{"name":"Cyber Tool Stack cybersecurity categories","description":"Structured security category definitions, capability taxonomies, and learning sources.","lastModified":"2026-08-12","recordCount":35,"records":[{"slug":"ngfw","domainSlug":"network","name":"Next-Generation Firewall","acronym":"NGFW","summary":"Controls traffic entering and leaving a network. In addition to addresses and ports, it identifies applications, inspects content, and blocks known attack patterns.","capabilities":[{"key":"app-awareness","label":"Application awareness","description":"Identifies and controls traffic by application, not just by port or protocol."},{"key":"intrusion-prevention","label":"Built-in intrusion prevention","description":"Blocks known exploit attempts and attack patterns inline, without a separate box."},{"key":"ssl-inspection","label":"Encrypted traffic inspection","description":"Decrypts and inspects TLS traffic to catch threats hidden inside encrypted sessions."},{"key":"url-content-filtering","label":"URL & content filtering","description":"Blocks access to malicious, risky, or policy-violating web categories."},{"key":"sandboxing","label":"Cloud sandboxing","description":"Detonates suspicious files in an isolated environment to catch unknown malware."},{"key":"centralized-management","label":"Centralized policy management","description":"Manages rules and logs across many firewalls and sites from one console."},{"key":"vpn-remote-access","label":"VPN & remote access","description":"Terminates site-to-site and remote-user VPN connections on the same appliance."}],"relatedCategorySlugs":["ids-ips-ndr","sase-ztna","ddos-protection"],"learning":{"slug":"ngfw","title":"How a firewall decides what gets through","hook":"Every connection into or out of a network passes a checkpoint that must decide, in a fraction of a second, whether it's legitimate work or the start of an attack. This lesson walks through how that decision actually gets made.","analogy":{"title":"The border checkpoint","body":"A traditional firewall is a checkpoint guard who only reads license plates: where is this traffic coming from, and which gate (port) is it using? A next-generation firewall opens the trunk. It recognizes which application the traffic belongs to, who is behind the wheel, and whether anything inside matches a known attack — then waves it through, or turns it away and writes down why."},"diagram":{"kind":"flow","caption":"Every connection is identified and inspected against policy before it's allowed through — and blocked traffic is logged, so the security team can see what was attempted.","nodes":[{"label":"Traffic arrives","sublabel":"Web, email, apps, remote users"},{"label":"Identify","sublabel":"Which app, which user — not just which port"},{"label":"Inspect","sublabel":"Known exploits, malware, risky destinations"}],"outcomes":{"pass":{"label":"Allowed through","sublabel":"Matches policy"},"block":{"label":"Blocked & logged","sublabel":"Breaks policy or looks malicious"}}},"keyTermSlugs":["sandbox","c2","defense-in-depth","microsegmentation","sase"],"sourceUrls":["https://www.akamai.com/glossary/what-is-a-next-generation-firewall-ngfw","https://www.paloaltonetworks.com/cyberpedia/what-is-a-next-generation-firewall-ngfw","https://en.wikipedia.org/wiki/Next-generation_firewall"],"verifiedAt":"2026-08-04"}},{"slug":"ids-ips-ndr","domainSlug":"network","name":"Intrusion Detection & Network Detection and Response","acronym":"IDS/NDR","summary":"Watches raw network traffic — not just what a firewall lets through — to spot attacker behavior like scanning, lateral movement, and command-and-control that other tools miss, and either alerts on it or blocks it automatically.","capabilities":[{"key":"signature-detection","label":"Signature-based detection","description":"Matches traffic against known attack and exploit signatures."},{"key":"behavioral-anomaly-detection","label":"Behavioral anomaly detection","description":"Baselines normal traffic patterns to flag deviations without a known signature."},{"key":"east-west-visibility","label":"East-west traffic visibility","description":"Sees lateral movement between internal hosts, not just traffic crossing the perimeter."},{"key":"packet-capture-forensics","label":"Packet capture & forensics","description":"Stores full or metadata-level packet history for post-incident investigation."},{"key":"threat-intel-integration","label":"Threat intelligence integration","description":"Enriches detections with known-bad IPs, domains, and indicators from feeds."},{"key":"inline-blocking","label":"Inline blocking (IPS mode)","description":"Can actively drop malicious traffic in real time rather than only alert on it."},{"key":"encrypted-traffic-analysis","label":"Encrypted traffic analysis","description":"Flags malicious patterns in encrypted flows without decrypting them."}],"relatedCategorySlugs":["ngfw","siem","threat-intelligence","container-kubernetes-security"],"learning":{"slug":"ids-ips-ndr","title":"Catching intruders the firewall already let in","hook":"Firewalls decide who gets in, but an attacker who slips past can roam a network for weeks unseen. This lesson shows how watching the traffic itself exposes them.","analogy":{"title":"The cameras inside the building","body":"A firewall is the guard checking badges at the front door. Intrusion detection is the camera system inside: it watches what people actually do once they're in. Someone with a valid badge quietly trying every office door at 2 a.m. sails right past the guard — but the cameras catch the behavior, and security can lock the doors the moment it's spotted."},"diagram":{"kind":"hub","caption":"Traffic from every corner of the network feeds one analysis engine that turns suspicious patterns into alerts, blocks, and evidence.","inputs":[{"label":"Perimeter traffic","sublabel":"What crosses in and out of the network"},{"label":"East-west traffic","sublabel":"Machine-to-machine activity inside the network"},{"label":"Cloud traffic","sublabel":"Flows between cloud workloads"}],"hub":{"label":"Detection engine","sublabel":"Known signatures plus behavior baselines"},"outputs":[{"label":"Alert","sublabel":"An analyst investigates"},{"label":"Inline block","sublabel":"IPS mode drops it in real time"},{"label":"Traffic record","sublabel":"Evidence for later forensics"}]},"keyTermSlugs":["ndr","lateral-movement","c2","detection-rule","telemetry"],"sourceUrls":["https://corelight.com/resources/glossary/ndr-vs-ids","https://corelight.com/resources/glossary/ids-vs-ips","https://www.extrahop.com/blog/network-detection-response-vs-intrusion-detection-systems"],"verifiedAt":"2026-08-04"}},{"slug":"sase-ztna","domainSlug":"network","name":"SASE, SSE & Zero Trust Network Access","acronym":"SASE/ZTNA","summary":"Replaces the old model of routing all remote traffic through a corporate VPN with cloud-delivered security that connects each user directly to the specific app or site they need, checking identity and device health on every request instead of trusting anyone on the network.","capabilities":[{"key":"ztna-private-access","label":"Zero trust private app access","description":"Grants access to specific internal applications per-request instead of the whole network, replacing VPN."},{"key":"secure-web-gateway","label":"Secure web gateway (SWG)","description":"Inspects and filters general internet-bound traffic for malware and policy violations."},{"key":"sd-wan","label":"SD-WAN connectivity","description":"Provides software-defined branch and site connectivity into the security fabric."},{"key":"cloud-delivered-pops","label":"Cloud-delivered enforcement","description":"Enforces policy from a global network of cloud points of presence close to the user."},{"key":"casb-controls","label":"CASB-style SaaS controls","description":"Extends visibility and data controls into sanctioned SaaS applications."},{"key":"inline-dlp","label":"Inline data loss prevention","description":"Inspects web and private-app traffic for sensitive data leaving the organization."},{"key":"unified-policy-engine","label":"Unified policy engine","description":"Applies one consistent identity- and context-aware policy across all traffic types."}],"relatedCategorySlugs":["ngfw","casb","iam-sso"],"learning":{"slug":"sase-ztna","title":"Why remote work broke the corporate VPN","hook":"When one stolen VPN password can hand an attacker your entire internal network, the fix is to stop handing out networks at all. This lesson explains the cloud model replacing the VPN.","analogy":{"title":"The escort, not the master key","body":"An old-style VPN is like handing every remote worker a key to the whole office building — once inside, they can wander any floor. Zero trust access works like a front-desk escort: it checks your ID and your device at every door, then walks you to the one meeting room you booked. You never get a key, and you never even see the rest of the building."},"diagram":{"kind":"flow","caption":"Every request is checked for identity and device health at a nearby cloud enforcement point before it reaches one specific app.","nodes":[{"label":"User connects","sublabel":"From home, a cafe, or a branch office"},{"label":"Verify","sublabel":"Who are you, and is your device healthy?"