where defenses can intercept an intrusion.
A list maintained by CISA of vulnerabilities confirmed to be exploited in the wild. Under Binding Operational Directive 22-01, U.S. federal civilian agencies must fix listed flaws by set deadlines, and many private companies use it as their own patching priority list.
The set of practices and controls that secure container orchestration environments, including cluster configuration, workload isolation, and role-based access within the cluster.
A pre-configured, secure baseline environment for provisioning new cloud accounts or workloads, intended to enforce consistent guardrails from the start.
The practices used to secure applications built on large language models against risks such as prompt injection, data leakage, and insecure output handling.
Techniques an attacker uses to move through a network after gaining initial access, expanding reach toward higher-value systems and data.
A method of ranking leads by fit and engagement, using firmographic data and behaviors such as content downloads, event attendance and website visits, to decide which ones reach sales. AI can help with scoring, but the pipeline itself is still built by people working those leads.
The principle that a user, application, or system should be granted only the minimum access necessary to perform its function.
An attack technique that uses legitimate, pre-installed system tools rather than custom malware to carry out malicious activity, making detection significantly harder.
The centralized collection of log data from across an organization's systems into a single platform for analysis, correlation, and retention.
A domain registered to closely resemble a legitimate organization's domain, used to support phishing, brand impersonation, and business email compromise.
Gartner's research report that evaluates vendors in a market on two axes, completeness of vision and ability to execute, placing them as Leaders, Challengers, Visionaries or Niche Players. Placement heavily influences enterprise security shortlists, which is why vendors invest so much in analyst relations.
An open source package published to a registry such as npm or PyPI with intentionally harmful code, often to steal credentials or install backdoors. In 2025 the Shai-Hulud worm showed packages can spread themselves, using stolen maintainer tokens to publish trojanized versions of hundreds of other packages.
The use of online advertising to deliver malware, exploiting ad networks to distribute malicious code to visitors of otherwise legitimate websites.
An attack in which a threat actor secretly intercepts and potentially alters communication between two parties who believe they are communicating directly.
An outsourced security service that provides continuous threat monitoring, detection, and response, typically combining human analysts with detection technology.
Methods for assigning credit for pipeline and revenue to the marketing touches that influenced them, from first-touch and last-touch models to multi-touch and self-reported attribution. Long security sales cycles with many stakeholders make any single model incomplete, so most teams combine several.
A lead that has met a marketing-defined threshold of fit and engagement but has not yet been accepted by sales. MQL volume is easy to inflate, so on its own it says little about pipeline.
An attack that hides malicious instructions in the description or metadata of a tool exposed through the Model Context Protocol. The model reads and follows those instructions when deciding how to use the tool, while the user typically never sees them, which can lead to data exfiltration or unauthorized actions.
The average time it takes a security team to identify that a security incident has occurred, a core metric for measuring detection program effectiveness.
The average time it takes a security team to contain and remediate an incident once it has been detected.
A sales qualification framework covering Metrics, Economic buyer, Decision criteria, Decision process, Identify pain, Champion and Competition. Security sales teams use it to judge whether an opportunity is real before investing in a long technical evaluation.
The analysis of a system's volatile memory to uncover evidence of malicious activity, including fileless malware that never touches disk.
A structured document that sets out the core value proposition, supporting proof points and the language used for each persona and use case. It keeps sales, marketing and executives describing the product the same way.
A social engineering technique in which an attacker bombards a user with repeated multi-factor authentication push notifications, hoping the user approves one out of frustration or confusion.
The practice of dividing a network into granular, isolated zones down to the individual workload level, limiting lateral movement even after a breach occurs.
An improperly set security control, most commonly in cloud environments, such as an open storage bucket or overly permissive identity policy, and one of the leading root causes of cloud breaches.
Adversarial Threat Landscape for Artificial-Intelligence Systems, a publicly maintained knowledge base of tactics and techniques used against AI and machine learning systems, modeled on MITRE ATT&CK. Security teams use it to structure AI threat modeling and red team exercises.
A publicly maintained knowledge base of real-world adversary tactics and techniques, widely used to structure threat intelligence, detection engineering, and red team exercises.