},{"label":"Apply policy","sublabel":"Cloud checkpoint close to the user"}],"outcomes":{"pass":{"label":"One app, connected","sublabel":"Never the whole network"},"block":{"label":"Denied","sublabel":"Wrong user, risky device, or no entitlement"}}},"keyTermSlugs":["sase","sse","ztna","zero-trust","swg","casb"],"sourceUrls":["https://www.paloaltonetworks.com/cyberpedia/sase-vs-ztna","https://www.fortinet.com/resources/cyberglossary/sase-vs-ztna","https://www.checkpoint.com/cyber-hub/network-security/what-is-secure-access-service-edge-sase/sase-vs-ztna/"],"verifiedAt":"2026-08-04"}},{"slug":"ddos-protection","domainSlug":"network","name":"DDoS Protection","summary":"Absorbs and filters floods of junk traffic aimed at knocking a website, API, or network offline, so legitimate visitors keep getting through even while an attacker is trying to overwhelm the connection.","capabilities":[{"key":"volumetric-mitigation","label":"Volumetric attack mitigation","description":"Absorbs and scrubs massive traffic floods aimed at saturating bandwidth."},{"key":"layer7-protection","label":"Application-layer (L7) protection","description":"Filters attacks targeting web apps and APIs rather than just raw bandwidth."},{"key":"always-on-vs-on-demand","label":"Always-on or on-demand mitigation","description":"Offers continuously active protection or activation only when an attack is detected."},{"key":"scrubbing-capacity","label":"Global scrubbing capacity","description":"Total network capacity available to absorb attack traffic before it reaches you."},{"key":"traffic-redirection","label":"BGP/DNS-based redirection","description":"Reroutes traffic through scrubbing centers via BGP announcement or DNS during an attack."},{"key":"mitigation-response-time","label":"Automatic mitigation speed","description":"How quickly the service detects and starts mitigating an attack without manual action."}],"relatedCategorySlugs":["ngfw","waf-api-security","ids-ips-ndr"],"learning":{"slug":"ddos-protection","title":"Surviving a flood of a million fake visitors","hook":"Attackers can rent tens of thousands of hijacked devices and aim them all at one website at once. This lesson explains how sites stay online while under that flood.","analogy":{"title":"The rent-a-mob outside the shop","body":"Imagine a rival pays a huge crowd to jam a shop's doorway — nobody in the mob wants to buy anything, they just stand there so real customers can't get in. DDoS protection moves the entrance into a stadium-sized lobby with thousands of staff who wave genuine customers through and turn the mob away before it ever reaches the shop door."},"diagram":{"kind":"flow","caption":"All traffic passes through a high-capacity filtering network that absorbs the flood and forwards only genuine requests to the site.","nodes":[{"label":"Traffic arrives","sublabel":"Real visitors mixed with a botnet flood"},{"label":"Absorb","sublabel":"Global network with huge spare capacity"},{"label":"Filter","sublabel":"Tell genuine requests from junk"}],"outcomes":{"pass":{"label":"Clean traffic","sublabel":"Reaches the real servers"},"block":{"label":"Flood dropped","sublabel":"Junk absorbed at the edge"}}},"keyTermSlugs":["ddos","botnet","waf","c2"],"sourceUrls":["https://www.cloudflare.com/learning/ddos/ddos-mitigation/","https://developers.cloudflare.com/ddos-protection/about/how-ddos-protection-works/","https://www.cisa.gov/resources-tools/resources/understanding-and-responding-distributed-denial-service-attacks"],"verifiedAt":"2026-08-04"}},{"slug":"epp-antivirus","domainSlug":"endpoint","name":"Endpoint Protection Platform","acronym":"EPP","summary":"The baseline defense installed on every laptop and server: blocks known malware before it runs, locks down risky device behavior, and gives IT one place to enforce security policy across the whole fleet.","capabilities":[{"key":"malware-prevention","label":"Malware prevention","description":"Blocks known and behaviorally suspicious malware before it can execute."},{"key":"device-control","label":"Device control","description":"Restricts or monitors USB drives and other removable media."},{"key":"application-control","label":"Application control / allowlisting","description":"Restricts which programs are permitted to run on a device."},{"key":"exploit-prevention","label":"Exploit prevention","description":"Blocks techniques attackers use to abuse legitimate software, not just known files."},{"key":"disk-encryption-management","label":"Disk encryption management","description":"Manages and reports on full-disk encryption status across devices."},{"key":"centralized-policy","label":"Centralized policy management","description":"Applies and audits security policy across the whole endpoint fleet from one console."}],"relatedCategorySlugs":["edr-xdr","mdm-uem","dlp"],"learning":{"slug":"epp-antivirus","title":"How your laptop blocks malware before it runs","hook":"Most attacks still end with a malicious program trying to run on someone's laptop. This lesson explains the layered checks that stop it in the split second before that happens.","analogy":{"title":"The bouncer at the door","body":"An endpoint protection agent works like a club bouncer. First comes the banned list: known troublemakers are turned away on sight. But a good bouncer also has instincts — a fake ID, a bulky coat in summer, behavior that matches how trouble usually starts — and stops those people too, even on their first visit. And the house rules apply to everyone: no outside bottles, no exceptions."},"diagram":{"kind":"layers","caption":"A file must get past several independent checks, from known-malware lists to live behavior rules, before it's allowed to run.","layers":[{"label":"Known-malware check","sublabel":"Matches files against catalogued bad ones"},{"label":"Machine-learning check","sublabel":"Judges brand-new files by their traits"},{"label":"Behavior & exploit check","sublabel":"Stops malicious actions as they start"},{"label":"Device policy","sublabel":"App allowlists, USB control, encryption"}]},"keyTermSlugs":["epp","endpoint","agent","ransomware","edr"],"sourceUrls":["https://www.paloaltonetworks.com/cyberpedia/what-is-an-endpoint-protection-platform-epp","https://www.paloaltonetworks.com/cyberpedia/what-is-next-generation-anti-virus","https://www.esecurityplanet.com/endpoint/antivirus-vs-epp-vs-edr/"],"verifiedAt":"2026-08-04"}},{"slug":"edr-xdr","domainSlug":"endpoint","name":"Endpoint & Extended Detection and Response","acronym":"EDR/XDR","summary":"Records process, file, and network activity on laptops and servers so security teams can detect, investigate, and contain attacks that bypass preventive controls.","capabilities":[{"key":"behavioral-detection","label":"Behavioral detection","description":"Flags malicious behavior patterns rather than known file signatures."},{"key":"threat-hunting","label":"Threat hunting","description":"Lets analysts query historical endpoint telemetry for signs of compromise."},{"key":"response-actions","label":"Remote response actions","description":"Isolate a host, kill a process, or pull files from an endpoint remotely."},{"key":"rollback","label":"Ransomware rollback","description":"Restores files encrypted or modified by detected ransomware."},{"key":"xdr-correlation","label":"Cross-surface correlation (XDR)","description":"Correlates endpoint signals with identity, email, and cloud telemetry."},{"key":"managed-option","label":"Managed detection option","description":"Vendor-operated 24/7 monitoring available (MDR)."}],"relatedCategorySlugs":["epp-antivirus","siem","dfir"],"learning":{"slug":"edr-xdr","title":"The flight recorder for every laptop and server","hook":"Some attacks slip past every preventive control. This lesson shows how recording everything that happens on endpoints lets defenders catch, replay, and shut down the ones that get through.","analogy":{"title":"Rewindable security footage","body":"Imagine a guard who doesn't just watch live camera feeds but keeps recordings of every hallway, door, and elevator. When a break-in is discovered, they rewind, follow the intruder's entire path through the building, see every room that was entered — and then remotely lock the doors around the intruder, wherever they are right now."