Module-Lattice-Based Key-Encapsulation Mechanism, the post-quantum algorithm NIST standardized in August 2024 as FIPS 203 for establishing shared encryption keys. Derived from CRYSTALS-Kyber, it is already being deployed in hybrid modes in TLS, browsers and messaging apps.
Software that allows an organization to configure, monitor, and secure mobile devices used to access corporate resources.
An open standard, introduced by Anthropic in late 2024 and now governed under the Linux Foundation's Agentic AI Foundation, that lets AI assistants and agents connect to external tools, data sources and services through a common interface. Every MCP server an agent can reach extends what the agent can read and do, which makes MCP integrations a significant new attack surface.
An attack that attempts to reconstruct sensitive training data by analyzing a machine learning model's outputs, potentially exposing private information the model was trained on.
The unauthorized extraction or replication of a proprietary machine learning model's parameters or behavior, often through repeated querying of an exposed API.
A defensive strategy that continually changes system attributes, such as configurations or network addresses, to increase the cost and difficulty of an attacker's reconnaissance.
The use of cloud services from more than one provider, which increases architectural flexibility but multiplies the surfaces a security team must monitor and govern.
An authentication method requiring two or more independent verification factors, typically something you know, something you have, and something you are.
An architecture in which a single application instance serves multiple customers, isolated logically rather than physically, requiring strong controls to prevent cross-tenant data exposure.
Revenue from an existing customer base over a period, including expansion and minus downgrades and churn, divided by that group's revenue at the start of the period. A figure above 100% means the company grows even without adding new customers.
A security approach that enforces policy on which devices and users can connect to a network, and what level of access they receive once connected.
Endpoint protection that uses behavioral analysis and machine learning to detect malicious activity, extending beyond signature-based antivirus to catch novel threats.
A firewall that adds application awareness, intrusion prevention, and identity integration to traditional port and protocol filtering.
The EU's updated Network and Information Security Directive, which widens cybersecurity and incident reporting obligations to many more sectors and mid-sized companies and makes management bodies accountable for compliance. Significant incidents require a 24-hour early warning, a 72-hour notification and a final report within a month. Member states had to transpose it by October 2024, though most missed that deadline.
A voluntary framework released by NIST in January 2023 to help organizations identify and manage risks from AI systems, organized around four functions: Govern, Map, Measure and Manage. It is widely referenced in U.S. AI governance programs and vendor questionnaires.
A voluntary framework from the U.S. National Institute of Standards and Technology for managing cybersecurity risk. Version 2.0, released in February 2024, organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover, with Govern added to put risk strategy and oversight at the center.
A machine, workload, service account, API key, or other non-person credential that authenticates and acts within a system. Non-human identities now outnumber human ones in most environments and require separate lifecycle, ownership, and governance controls since they can't do MFA or recognize a phishing attempt.
The cumulative risk introduced across an extended, multi-layered chain of vendor dependencies beyond the third and fourth party.
Tricking a user into granting a malicious application delegated permissions to their mailbox, files or other SaaS data through a legitimate OAuth consent prompt. Also called an illicit consent grant, it steals no password, so password resets and MFA do not remove the attacker's access until the app's tokens are revoked.
The security exposure created by using open source components, including unpatched vulnerabilities, unmaintained projects, and intentionally malicious packages.
Hardware and software that monitors or controls physical devices and processes, historically isolated from IT networks but increasingly interconnected.
Intelligence gathered from publicly available sources such as social media, public records, and the open web, used in threat research and investigations.
The growing interconnection of operational technology and traditional IT networks, which improves efficiency but exposes previously isolated industrial systems to IT-borne threats.
An industry awareness document from the Open Worldwide Application Security Project listing the most critical web application security risks. The 2025 edition keeps Broken Access Control at number one and expands outdated components into a broader Software Supply Chain Failures category and adds Mishandling of Exceptional Conditions.
Companion lists from the OWASP GenAI Security Project ranking the most critical risks in applications built on large language models and in autonomous AI agents. They cover risks such as prompt injection, excessive agency, goal hijacking and tool misuse, and are increasingly cited in security questionnaires and RFPs for AI products.