},"diagram":{"kind":"hub","caption":"Activity from endpoints and other surfaces streams into one detection engine that produces incidents, containment actions, and hunting data.","inputs":[{"label":"Endpoint telemetry","sublabel":"Processes, files, network connections"},{"label":"Identity signals","sublabel":"Logins and privilege changes"},{"label":"Email & cloud signals","sublabel":"Extra surfaces correlated by XDR"}],"hub":{"label":"Detection & correlation","sublabel":"Behavior patterns, not just known files"},"outputs":[{"label":"Incident alert","sublabel":"One connected story, with context"},{"label":"Remote containment","sublabel":"Isolate host, kill process"},{"label":"Hunting data","sublabel":"Months of searchable history"}]},"keyTermSlugs":["edr","xdr","mdr","telemetry","threat-hunting","ioa"],"sourceUrls":["https://www.techtarget.com/searchsecurity/tip/EDR-vs-XDR-vs-MDR-Which-does-your-company-need","https://redcanary.com/cybersecurity-101/endpoint-security/edr-vs-mdr-vs-xdr/","https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-endpoint-detection-and-response/edr-vs-mdr-vs-xdr/"],"verifiedAt":"2026-08-04"}},{"slug":"mdm-uem","domainSlug":"endpoint","name":"Mobile & Unified Endpoint Management","acronym":"MDM/UEM","summary":"Lets IT enroll every laptop, phone, and tablet employees use for work, push configuration and security settings to them, keep them patched, and wipe them remotely if they're lost, stolen, or an employee leaves.","capabilities":[{"key":"device-enrollment","label":"Device enrollment & provisioning","description":"Automates zero-touch setup of new devices with company configuration."},{"key":"policy-configuration","label":"Policy & configuration management","description":"Pushes security settings, restrictions, and profiles to managed devices."},{"key":"app-management","label":"Application management","description":"Distributes, updates, and removes apps on managed devices remotely."},{"key":"patch-os-updates","label":"Patch & OS update management","description":"Enforces and tracks operating system update compliance across the fleet."},{"key":"remote-wipe-lock","label":"Remote wipe & lock","description":"Locks or wipes a lost, stolen, or offboarded device on demand."},{"key":"conditional-access-integration","label":"Conditional access integration","description":"Feeds device compliance status into identity systems to gate app access."},{"key":"compliance-reporting","label":"Compliance reporting","description":"Reports fleet-wide adherence to security and configuration baselines."}],"relatedCategorySlugs":["epp-antivirus","iam-sso","mfa-passwordless"],"learning":{"slug":"mdm-uem","title":"Keeping a thousand devices safe from one screen","hook":"Every laptop and phone an employee carries is company data walking out the door. This lesson shows how IT keeps an entire fleet configured, patched, and erasable from one console.","analogy":{"title":"The company car fleet manager","body":"A fleet manager registers every company car, schedules its maintenance, knows who's driving it, and can disable the engine remotely if it's stolen. Device management does the same for laptops and phones: every device is registered, kept up to date, tied to its owner — and if one goes missing, it can be locked or wiped from anywhere."},"diagram":{"kind":"cycle","caption":"Devices move through a continuous management loop that keeps the whole fleet configured, patched, and provably compliant.","steps":[{"label":"Enroll","sublabel":"Register the device, zero-touch setup"},{"label":"Configure","sublabel":"Push settings, profiles, and apps"},{"label":"Patch & update","sublabel":"Enforce OS and app updates"},{"label":"Check compliance","sublabel":"Encrypted? Patched? Passcode set?"},{"label":"Remediate or wipe","sublabel":"Fix drift, lock or erase lost devices"}]},"keyTermSlugs":["mdm","uem","endpoint","zero-trust"],"sourceUrls":["https://www.blackberry.com/en/secure-communications/insights/glossary/uem-vs-mdm","https://www.fortinet.com/resources/cyberglossary/unified-endpoint-management-uem","https://en.wikipedia.org/wiki/Unified_endpoint_management"],"verifiedAt":"2026-08-04"}},{"slug":"iam-sso","domainSlug":"identity","name":"Identity & Access Management / Single Sign-On","acronym":"IAM/SSO","summary":"The system employees log into once to reach every other work app, and the system IT uses to control who gets access to what — the front door for almost everything else in a company's software stack.","capabilities":[{"key":"single-sign-on","label":"Single sign-on","description":"Lets users authenticate once to access many connected applications."},{"key":"directory-integration","label":"Directory integration","description":"Syncs users and groups with an existing directory like Active Directory or HR system."},{"key":"adaptive-access","label":"Adaptive / conditional access","description":"Adjusts login requirements based on device, location, and risk signals."},{"key":"lifecycle-provisioning","label":"Lifecycle provisioning","description":"Automatically grants and revokes app access as employees join, move, or leave."},{"key":"mfa-support","label":"Multi-factor authentication support","description":"Enforces a second factor at login as part of the sign-in flow."},{"key":"audit-logging","label":"Audit logging","description":"Records authentication and access events for security and compliance review."},{"key":"app-catalog","label":"Pre-built app connectors","description":"Ships with ready-made SSO integrations for thousands of common apps."}],"relatedCategorySlugs":["mfa-passwordless","pam","iga"],"learning":{"slug":"iam-sso","title":"How one login safely opens every app at work","hook":"Almost every company now funnels its logins through a single front door. Learn why collapsing dozens of passwords into one identity system makes you safer, not less safe — and what actually happens behind the redirect.","analogy":{"title":"The hotel front desk","body":"You show your ID once, at check-in. The front desk hands you a keycard that opens your room, the gym, and the pool — each door trusts the card, not your ID. At checkout, deactivating that one card locks you out of every door at once. That's single sign-on: verify once, carry a trusted pass everywhere, revoke in one place."},"diagram":{"kind":"hub","caption":"One verified login at the identity provider becomes a signed token that opens every connected app — and every login and grant is logged.","inputs":[{"label":"Employee sign-in","sublabel":"one password plus a second factor"},{"label":"HR & directory data","sublabel":"who works here, on which team"},{"label":"Risk signals","sublabel":"device, location, time of login"}],"hub":{"label":"Identity provider","sublabel":"verifies you once, issues a signed token"},"outputs":[{"label":"Email & chat"},{"label":"Files & code"},{"label":"Hundreds of other apps","sublabel":"each trusts the token, not a password"},{"label":"Audit log","sublabel":"every login recorded"}]},"keyTermSlugs":["sso","iam","idp","saml","oidc","mfa"],"sourceUrls":["https://www.cloudflare.com/learning/access-management/what-is-sso/","https://www.cloudflare.com/learning/access-management/what-is-an-identity-provider/","https://en.wikipedia.org/wiki/Identity_and_access_management"],"verifiedAt":"2026-08-04"}},{"slug":"mfa-passwordless","domainSlug":"identity","name":"MFA & Passwordless Authentication","acronym":"MFA","summary":"Adds a second proof of identity beyond a password — or replaces the password entirely with a fingerprint, device passkey, or security key — so a stolen password alone isn't enough for an attacker to log in as you.","capabilities":[{"key":"phishing-resistant-factors","label":"Phishing-resistant factors","description":"Supports FIDO2 security keys and passkeys that can't be relayed or phished."},{"key":"push-otp-factors","label":"Push & one-time-passcode factors","description":"Offers mobile push approval and time-based one-time codes as second factors."},{"key":"adaptive-step-up","label":"Adaptive step-up authentication","description":"Requires stronger verification only when the login looks risky."},{"key":"biometric-authentication","label":"Biometric authentication","description":"Uses fingerprint or face recognition built into user devices."},{"key":"device-trust","label":"Device trust signals","description":"Factors device health and enrollment status into the authentication decision."},{"key":"enforcement-policies","label":"Admin enforcement policies","description":"Lets admins mandate MFA or passwordless methods by group, app, or risk level."}],"relatedCategorySlugs":["iam-sso","pam","iga"],"learning":{"slug":"mfa-passwordless","title":"Why a stolen password no longer means game over","hook":"Passwords get phished, guessed, and leaked every single day. This lesson shows how a second proof of identity — or no password at all — turns a stolen password from a master key into a useless string of text.","analogy":{"title":"The safe-deposit box","body":"Opening a bank safe-deposit box takes two different keys turned together — yours and the bank's. A pickpocket who lifts your key still leaves the vault empty-handed. Passkeys go further: your key is welded into your own device and only turns in the one lock it was made for, so even a perfect fake bank branch gets nothing."},"diagram":{"kind":"layers","caption":"Login factors form a ladder from easiest to defeat up to hardest: each step makes a phished or leaked password less useful to an attacker.","layers":[{"label":"Password only","sublabel":"one leaked secret unlocks the account"},{"label":"Texted or app codes","sublabel":"stronger, but can be phished and relayed in real time"},{"label":"Push approvals","sublabel":"better still, but vulnerable to approval-spam fatigue"},{"label":"Passkeys & security keys","sublabel":"phishing-resistant: the credential only answers to the real site"}]},"keyTermSlugs":["mfa","passwordless","passkey","fido2-webauthn","mfa-fatigue","phishing"],"sourceUrls":["https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf","https://www.idmanagement.gov/playbooks/altauthn/","https://www.sentinelone.com/cybersecurity-101/identity-security/phishing-resistant-mfa/"],"verifiedAt":"2026-08-04"}},{"slug":"pam","domainSlug":"identity","name":"Privileged Access Management","acronym":"PAM","summary":"Locks down the small number of accounts that can do serious damage — admin logins, database credentials, service accounts — behind checkout, time-limits, and recording, instead of leaving powerful passwords sitting around unmonitored.","capabilities":[{"key":"credential-vaulting","label":"Privileged credential vaulting","description":"Stores and rotates admin passwords and keys in an encrypted vault."},{"key":"session-recording","label":"Session recording & monitoring","description":"Records and can live-monitor privileged sessions for audit and investigation."},{"key":"just-in-time-access","label":"Just-in-time access","description":"Grants elevated access for a limited time window instead of standing privilege."},{"key":"least-privilege-elevation","label":"Least-privilege elevation","description":"Allows temporary privilege elevation for a specific task rather than full admin rights."},{"key":"secrets-management","label":"Secrets management","description":"Manages API keys, certificates, and application secrets alongside human credentials."},{"key":"service-account-management","label":"Service account management","description":"Discovers and rotates credentials for non-human, machine-to-machine accounts."}],"relatedCategorySlugs":["iam-sso","iga","dfir"],"learning":{"slug":"pam","title":"Guarding the accounts that could burn it all down","hook":"A handful of logins — domain admins, database roots, service accounts — can undo every other defense a company owns. This lesson shows how those master keys get locked up, time-limited, and watched.","analogy":{"title":"The signed-out master key","body":"In a well-run building, the master key never lives in anyone's pocket. It sits in a locked cabinet at the front desk. A technician signs it out for a named job, keeps it for one hour under the lobby camera, and hands it back — and the building quietly changes the lock afterward, just in case a copy was made."},"diagram":{"kind":"flow","caption":"Privileged access is requested, checked out from a vault, and used inside a recorded, time-boxed session before it is automatically revoked.","nodes":[{"label":"Admin requests access","sublabel":"named task, approval, fixed time window"},{"label":"Vault checks out credential","sublabel":"injected into the session, never revealed"},{"label":"Time-boxed session","sublabel":"recorded and watched as it happens"}],"outcomes":{"pass":{"label":"Access expires","sublabel":"credential rotated behind the admin"},"block":{"label":"Session cut short","sublabel":"suspicious activity ends it early"}}},"keyTermSlugs":["pam","privileged-account","least-privilege","jit-access","lateral-movement","machine-identity"],"sourceUrls":["https://www.paloaltonetworks.com/cyberpedia/what-is-privileged-access-management","https://www.paloaltonetworks.com/cyberpedia/what-is-just-in-time-access-jit","https://www.idsalliance.org/blog/what-is-privileged-access-management-pam/"],"verifiedAt":"2026-08-04"}},{"slug":"iga","domainSlug":"identity","name":"Identity Governance & Administration","acronym":"IGA","summary":"Answers the audit question 'who has access to what, and why' — running periodic reviews of every employee's permissions, modeling access by role, and proving to auditors that unneeded access gets removed.","capabilities":[{"key":"access-certification","label":"Access certification campaigns","description":"Runs periodic manager or owner review of who has access to what."},{"key":"role-based-modeling","label":"Role-based access modeling","description":"Groups entitlements into roles so access can be granted and reviewed at scale."},{"key":"automated-provisioning","label":"Automated provisioning & deprovisioning","description":"Grants and removes system access automatically based on identity lifecycle events."},{"key":"segregation-of-duties","label":"Segregation-of-duties enforcement","description":"Flags or blocks toxic combinations of access that violate internal controls."},{"key":"access-request-workflows","label":"Access request workflows","description":"Lets employees request access with approval routing and audit trail."},{"key":"compliance-reporting","label":"Compliance reporting","description":"Produces audit-ready evidence of access reviews and policy enforcement."}],"relatedCategorySlugs":["iam-sso","pam","grc-compliance"],"learning":{"slug":"iga","title":"Proving nobody kept keys they shouldn't have","hook":"Access only ever piles up: every project, role change, and 'just for now' grant adds another door someone can open. Learn how companies find, prune, and prove control over all of that access.","analogy":{"title":"The key cabinet audit","body":"Over the years, employees collect office keys — a closet for an old project, a lab from a former role — and nobody ever asks for them back. An access review is the day building management lays every key on the table and asks each door's owner: does this person still need this? Keys nobody can justify get melted down."},"diagram":{"kind":"cycle","caption":"Access follows the employment lifecycle, with periodic reviews pruning the permissions that quietly accumulate along the way.","steps":[{"label":"Joiner","sublabel":"day-one access granted from the role"},{"label":"Mover","sublabel":"new role: add what's needed, drop the rest"},{"label":"Review","sublabel":"owners certify each grant is still needed"},{"label":"Leaver","sublabel":"every account disabled at once"}]},"keyTermSlugs":["iga","iam","least-privilege","soc-2"],"sourceUrls":["https://www.ibm.com/think/topics/identity-governance-and-administration","https://www.paloaltonetworks.com/cyberpedia/what-is-identity-governance-and-administration-iga","https://www.beyondtrust.com/resources/glossary/identity-governance-and-administration"],"verifiedAt":"2026-08-04"}},{"slug":"cnapp-cspm","domainSlug":"cloud","name":"Cloud-Native Application Protection / Posture Management","acronym":"CNAPP/CSPM","summary":"Checks cloud accounts and workloads for misconfigurations, vulnerable software, exposed resources, and excessive permissions, then connects related findings into attack paths.","capabilities":[{"key":"misconfiguration-detection","label":"Misconfiguration detection (CSPM)","description":"Flags cloud configuration drift against benchmarks like CIS and provider best practices."},{"key":"agentless-scanning","label":"Agentless workload scanning","description":"Scans workloads via cloud provider APIs or snapshots without deploying agents."},{"key":"entitlement-management","label":"Cloud entitlement management (CIEM)","description":"Identifies excessive or unused permissions across cloud identities."},{"key":"attack-path-analysis","label":"Attack path analysis","description":"Correlates findings across identity, network, and data exposure to surface exploitable attack paths."},{"key":"iac-scanning","label":"Infrastructure-as-code scanning","description":"Catches misconfigurations in Terraform and CloudFormation before they're deployed."},{"key":"vulnerability-prioritization","label":"Vulnerability prioritization","description":"Finds and ranks OS and package CVEs across cloud workloads by real-world exploitability."},{"key":"compliance-benchmarks","label":"Compliance benchmark mapping","description":"Continuously maps posture to frameworks like CIS, SOC 2, and PCI."}],"relatedCategorySlugs":["container-kubernetes-security","dspm","casb"],"learning":{"slug":"cnapp-cspm","title":"Why cloud breaches start with a checkbox","hook":"Most cloud breaches aren't clever hacks — they're someone finding a setting nobody knew was wrong. This lesson shows how posture tools find those settings first, and how they decide which ones actually matter.","analogy":{"title":"The building inspector","body":"Imagine an inspector who walks every floor of a huge building with the master blueprint, noting each unlocked door, propped-open window, and spare key taped under a desk. Any one finding might be harmless. But when the inspector connects them — this unlocked side door leads to the hallway where the vault key hangs on a hook — the tour ends with a short list of fixes that actually prevent a robbery."