The capture and inspection of data packets traveling across a network, used legitimately for diagnostics and maliciously to intercept unencrypted data.
Authenticating with a stolen password hash instead of the plaintext password. Some Windows authentication protocols accept the hash itself as proof of identity, so an attacker who dumps hashes from one machine can move laterally without ever cracking them.
A historical record of DNS resolution data used in threat investigations to reconstruct domain history and link infrastructure to threat actors.
A phishing-resistant, passwordless credential based on public-key cryptography and tied to a specific website or app, so it cannot be replayed on a lookalike site. Passkeys can be synced across a user's devices by a passkey provider or bound to a single device or hardware security key for higher assurance.
Trying one or a few common passwords across many accounts instead of many passwords against a single account. Spreading guesses thinly keeps each account under typical lockout thresholds, which is why the technique is popular against cloud login portals.
An authentication approach that removes shared secrets like passwords entirely, relying instead on possession-based and biometric factors such as passkeys or hardware tokens.
A web service used to share text content publicly, frequently exploited by threat actors to publish stolen credentials or leaked data.
The process of identifying, testing, and deploying software updates that fix known vulnerabilities, one of the most consistently effective controls against opportunistic attacks.
The Payment Card Industry Data Security Standard, a set of requirements for organizations that store, process or transmit branded payment card data. Version 4.0.1 is current, and the requirements that version 4.0 introduced as future-dated became mandatory on March 31, 2025.
An authorized, simulated attack against systems, applications or networks, performed by skilled testers to find and demonstrate exploitable weaknesses. Unlike an automated scan, a pen test chains findings together the way a real attacker would, and many frameworks and customers require one at least annually.
Any data that can be used to identify a specific individual, including name, address, date of birth, and financial or government identification numbers.
A social engineering attack that uses deceptive messages, typically email, to trick recipients into revealing credentials, clicking malicious links, or installing malware.
A criminal subscription model in which operators rent ready-made phishing kits, hosting and often MFA-bypass capability to other criminals. Like ransomware-as-a-service, it lets low-skill attackers run sophisticated campaigns, and law enforcement takedowns of major PhaaS platforms have become regular news.
Multi-factor authentication that cannot be relayed or approved on a fake site, typically FIDO2 security keys, passkeys or certificate-based authentication. These methods bind the login to the legitimate website's origin, so a stolen code or a tired user tapping approve cannot complete an attacker's login. CISA recommends it as the standard for high-value accounts.
The ratio of open pipeline to the quota or revenue target it has to produce. The right ratio depends on historical win rate and sales cycle length, not a universal 3x rule of thumb: a team with a 33% win rate and a short cycle needs very different coverage from one with a 12% win rate and a nine-month cycle.
A measure of how quickly pipeline turns into revenue, usually calculated as the number of opportunities times average deal size times win rate, divided by sales cycle length. It shows which lever, such as more deals, bigger deals, better win rates or faster cycles, would move revenue most.
A predefined, step-by-step set of actions for responding to a specific type of security event, used to ensure consistent and rapid response.
The component in a zero trust architecture that evaluates access requests against policy and determines whether to grant or deny them.
The component in a zero trust architecture that enforces the access decision made by the policy decision point, sitting between the user and the resource.
Malware that continually changes its identifiable code features while keeping its underlying functionality intact, evading signature-based detection.
A reconnaissance technique used to identify open ports and running services on a target system, often a precursor to identifying exploitable vulnerabilities.
The decision about which market a product competes in, who it is for, what it is compared against and why it is the better choice for that buyer. Messaging, pricing and campaigns all depend on it, so weak positioning shows up everywhere downstream.
A structured evaluation conducted after an incident is resolved to identify root causes, response gaps, and improvements for future readiness.
Cryptographic algorithms designed to stay secure against attacks from sufficiently powerful quantum computers. NIST published the first three standards in August 2024: ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures, and chose HQC as a backup key-establishment algorithm in 2025.
A social engineering technique in which an attacker fabricates a plausible scenario or false identity to manipulate a target into disclosing information or granting access.
An approach that embeds privacy protections into the design of systems and processes from the outset, rather than adding them after the fact.
Gaining more access than originally granted, either by exploiting a flaw to reach a higher privilege level (vertical) or by taking over another account at the same level (horizontal). An attacker's first foothold rarely has the access they need, so escalation is usually a required step toward valuable systems and data.
A set of controls that secure, monitor, and manage accounts with elevated permissions, reducing the risk that privileged credentials are stolen or misused.
The recording, monitoring, and control of active sessions initiated by privileged accounts, often used to enforce accountability and enable forensic review after an incident.
The discipline that connects a product to its market: positioning, messaging, competitive intelligence, launch planning and sales enablement. In cybersecurity it translates technical capability into the business outcomes the buying committee cares about.
An industrial computer used to automate physical processes such as assembly lines or utility systems, a frequent target in attacks on industrial environments.
An attack technique that manipulates an AI system's behavior by embedding malicious instructions within its input, potentially overriding intended guardrails.
A time-boxed technical trial in which a prospect tests a product in its own environment against agreed success criteria before buying. In security, POCs are common and costly, so clear exit criteria and an engaged economic buyer matter as much as the technology.
Health-related information that can be linked to a specific individual and is subject to specific regulatory protection under laws such as HIPAA.
The framework of policies, roles, and technology used to create, manage, distribute, and revoke digital certificates and public keys.
A reference architecture that segments industrial control networks into hierarchical levels, used to design and enforce security boundaries between IT and OT environments.
A collaborative exercise structure in which red and blue teams work together in real time to improve detection and response, rather than operating as adversaries.
The risk that future quantum computers will be able to break widely deployed asymmetric encryption such as RSA and elliptic curve cryptography. Because encrypted data can be stolen now and decrypted later, NIST has proposed deprecating these algorithms after 2030 and disallowing them after 2035.
A phishing technique that uses malicious QR codes to direct victims to a fraudulent site, exploiting the fact that scanned links often bypass traditional email link scanning.
Exploiting the timing gap between when a system checks a condition and when it acts on it, known as time-of-check to time-of-use. In that window an attacker can change the underlying resource, so a check that passed a moment earlier no longer reflects reality.
Malware that encrypts an organization's files or systems and demands payment for the decryption key, typically following credential theft and network reconnaissance.
A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates in exchange for a share of the ransom payments.
A team that simulates real-world attacker tactics against an organization's defenses to test detection, response, and overall security posture.
A monetary penalty imposed by a regulator for noncompliance with a data protection or security law, scaled in many jurisdictions to the severity of the violation and the organization's revenue.
Malware that provides an attacker with covert remote control over an infected system, often used for surveillance, data theft, or as a foothold for further attacks.
A microprocessor-based device used in industrial environments to interface field equipment with a central control system, commonly found in SCADA deployments.
Capturing valid data in transit, such as an authentication token, and sending it again later to gain access or repeat a transaction. It succeeds against protocols that check whether a message is authentic but not whether it is fresh, which is why nonces and timestamps exist.
A service that routes traffic through the IP addresses of ordinary home devices, often enrolled without informed consent through bundled apps or compromised hardware. Attackers use them so malicious logins and scanning appear to come from normal households, which undermines IP reputation and geolocation controls.
The function that runs the systems, data, processes and reporting shared by marketing, sales and customer success, such as the CRM, lead routing, forecasting and attribution. When it works, all three teams see the same numbers and definitions.
A role that builds and maintains the data layer marketing, sales and customer success work from, including CRM architecture, pipelines between revenue systems, attribution models and forecasting inputs. It differs from a head of RevOps, who sets process and policy.
A privacy right, established under GDPR, that allows individuals to request the deletion of their personal data under certain conditions.
Technology that attaches persistent usage controls to a file, such as restricting printing, copying, or forwarding, regardless of where the file travels after it leaves its origin.
A structured, maintained record of identified risks, their likelihood and impact, and the treatment plan assigned to each, used to track enterprise risk over time.
An authentication approach that dynamically adjusts required verification steps based on a calculated risk score for the specific login attempt.