},"diagram":{"kind":"hub","caption":"Many kinds of cloud signals feed one analysis engine, which connects them into a short list of attack paths worth fixing first.","inputs":[{"label":"Cloud account settings","sublabel":"Storage, network, and logging configuration"},{"label":"Workloads","sublabel":"VMs, containers, serverless — scanned for flaws"},{"label":"Identities & permissions","sublabel":"Who and what can touch which resource"},{"label":"Infrastructure as code","sublabel":"Templates checked before anything is deployed"}],"hub":{"label":"Risk correlation engine","sublabel":"Connects findings into attack paths"},"outputs":[{"label":"Prioritized attack paths","sublabel":"The few combinations that lead to real damage"},{"label":"Compliance posture","sublabel":"Mapped to benchmarks and frameworks"},{"label":"Fix tickets","sublabel":"Routed to the team that owns the resource"}]},"keyTermSlugs":["cnapp","cspm","cwpp","ciem","iac","least-privilege"],"sourceUrls":["https://www.microsoft.com/en-us/security/business/security-101/what-is-cnapp","https://www.ibm.com/think/topics/cnapp","https://www.paloaltonetworks.com/cyberpedia/what-is-a-cloud-native-application-protection-platform","https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cnapp-vs-cspm/"],"verifiedAt":"2026-08-04"}},{"slug":"container-kubernetes-security","domainSlug":"cloud","name":"Container & Kubernetes Security","summary":"Protects the containers and Kubernetes clusters modern apps run in — scanning images for known vulnerabilities before deployment, watching running containers for suspicious behavior, and enforcing safe cluster configuration.","capabilities":[{"key":"image-scanning","label":"Container image scanning","description":"Scans container images for vulnerabilities and exposed secrets before deployment."},{"key":"runtime-threat-detection","label":"Runtime threat detection","description":"Detects anomalous process and system-call behavior in running containers."},{"key":"kubernetes-posture","label":"Kubernetes posture management (KSPM)","description":"Flags misconfigured cluster settings, RBAC, and pod security policies."},{"key":"admission-control","label":"Admission control","description":"Blocks noncompliant workloads from being deployed to the cluster in the first place."},{"key":"response-actions","label":"Runtime response actions","description":"Kills, isolates, or quarantines a compromised container or pod."},{"key":"registry-scanning","label":"Registry scanning","description":"Continuously rescans image registries for newly disclosed vulnerabilities."}],"relatedCategorySlugs":["cnapp-cspm","sca-supply-chain","siem","ids-ips-ndr"],"learning":{"slug":"container-kubernetes-security","title":"How a bad container gets stopped at the cluster door","hook":"Modern apps ship as containers that can go from a developer's laptop to production in minutes. This lesson follows one container through the checkpoints that decide whether it's safe to build, deploy, and keep running.","analogy":{"title":"The shipping port","body":"Think of a cargo port. Every sealed shipping container is inspected when it's packed at the factory, checked against its paperwork at the dock, and refused by the crane operator if anything is off. Even after loading, the crew keeps watch on the voyage — because a container that passed inspection can still catch fire at sea."},"diagram":{"kind":"flow","caption":"A container image is scanned at build and in the registry, gated at the cluster's admission checkpoint, and watched while it runs.","nodes":[{"label":"Build","sublabel":"Image assembled from base layers and app code"},{"label":"Registry scan","sublabel":"Checked for known flaws and leaked secrets"},{"label":"Admission control","sublabel":"Cluster gate checks policy before deploying"}],"outcomes":{"pass":{"label":"Runs — and is watched","sublabel":"Runtime detection flags odd behavior"},"block":{"label":"Deployment rejected","sublabel":"Fails scan or policy, never reaches the cluster"}}},"keyTermSlugs":["kspm","cve","cwpp","sbom","lateral-movement"],"sourceUrls":["https://cheatsheetseries.owasp.org/cheatsheets/Kubernetes_Security_Cheat_Sheet.html","https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/understanding-the-kubernetes-security-triad-image-scanning-admission-controllers-and-runtime-security","https://owasp.org/www-project-devsecops-guideline/latest/02f-Container-Vulnerability-Scanning"],"verifiedAt":"2026-08-04"}},{"slug":"casb","domainSlug":"cloud","name":"Cloud Access Security Broker","acronym":"CASB","summary":"Shows IT which cloud applications employees use, including unapproved services, and applies access and data-protection rules to sanctioned SaaS products such as Microsoft 365 and Salesforce.","capabilities":[{"key":"shadow-it-discovery","label":"Shadow IT discovery","description":"Identifies unsanctioned cloud apps in use across the organization."},{"key":"saas-dlp","label":"Sanctioned app data controls","description":"Applies data loss prevention policy to files and data inside approved SaaS apps."},{"key":"saas-threat-protection","label":"SaaS threat protection","description":"Detects malware and account compromise within cloud app activity."},{"key":"adaptive-access-control","label":"Adaptive access control","description":"Adjusts what a user can do in a cloud app based on device and risk context."},{"key":"deployment-modes","label":"API-based & inline deployment","description":"Offers both API-based visibility and inline proxy enforcement modes."},{"key":"compliance-reporting","label":"Compliance reporting","description":"Reports cloud app usage and data exposure against regulatory requirements."}],"relatedCategorySlugs":["sase-ztna","dlp","iam-sso"],"learning":{"slug":"casb","title":"Finding the apps your IT team never approved","hook":"Employees sign up for cloud apps on their own every day — file sharing, note-taking, AI helpers — and each one may hold company data nobody is protecting. This lesson explains how those apps get discovered and brought under control.","analogy":{"title":"The company card statement","body":"Picture a finance manager reading the company credit-card statement and finding dozens of subscriptions no one ever approved — some useful, some risky, some long forgotten but still charging. Step one is simply seeing the full list. Step two is setting rules: these services are fine, these need review, and these get cancelled before they cause real trouble."},"diagram":{"kind":"hub","caption":"Traffic logs and direct app connections feed one policy engine that reveals shadow IT and enforces data rules inside approved apps.","inputs":[{"label":"Network & proxy logs","sublabel":"Which cloud services employees actually reach"},{"label":"API connections","sublabel":"Direct visibility inside sanctioned apps"},{"label":"User & device context","sublabel":"Who is signing in, and from what"}],"hub":{"label":"CASB policy engine","sublabel":"Classifies apps and applies rules"},"outputs":[{"label":"Shadow IT inventory","sublabel":"Every app in use, scored by risk"},{"label":"Data controls","sublabel":"Risky sharing blocked or fixed in approved apps"},{"label":"Alerts","sublabel":"Suspicious logins and malware in cloud files"}]},"keyTermSlugs":["casb","saas","sse","sase","zero-trust"],"sourceUrls":["https://www.microsoft.com/en-us/security/business/security-101/what-is-a-cloud-access-security-broker-casb","https://www.cisco.com/site/us/en/learn/topics/security/what-is-a-casb.html","https://www.paloaltonetworks.com/cyberpedia/what-is-a-casb-cloud-access-security-broker"],"verifiedAt":"2026-08-04"}},{"slug":"sast","domainSlug":"appsec","name":"Static Application Security Testing","acronym":"SAST","summary":"Reads an application's source code without running it, looking for coding mistakes — like SQL injection or hardcoded secrets — that could become exploitable vulnerabilities, and flags them before the code ever ships.","capabilities":[{"key":"source-code-scanning","label":"Source code vulnerability scanning","description":"Analyzes source code for security flaws without executing the application."},{"key":"ide-ci-integration","label":"IDE & CI/CD integration","description":"Surfaces findings directly in the developer's editor or pull request."},{"key":"language-coverage","label":"Language & framework coverage","description":"Breadth of programming languages and frameworks the scanner understands."},{"key":"finding-prioritization","label":"False-positive triage & prioritization","description":"Ranks and filters findings so developers focus on the issues that matter."},{"key":"secrets-detection","label":"Secrets detection","description":"Flags hardcoded credentials, API keys, and tokens committed to source code."},{"key":"custom-rules","label":"Custom rule authoring","description":"Lets teams write organization-specific detection rules beyond the built-in set."},{"key":"pr-gating","label":"PR / commit gating","description":"Blocks merges when new high-severity findings are introduced."},{"key":"iac-container-scanning","label":"IaC & container config scanning","description":"Scans infrastructure-as-code templates and container configurations for misconfigurations alongside application code."}],"relatedCategorySlugs":["dast","sca-supply-chain","waf-api-security"],"learning":{"slug":"sast","title":"Catching security bugs by reading code, not running it","hook":"Some of the worst vulnerabilities are ordinary coding mistakes that sit in plain sight until an attacker finds them. This lesson shows how a scanner reads source code like a security-trained editor and flags trouble before the app ever runs.","analogy":{"title":"The blueprint review","body":"A structural engineer can look at a building's blueprints and spot a beam that won't bear its load — before any concrete is poured. Fixing the drawing costs an eraser; fixing the finished building costs a fortune. Reviewing code before it runs works the same way: the flaw is cheapest to fix while it's still just lines on a page."},"diagram":{"kind":"flow","caption":"Code is modeled and traced for dangerous paths, and findings land in the pull request where they're cheapest to fix.","nodes":[{"label":"Developer pushes code","sublabel":"A change goes up for review"},{"label":"Scanner models the code","sublabel":"Builds a map of how data flows through it"},{"label":"Traces risky paths","sublabel":"User input reaching dangerous operations"}],"outcomes":{"pass":{"label":"Merge proceeds","sublabel":"No new high-severity findings"},"block":{"label":"Finding in the PR","sublabel":"Flagged line, explanation, suggested fix"}}},"keyTermSlugs":["cwe","owasp-top-10","shift-left","devsecops","secrets-sprawl"],"sourceUrls":["https://owasp.org/www-community/Source_Code_Analysis_Tools","https://en.wikipedia.org/wiki/Static_application_security_testing","https://www.paloaltonetworks.com/cyberpedia/what-is-sast-static-application-security-testing"],"verifiedAt":"2026-08-04"}},{"slug":"dast","domainSlug":"appsec","name":"Dynamic Application Security Testing","acronym":"DAST","summary":"Tests a running web application or API with malicious inputs and analyzes the responses, finding vulnerabilities that appear only when the complete application is deployed.","capabilities":[{"key":"black-box-scanning","label":"Black-box scanning","description":"Tests a running application from the outside, without access to source code."},{"key":"authenticated-scanning","label":"Authenticated scanning","description":"Crawls and tests pages that require a logged-in session."},{"key":"api-scanning","label":"API scanning","description":"Tests REST and GraphQL APIs, not just traditional web pages."},{"key":"ci-cd-automation","label":"CI/CD scan automation","description":"Runs scans automatically as part of the build and deploy pipeline."},{"key":"finding-verification","label":"Automated finding verification","description":"Confirms exploitability of findings to cut down false positives."},{"key":"owasp-coverage","label":"OWASP Top 10 coverage","description":"Tests for the industry-standard set of common web application vulnerability classes."}],"relatedCategorySlugs":["sast","waf-api-security","vulnerability-management"],"learning":{"slug":"dast","title":"Attacking your own app before someone else does","hook":"The surest way to know whether your website can be hacked is to try hacking it — safely, automatically, and on a schedule. This lesson explains how a scanner probes a running app from the outside, exactly the way an attacker would.","analogy":{"title":"The hired locksmith","body":"Before moving in, you hire a trusted locksmith to walk around the finished house and try everything a burglar would: jiggle each lock, push on every window, test whether the side gate really latches. They steal nothing — they just hand you a list of which doors opened, how, and what to fix before someone less friendly tries the same."},"diagram":{"kind":"cycle","caption":"The scanner maps the running app, attacks it, verifies what actually worked, and repeats on every release.","steps":[{"label":"Crawl","sublabel":"Map every page, form, and API endpoint"},{"label":"Attack","sublabel":"Send malicious inputs to each one"},{"label":"Observe","sublabel":"Read responses for signs a probe worked"},{"label":"Verify","sublabel":"Confirm real findings, discard false alarms"},{"label":"Report & retest","sublabel":"File findings, re-run on the next release"}]},"keyTermSlugs":["owasp-top-10","cwe","pentest","shift-left","devsecops"],"sourceUrls":["https://owasp.org/www-community/Vulnerability_Scanning_Tools","https://www.ibm.com/think/topics/dynamic-application-security-testing","https://devguide.owasp.org/en/06-verification/02-tools/01-dast/"],"verifiedAt":"2026-08-04"}},{"slug":"sca-supply-chain","domainSlug":"appsec","name":"Software Composition Analysis & Supply Chain Security","acronym":"SCA","summary":"Inventories every open-source library an application depends on — including the dependencies of those dependencies — and flags known vulnerabilities, risky licenses, or tampered packages hiding in that supply chain.","capabilities":[{"key":"dependency-vulnerability-scanning","label":"Dependency vulnerability scanning","description":"Flags known CVEs in direct and transitive open-source dependencies."},{"key":"license-compliance","label":"License compliance","description":"Detects and enforces policy on open-source license obligations."},{"key":"sbom-generation","label":"SBOM generation","description":"Produces standardized SPDX or CycloneDX software bills of materials."},{"key":"malicious-package-detection","label":"Malicious package detection","description":"Flags typosquatting and known-malicious packages in the dependency chain."},{"key":"ci-cd-gating","label":"CI/CD gating","description":"Blocks builds or pull requests that introduce new vulnerable or noncompliant packages."},{"key":"reachability-analysis","label":"Reachability analysis","description":"Determines whether a vulnerable code path is actually invoked, to cut noise from unused code."},{"key":"iac-container-scanning","label":"IaC & container config scanning","description":"Scans infrastructure-as-code templates and container configurations for misconfigurations alongside application code."}],"relatedCategorySlugs":["sast","container-kubernetes-security","vulnerability-management"],"learning":{"slug":"sca-supply-chain","title":"What's really inside the software you ship","hook":"Most of a modern application is code your team didn't write — open-source packages pulled in by other packages. This lesson explains how that hidden supply chain gets inventoried, checked, and gated before it bites.","analogy":{"title":"The ingredient label","body":"A bakery buys flour, chocolate, and vanilla rather than milling and growing everything itself — and each supplier has suppliers of its own. When a recall hits one brand of flour, the bakery with a complete ingredient list knows within minutes which cakes are affected. The bakery without one has to tear apart every recipe by hand."},"diagram":{"kind":"flow","caption":"Declared dependencies are expanded into the full tree, checked against vulnerability and license databases, and gated in the build.","nodes":[{"label":"Dependency manifest","sublabel":"The packages your code asks for directly"},{"label":"Resolve the full tree","sublabel":"Including dependencies of dependencies"},{"label":"Check databases","sublabel":"Known flaws, licenses, malicious packages"}],"outcomes":{"pass":{"label":"Build ships with an SBOM","sublabel":"A machine-readable ingredient list"},"block":{"label":"Build or PR gated","sublabel":"New vulnerable or risky package stopped"}}},"keyTermSlugs":["sbom","vex","cve","supply-chain-attack","typosquatting","kev"],"sourceUrls":["https://www.cisa.gov/sbom","https://www.ibm.com/think/topics/software-composition-analysis","https://www.akamai.com/glossary/what-is-software-composition-analysis-sca"],"verifiedAt":"2026-08-04"}},{"slug":"waf-api-security","domainSlug":"appsec","name":"WAF & API Security","acronym":"WAF","summary":"Sits in front of web applications and APIs to block common attacks like SQL injection in real time, and — because so much traffic is now API calls instead of web pages — discovers and protects every API endpoint, including the ones nobody documented.","capabilities":[{"key":"attack-signature-blocking","label":"Attack signature blocking","description":"Blocks OWASP Top 10 style attacks like SQL injection and XSS at the edge."},{"key":"api-discovery","label":"API discovery","description":"Automatically inventories known and shadow API endpoints from observed traffic."},{"key":"schema-validation","label":"Schema validation","description":"Enforces that requests match the declared API schema, blocking anything that doesn't."},{"key":"bot-management","label":"Bot management","description":"Distinguishes automated and malicious bot traffic from legitimate users."},{"key":"rate-limiting","label":"Rate limiting","description":"Throttles abusive request volumes per client or endpoint."},{"key":"runtime-api-protection","label":"Runtime API protection","description":"Detects and blocks data leakage and abuse in live API traffic."}],"relatedCategorySlugs":["dast","ddos-protection","sast"],"learning":{"slug":"waf-api-security","title":"How a web app tells a real request from an attack","hook":"Every public website and API is probed around the clock by scripts hunting for one careless line of code. This lesson shows how a filter in front of the app decides which requests get through — and why the doors nobody documented matter most.","analogy":{"title":"The receptionist and the side doors","body":"A busy office has a receptionist who screens every visitor at the front entrance — checking who they claim to be and what they're carrying. But offices grow side doors: a loading dock, a back stairwell someone propped open for deliveries. The modern job isn't just screening the lobby; it's finding every unlisted door and putting a guard on each one."