An unauthorized wireless access point installed on a network, either maliciously to intercept traffic or unknowingly by an employee, creating an unmonitored entry point.
An unauthorized DHCP server that hands out attacker-controlled network settings, such as a malicious DNS server or gateway, to devices joining a network. DHCP has no built-in authentication, so on a poorly segmented network clients accept whichever server answers first.
An access control model that assigns permissions to users based on predefined roles rather than granting access on an individual basis.
The process of identifying the underlying condition or failure that allowed a security incident to occur, distinct from its immediate technical trigger.
Malware designed to gain and conceal privileged access to a system, often modifying the operating system itself to hide its presence from security tools.
A security technology embedded within an application that detects and blocks attacks in real time based on the application's actual runtime behavior.
Tooling that continuously checks the security settings, user permissions and third-party integrations of SaaS applications such as Microsoft 365, Salesforce and Google Workspace. It finds risky configurations and overly permissive connected apps that the SaaS vendor leaves the customer to manage.
An attack that compromises a third-party SaaS integration, often by stealing its OAuth or API tokens, and uses that trusted connection to reach customers' data in other platforms. The 2025 theft of Salesloft Drift tokens, used to query many companies' Salesforce instances, made integrations a recognized category of third-party risk.
A lead that sales has reviewed and agreed is worth working, the handoff point between marketing and sales qualification. Tracking the rate at which MQLs become SALs shows whether marketing and sales agree on what a good lead is.
The time from when an opportunity is created to when it closes. Security sales cycles tend to run long because of technical validation, security and legal reviews, and procurement, and cycle length directly shapes how much pipeline a team needs.
A lead that sales has qualified as a real potential opportunity, typically after confirming need, authority, budget or timing. The gap between MQL and SQL is where most marketing and sales alignment problems become visible, because each team is often measuring against a different definition.
The practice of adding random data to a password before hashing it, preventing attackers from using precomputed tables to crack multiple passwords at once.
Supervisory Control and Data Acquisition, a control system architecture used to monitor and manage industrial processes across large, geographically distributed sites.
A software-defined approach to managing wide area network connections that centralizes control and can integrate security functions across distributed sites.
U.S. Securities and Exchange Commission rules, effective December 2023, requiring public companies to disclose material cybersecurity incidents on Form 8-K, Item 1.05, within four business days of determining materiality, and to describe their cyber risk management and governance in annual reports. Deciding what counts as material now involves the CISO, legal and the board.
The practice of securely storing, rotating, and controlling access to credentials, API keys, and tokens used by applications, rather than embedding them in code or configuration files.
A converged architecture that combines networking and security functions, including SD-WAN, secure web gateway, CASB, and ZTNA, delivered from the cloud.
A principle, championed by CISA and partner agencies, that software makers should build products secure out of the box and take ownership of customer security outcomes rather than shifting the burden to users. CISA's Secure by Design pledge, launched in May 2024, asks vendors to commit to measurable goals such as wider MFA and eliminating default passwords.
A security control that filters inbound and outbound email traffic for spam, phishing, malware, and policy violations before messages reach or leave a user's inbox.
A browser built or managed for corporate use that enforces security policy, such as data loss controls, access rules and session recording, inside the browser itself. Because so much work now happens in web and SaaS apps, the browser has become a practical control point, especially for contractors and unmanaged devices.
A development process that incorporates security requirements, threat modeling, and testing at every phase, from design through deployment and maintenance.
A security control that inspects users' web traffic to block malicious sites, enforce acceptable use policies and prevent data loss. It is now usually delivered from the cloud as part of SSE or SASE.
A platform that collects, filters, normalizes and routes security telemetry from many sources to SIEMs, data lakes and other tools. Teams use it to cut ingestion costs, drop low-value data and avoid lock-in to a single analytics platform.
A platform that collects, aggregates, and analyzes security event data across an organization to support detection, investigation, and compliance.
A centralized team and function responsible for continuously monitoring, detecting, and responding to security threats across an organization.
A platform that automates repetitive incident response tasks and orchestrates workflows across security tools, reducing manual analyst workload.