},"diagram":{"kind":"flow","caption":"Each incoming request is inspected for attack patterns, checked against the API's declared shape, and passed or blocked.","nodes":[{"label":"Request arrives","sublabel":"From a browser, mobile app, or bot"},{"label":"Inspect the payload","sublabel":"Injection, scripting, known exploit patterns"},{"label":"Check shape & behavior","sublabel":"API schema, rate limits, bot signals"}],"outcomes":{"pass":{"label":"Forwarded to the app","sublabel":"Looks like legitimate use"},"block":{"label":"Blocked & logged","sublabel":"Matches an attack or breaks the rules"}}},"keyTermSlugs":["waf","owasp-top-10","ddos","botnet","zero-day"],"sourceUrls":["https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/","https://www.checkpoint.com/cyber-hub/cloud-security/what-is-web-application-api-protection-waap/","https://www.paloaltonetworks.com/cyberpedia/what-is-web-application-and-api-protection"],"verifiedAt":"2026-08-04"}},{"slug":"dlp","domainSlug":"data","name":"Data Loss Prevention","acronym":"DLP","summary":"Watches for sensitive data — customer records, source code, financial files — trying to leave the organization through email, USB drives, cloud uploads, or printers, and blocks or flags it before it gets out.","capabilities":[{"key":"content-inspection","label":"Content inspection & classification","description":"Identifies sensitive data types inside files and messages by content, not just filename."},{"key":"endpoint-dlp","label":"Endpoint DLP","description":"Controls data movement to USB drives, clipboard, and local printing on the device."},{"key":"network-email-dlp","label":"Network & email DLP","description":"Inspects outbound email and network traffic for sensitive data leaving the organization."},{"key":"cloud-saas-dlp","label":"Cloud & SaaS DLP","description":"Applies data protection policy to files stored and shared in cloud apps."},{"key":"regulatory-policy-templates","label":"Regulatory policy templates","description":"Ships with pre-built rules for regulations like PCI DSS and HIPAA."},{"key":"incident-workflow","label":"Incident workflow & remediation","description":"Routes policy violations to reviewers and tracks resolution."}],"relatedCategorySlugs":["dspm","casb","encryption-key-management"],"learning":{"slug":"dlp","title":"Catching secrets on their way out the door","hook":"Most stolen data doesn't leave through a hole in the firewall — it walks out through email, uploads, and USB drives, often by accident. Learn how the exits get watched and how risky moves get stopped.","analogy":{"title":"The museum exit check","body":"A museum doesn't search your bag on the way in — nothing it owns is at risk arriving. The guards stand at the exit, glancing into bags as people leave. Most visitors stroll straight through; the one with a rolled-up canvas under a coat gets stopped. Data loss prevention works the exits: it inspects what's leaving, not what's coming in."},"diagram":{"kind":"flow","caption":"Data leaving through any channel is inspected for sensitive content and checked against policy before it is allowed out of the organization.","nodes":[{"label":"Data starts moving","sublabel":"email, cloud upload, USB copy, print"},{"label":"Inspect content","sublabel":"what is actually inside the file?"},{"label":"Check policy","sublabel":"this data, this person, this destination"}],"outcomes":{"pass":{"label":"Allowed out","sublabel":"normal business continues"},"block":{"label":"Blocked or flagged","sublabel":"user warned, incident routed for review"}}},"keyTermSlugs":["data-classification","dspm","casb"],"sourceUrls":["https://www.paloaltonetworks.com/cyberpedia/what-is-data-loss-prevention-dlp","https://www.splunk.com/en_us/blog/learn/dlp-data-loss-prevention.html","https://en.wikipedia.org/wiki/Data_loss_prevention_software"],"verifiedAt":"2026-08-04"}},{"slug":"dspm","domainSlug":"data","name":"Data Security Posture Management","acronym":"DSPM","summary":"Finds and classifies sensitive data across cloud storage, SaaS applications, and databases, including untracked copies, then maps which identities can reach it.","capabilities":[{"key":"automated-data-discovery","label":"Automated data discovery","description":"Continuously finds sensitive data across cloud, SaaS, and on-prem data stores."},{"key":"ai-classification","label":"AI-driven classification","description":"Classifies discovered data by sensitivity and type using machine learning models."},{"key":"access-mapping","label":"Data access mapping","description":"Shows which identities and systems can reach each data store."},{"key":"risk-prioritization","label":"Risk prioritization","description":"Scores exposure by combining data sensitivity, access, and location."},{"key":"remediation-workflows","label":"Remediation workflows","description":"Automates masking, quarantine, or access revocation on risky data."},{"key":"shadow-data-detection","label":"Shadow data detection","description":"Finds unmanaged or forgotten copies of data outside sanctioned systems."}],"relatedCategorySlugs":["dlp","cnapp-cspm","grc-compliance"],"learning":{"slug":"dspm","title":"Finding the sensitive data you forgot you had","hook":"You can't protect data you don't know exists — and the cloud makes forgotten copies frighteningly easy to create. Learn how companies map where sensitive data really lives and who can actually reach it.","analogy":{"title":"The appraiser's walkthrough","body":"You'd swear everything valuable is in the safe. Then an insurance appraiser walks the whole house and finds jewelry in a shoebox, deeds in the garage, and a spare key under the doormat. Nothing has been stolen — yet — but now you finally know what you own, where it sits, and which unlocked windows matter most."},"diagram":{"kind":"cycle","caption":"DSPM continuously rediscovers where sensitive data lives, who can reach it, and which exposures deserve fixing first.","steps":[{"label":"Discover","sublabel":"scan cloud, SaaS, and databases for every data store"},{"label":"Classify","sublabel":"label what's sensitive: customer records, source code"},{"label":"Map access","sublabel":"chart which people and systems can reach each store"},{"label":"Prioritize","sublabel":"rank exposures by sensitivity, access, and configuration"},{"label":"Remediate","sublabel":"lock down, mask, or delete — then rescan"}]},"keyTermSlugs":["dspm","data-classification","saas","cspm"],"sourceUrls":["https://www.microsoft.com/en-us/security/business/security-101/what-is-data-security-posture-management-dspm","https://www.sentinelone.com/cybersecurity-101/cloud-security/dspm-vs-dlp/","https://www.forcepoint.com/blog/insights/dspm-vs-dlp"],"verifiedAt":"2026-08-04"}},{"slug":"encryption-key-management","domainSlug":"data","name":"Encryption & Key Management","acronym":"KMS","summary":"Creates, stores, rotates, and audits the cryptographic keys used to protect data, often using dedicated hardware, and helps enforce encryption across applications and infrastructure.","capabilities":[{"key":"key-lifecycle-management","label":"Centralized key lifecycle management","description":"Creates, distributes, rotates, and retires encryption keys from one system."},{"key":"hsm-backed-storage","label":"HSM-backed key storage","description":"Stores the most sensitive keys in dedicated hardware security modules."},{"key":"encryption-enforcement","label":"Encryption enforcement","description":"Ensures data at rest and in transit is actually encrypted, not just capable of it."},{"key":"automated-key-rotation","label":"Automated key rotation","description":"Rotates keys on a schedule without requiring manual intervention."},{"key":"byok-hyok-support","label":"BYOK / HYOK cloud support","description":"Lets customers bring or hold their own keys for data stored in cloud provider services."},{"key":"access-audit-logging","label":"Access audit logging","description":"Logs every use of a key for security review and compliance evidence."}],"relatedCategorySlugs":["dlp","dspm","cnapp-cspm","certificate-management"],"learning":{"slug":"encryption-key-management","title":"Encryption is easy — guarding the keys is hard","hook":"Modern encryption is effectively unbreakable, so attackers rarely try — they hunt for the keys instead. Learn where keys live, how they rotate, and why key custody decides whether encryption protects anything at all.","analogy":{"title":"The key under the doormat","body":"The strongest deadbolt on the market protects nothing if the spare key lives under the doormat. Encrypting data but keeping the key on the same server is the digital version of that doormat. Real key management is the locksmith's cabinet: every key numbered, signed out, and logged, with the locks changed on a regular schedule."