A set of questions a prospective customer sends a vendor about its security controls, policies and compliance, often based on frameworks such as SIG or CAIQ. Slow answers can stall a deal, which is why many vendors publish a trust center and keep reusable answers.
The security half of SASE, combining secure web gateway, cloud access security broker and zero trust network access capabilities in a cloud-delivered service. Organizations often adopt SSE first and add the networking side of SASE later.
The practice of dividing a network into isolated zones so that a compromise in one segment cannot easily spread to others.
The unintended disclosure of confidential or regulated data, whether through a breach, misconfiguration, or inadequate protection controls.
Tricking a server into making requests on the attacker's behalf, often to internal systems or cloud metadata services that are not reachable from outside. Applications that fetch a user-supplied URL without restricting the destination give attackers a path from the internet into the internal network.
Security practices tailored to function-as-a-service architectures, addressing risks such as over-permissioned functions, insecure dependencies, and event-source injection.
An attack in which a threat actor steals or replays an active session token or cookie to impersonate an already-authenticated user, bypassing login and MFA controls entirely.
The use of AI tools and services within an organization without the knowledge, approval, or oversight of IT and security teams.
Technology, applications, or cloud services used within an organization without the knowledge or approval of the IT or security team.
The division of security obligations between a cloud provider and its customer, in which the provider secures the underlying infrastructure and the customer secures what they configure and put in it.
The practice of moving security testing and review earlier in the development process, catching vulnerabilities before code reaches production rather than after.
Watching someone's screen, keyboard or documents, in person or through a camera, to capture credentials or sensitive information. It requires no technical skill, only proximity and a moment of inattention, which makes it one of the cheapest ways to steal a password.
Extracting secrets by measuring physical or behavioral characteristics of a system, such as timing, power consumption or electromagnetic emissions, rather than attacking the algorithm itself. Even mathematically sound cryptography can leak information through the hardware or software that implements it.
Detection rules written in Sigma, an open, vendor-neutral format for describing suspicious log events. A single Sigma rule can be converted into queries for many SIEM and data platforms, which makes detections portable and easy to share.
A measure of how much of a security team's alert volume represents genuinely actionable threats versus false positives or low-priority noise.
Convincing or bribing a mobile carrier to move a victim's phone number to a SIM card the attacker controls. With the number in hand, the attacker receives SMS one-time codes and account recovery messages, which is why SMS is considered a weak second factor.
An authentication method that lets a user log in once and gain access to multiple connected applications through a single identity.
Registering malicious packages under names that AI coding assistants tend to invent when they hallucinate dependencies that do not exist. Developers who install AI-suggested packages without checking them can pull the attacker's code straight into their projects.
An OpenSSF framework, pronounced "salsa," that defines increasing levels of assurance for how software is built, including tamper-resistant builds and verifiable provenance. It gives buyers and builders a common way to describe how trustworthy a software artifact's origin is.
A phishing attack conducted via SMS text message rather than email, often used to harvest credentials or deliver malicious links to mobile devices.
An auditing standard developed by the AICPA that evaluates a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy.
A formal, machine-readable inventory of the components and dependencies that make up a piece of software, used to identify exposure when a component is found vulnerable.
Tooling that scans an application's dependencies to identify known vulnerabilities, license risks, and outdated open source components.
The complete set of code, dependencies, tools, and processes involved in developing and delivering a piece of software from origin to end user.
An architecture that hides network resources from unauthorized users entirely, only revealing and granting access after identity and device verification succeed.
A cloud environment operated to meet a specific jurisdiction's data sovereignty, residency, and regulatory requirements, often used by government and highly regulated industries.
A targeted phishing attack customized to a specific individual or organization using researched, personalized details to increase credibility.
An email authentication standard that specifies which mail servers are authorized to send email on behalf of a domain, helping receiving servers detect spoofed messages.
An attack that inserts malicious SQL statements into an application's input fields to manipulate or extract data from its underlying database.
A testing method that analyzes an application's source code, byte code, or binaries for vulnerabilities without executing the program.
High-level intelligence on threat trends, actor motivations, and geopolitical context, intended to inform executive and board-level risk decisions rather than day-to-day defense.
Data organized in a predefined format, such as a database or spreadsheet, that is comparatively straightforward to classify, search, and protect.
An attack that compromises a trusted third-party vendor, software component, or service in order to reach that vendor's downstream customers.
An encryption method that uses a single shared key for both encrypting and decrypting data, generally faster than asymmetric encryption but requiring secure key exchange.
A DDoS technique that sends a flood of TCP connection requests without ever completing the handshake, filling the server's table of half-open connections. Each SYN packet costs the attacker almost nothing while the server must hold resources for it, so a modest flood can take a service offline.
Content, including images, audio, or video, generated or manipulated by AI, encompassing deepfakes as well as broader AI-generated material used in disinformation.
A discussion-based simulation in which stakeholders walk through their roles and decisions during a hypothetical incident, used to test and refine an incident response plan.
Intelligence on specific adversary tools, techniques, and procedures, used directly by security teams to tune detection and defensive controls.
Following an authorized person through a secured door or checkpoint without presenting credentials, also called piggybacking. It relies on politeness: most people hold the door rather than challenge someone who looks like they belong.
The evaluation of a vendor or partner's security and compliance posture before and during a business relationship, to understand the risk they introduce.
An individual, group, or organization responsible for conducting cyberattacks, ranging from opportunistic criminals to nation-state operators.
The set of actions taken to limit the spread and impact of an active security incident while investigation and remediation continue.
The proactive search for signs of malicious activity within an environment that has evaded existing detection tools, rather than waiting for an alert.
A system that aggregates, correlates, and operationalizes threat intelligence feeds from multiple sources for use across a security program.
A staffing model that structures a SOC by escalating complexity, with Tier 1 handling initial triage, Tier 2 conducting deeper investigation, and Tier 3 leading advanced response and threat hunting.
A cryptographic protocol that provides encrypted, authenticated communication over a network, and the modern standard underlying HTTPS.
The process of replacing sensitive data with a non-sensitive substitute value, or token, that has no exploitable value if exposed, while the original data is stored securely elsewhere.
The risk that sensitive, proprietary, or regulated data included in a model's training set could be exposed through the model's outputs or through direct compromise of the dataset.
The initial assessment of a security alert or incident to determine its severity, scope, and priority for further investigation.
Malware disguised as legitimate software to trick a user into installing it, at which point it carries out malicious actions without the user's knowledge.
A public or gated web page where a vendor shares its security, privacy and compliance information, such as certifications, policies, subprocessors and audit reports, with customers and prospects. It shortens security reviews and has become a standard part of B2B sales.
An attack that exploits an established, trusted connection between two organizations, such as a vendor's network access, to reach a target that would otherwise be harder to breach directly.
The behavioral patterns that describe how a specific threat actor operates, used to profile adversaries and build detections independent of any single indicator.
The registration of a domain name that closely resembles a legitimate brand's domain, exploiting common typing errors to conduct phishing or intercept traffic.
A platform that manages and secures a broad range of endpoint device types, including desktops, mobile devices, and IoT, from a single console.
Data without a predefined format, such as documents, emails, and images, which is significantly harder to discover, classify, and protect than structured data.
The process of designing specific detection scenarios within a SIEM or detection platform, mapped to known threats or compliance requirements.
The process of evaluating a prospective vendor's security, financial, and operational posture before entering into a business relationship.
The ongoing program of identifying, assessing, and monitoring the risks introduced by third-party vendors throughout the relationship lifecycle.
A machine-readable statement in which a software supplier says whether a known vulnerability in one of its components actually affects its product. Paired with an SBOM, it keeps customers from chasing vulnerabilities that cannot be exploited in the shipped software.
A way of working in which a marketer sets brand direction and uses generative tools to build landing pages, small interactive tools and creative quickly, then tests ideas weekly. The title borrows from vibe coding and still needs brand guardrails and a review step.
A phishing attack conducted over voice calls, in which an attacker impersonates a trusted party to extract sensitive information or manipulate the victim into taking action.
An attack technique that exploits misconfigured switches to send traffic from one virtual LAN into another it should not have access to, bypassing intended segmentation.
Data that exists only in a system's active memory and is lost when the system powers down, requiring specialized live-collection techniques to preserve.
An encrypted tunnel that extends a private network across a public network, commonly used to secure remote access to internal resources.
A published policy that tells outside researchers how to report security vulnerabilities and commits the organization to receive and act on them, usually with legal safe harbor but without payment. U.S. federal agencies have been required to maintain one since 2020, and the EU Cyber Resilience Act expects them from product makers.
The ongoing process of identifying, assessing, prioritizing, and remediating security weaknesses across an organization's systems.
An attack that compromises a website known to be frequented by a specific target group, infecting visitors rather than attacking the target directly.
The embedding of identifying information into a document, image, or file, used to trace the source of a leak or deter unauthorized distribution.
A security control that filters, monitors, and blocks malicious HTTP traffic to and from a web application.
A W3C web standard that enables browsers and applications to support public-key-based passwordless authentication, forming the core specification behind passkeys.
A highly targeted phishing attack aimed at senior executives or other high-value individuals within an organization.
The share of qualified opportunities that close as won over a period. It should be measured against a consistent stage definition, since counting early-stage opportunities makes the rate look worse and counting only late-stage ones makes it look better.
Structured review of why deals were won or lost, usually through interviews with buyers and the sales team. It shows whether problems sit in positioning, product gaps, pricing or sales execution, and it keeps the ICP honest.
Malware designed to permanently destroy or corrupt data on a target system, intended for disruption rather than financial extortion.
Self-replicating malware that spreads across networks and systems without requiring user interaction, often exploiting unpatched vulnerabilities.
Abusing an XML parser that processes external entity references to read local files, reach internal network resources or cause denial of service. Many parsers enabled this behavior by default, so a crafted document that looks like ordinary input can open a path into the server.
Pattern-matching rules, written in the open YARA language created at VirusTotal, that identify malware families and other files by text strings, byte sequences and conditions. Analysts share them to hunt for the same threat across files, memory and malware repositories.
A security model built on the principle that no user or device should be trusted by default, regardless of network location, and that access must be continuously verified.
The technical implementation of zero trust principles across an organization's identity, network, device, and application layers.
An access model that grants connectivity to specific applications only after verifying identity and device posture, replacing implicit trust in broad network access such as a traditional VPN.
An attack that exploits a software vulnerability unknown to the vendor and for which no patch yet exists, giving defenders zero days of advance warning.
It is a reference defining the terms used across cybersecurity go-to-market work, spanning security product categories, threat terminology, compliance frameworks, and the marketing and sales vocabulary specific to selling security software. This glossary covers 459 terms across 18 categories, each with its own anchor link and structured data.
An MQL, or marketing qualified lead, has met a marketing-defined threshold of fit and engagement but has not been accepted by sales. An SQL, or sales qualified lead, has been reviewed and accepted by sales as worth working. The gap between the two is where most marketing and sales alignment problems become visible, because each team is usually measuring a different definition.
Pipeline coverage is the ratio of open pipeline to the quota or revenue target it must produce. The requirement is set by historical win rate and sales cycle length, not by a universal 3x rule of thumb. A team with a 33% win rate and a short cycle needs very different coverage from a team with a 12% win rate and a nine-month cycle.
An ICP, or ideal customer profile, describes the company type a product is built to serve, usually by industry, size, security maturity, regulatory exposure, and existing stack. The recurring failure is an aspirational ICP: the profile a company says it sells to, which its closed-won data does not support.
In plain language, independent of any single vendor's product marketing. Each entry aims to explain what a term means and why it matters operationally, not to sell a specific tool.
The whole glossary is reviewed on the second Friday of every month. Definitions are checked against current standards, regulations and analyst categories, outdated facts are corrected, and new terms are added as they become established, particularly in AI security, identity and regulation, which move the fastest.
Yes, use the form below. Every suggestion is reviewed before it's added, so it won't appear on the page immediately.
No. This glossary is independent and reflects terminology across the categories I've worked in as a GTM leader in cybersecurity, not any single company's product suite.
Tell me the term and, if you know it, a rough definition. I review and write every entry myself before it goes live.