},"diagram":{"kind":"cycle","caption":"Every key moves through a managed lifecycle, so no key lives forever and every single use of one leaves a record.","steps":[{"label":"Generate","sublabel":"keys are born inside tamper-resistant hardware"},{"label":"Distribute & use","sublabel":"apps encrypt and decrypt without ever seeing the key"},{"label":"Rotate","sublabel":"a fresh key on schedule limits what any one key protects"},{"label":"Retire & destroy","sublabel":"old keys revoked and destroyed, every use logged"}]},"keyTermSlugs":["hsm","envelope-encryption","byok-hyok","secrets-sprawl"],"sourceUrls":["https://www.encryptionconsulting.com/education-center/what-is-key-management/","https://www.encryptionconsulting.com/education-center/what-is-an-hsm/","https://www.cryptomathic.com/blog/key-management-for-hosted-hardware-security-modules-and-post-quantum-readiness"],"verifiedAt":"2026-08-04"}},{"slug":"certificate-management","domainSlug":"data","name":"Certificate Lifecycle Management","acronym":"CLM","summary":"Finds every TLS and machine certificate an organization owns — including the forgotten and shadow ones nobody's tracking — renews them automatically before they expire and take a service down, and runs the private certificate authorities that issue them, so the trust machines place in each other never quietly breaks.","capabilities":[{"key":"certificate-discovery","label":"Certificate discovery & inventory","description":"Finds every certificate across on-prem, cloud, and Kubernetes environments — including unknown, expired, and shadow certificates nobody was tracking."},{"key":"automated-renewal","label":"Automated issuance & renewal","description":"Issues and renews certificates automatically through ACME and direct CA integrations, so nothing depends on someone remembering to do it by hand."},{"key":"expiry-monitoring","label":"Expiry monitoring & alerting","description":"Watches expiration dates across the whole estate and alerts owners well before a certificate lapses and causes an outage."},{"key":"private-ca","label":"Private CA & internal PKI","description":"Runs internal certificate authorities and PKI to issue the private certificates that secure machine-to-machine and internal service traffic."},{"key":"deployment-integrations","label":"Deployment integrations","description":"Pushes issued certificates directly into load balancers, Kubernetes, MDM, and web servers instead of leaving admins to install them by hand."},{"key":"crypto-agility","label":"Crypto-agility & rotation","description":"Inventories the algorithms and keys in use and rotates them at scale, including preparing for the migration to post-quantum cryptography."}],"relatedCategorySlugs":["encryption-key-management","pam","iam-sso"],"learning":{"slug":"certificate-management","title":"The expiring passports every machine carries","hook":"Every secure website and service proves its identity with a certificate that has a hard expiry date. Learn why forgotten certificates still take major services offline, and why renewal is going fully automatic.","analogy":{"title":"The passport that expires mid-trip","body":"A certificate is a machine's passport: issued by an authority everyone recognizes, valid until a printed date, and useless the moment that date passes — no grace period, no arguing at the border. Now imagine holding tens of thousands of passports, each expiring on its own schedule, where one missed renewal strands a service and everyone using it."},"diagram":{"kind":"cycle","caption":"Certificates are discovered, issued, deployed, watched, and renewed in a loop that increasingly has to run without any humans involved.","steps":[{"label":"Discover","sublabel":"inventory every certificate, including forgotten ones"},{"label":"Issue","sublabel":"a trusted certificate authority signs it"},{"label":"Deploy","sublabel":"installed on servers, load balancers, and devices"},{"label":"Monitor","sublabel":"every expiry date tracked across the estate"},{"label":"Renew","sublabel":"automatically, well before anything breaks"}]},"keyTermSlugs":["pki","certificate-authority","acme","machine-identity"],"sourceUrls":["https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days","https://www.akamai.com/resources/white-paper/tls-certificate-lifecycles-white-paper","https://www.manageengine.com/key-manager/ssl-tls-certificate-lifespan-reduced-to-47-days.html"],"verifiedAt":"2026-08-04"}},{"slug":"siem","domainSlug":"secops","name":"Security Information & Event Management","acronym":"SIEM","summary":"The security team's central log warehouse: collects events from everything in the environment, correlates them into alerts, and gives analysts one place to search when something looks wrong.","capabilities":[{"key":"log-ingestion","label":"Broad log ingestion","description":"Collects and normalizes logs from network, endpoint, cloud, and SaaS sources."},{"key":"correlation-rules","label":"Correlation & detection rules","description":"Turns raw events into alerts via built-in and custom detection logic."},{"key":"search","label":"Fast historical search","description":"Query months of data quickly during investigations."},{"key":"ueba","label":"Behavior analytics (UEBA)","description":"Baselines user and entity behavior to flag anomalies."},{"key":"dashboards","label":"Dashboards & reporting","description":"Compliance and operational reporting out of the box."},{"key":"detection-as-code","label":"Detection-as-code","description":"Manage detection rules in version control with CI."}],"relatedCategorySlugs":["soar","edr-xdr","threat-intelligence"],"learning":{"slug":"siem","title":"How a million boring logs become one urgent alert","hook":"Every system in a company writes a diary of what happened to it. This lesson shows how security teams merge those diaries and spot the sentence that reveals an attack in progress.","analogy":{"title":"The camera control room","body":"A shopping mall has hundreds of security cameras, but no one could watch them all. So every feed streams into one control room, where software flags the moment the same person tests a locked door on camera 12, slips into a stockroom on camera 40, and exits through the loading dock. Each clip alone is boring; together they tell a story."},"diagram":{"kind":"hub","caption":"Logs from every corner of the environment flow into one system that normalizes and correlates them into a short list of prioritized alerts.","inputs":[{"label":"Firewalls & network","sublabel":"Connections allowed and blocked"},{"label":"Laptops & servers","sublabel":"Logins, processes, file changes"},{"label":"Cloud & SaaS apps","sublabel":"Admin actions, sharing, API calls"},{"label":"Identity systems","sublabel":"Sign-ins, MFA prompts, password resets"}],"hub":{"label":"SIEM","sublabel":"Normalize, correlate, baseline"},"outputs":[{"label":"Prioritized alerts","sublabel":"Event chains worth a human's time"},{"label":"Searchable history","sublabel":"Months of data for investigations"},{"label":"Dashboards & reports","sublabel":"Posture and compliance evidence"}]},"keyTermSlugs":["log","detection-rule","ueba","soc","telemetry"],"sourceUrls":["https://www.cisco.com/site/us/en/learn/topics/security/what-is-siem.html","https://www.fortinet.com/resources/cyberglossary/what-is-siem","https://www.techtarget.com/searchsecurity/definition/security-information-and-event-management-SIEM"],"verifiedAt":"2026-08-04"}},{"slug":"soar","domainSlug":"secops","name":"Security Orchestration, Automation & Response","acronym":"SOAR","summary":"Automates the repetitive parts of responding to an alert — pulling context, opening a ticket, blocking an IP, notifying a user — so analysts spend less time on manual busywork and more time on the alerts that need human judgment.","capabilities":[{"key":"playbook-automation","label":"Playbook / workflow automation","description":"Runs automated multi-step response actions triggered by an alert."},{"key":"case-management","label":"Case management","description":"Tracks an incident from alert to closure with notes, evidence, and assignments."},{"key":"connector-library","label":"Integration & connector library","description":"Connects to SIEM, EDR, ticketing, and other tools to take action across the stack."},{"key":"alert-triage-enrichment","label":"Alert triage & enrichment","description":"Automatically gathers context on an alert before an analyst sees it."},{"key":"low-code-playbook-builder","label":"No-code / low-code playbook builder","description":"Lets analysts build automation without writing custom scripts."},{"key":"metrics-sla-reporting","label":"Metrics & SLA reporting","description":"Reports response times and automation impact against team SLAs."}],"relatedCategorySlugs":["siem","threat-intelligence","dfir"],"learning":{"slug":"soar","title":"How an alert gets answered while analysts sleep","hook":"Security teams drown in alerts that each need the same twenty minutes of routine checking. This lesson shows how playbooks do that work in seconds — and know when to wake a human.","analogy":{"title":"The 911 dispatch protocol","body":"When you call 911, the dispatcher doesn't improvise. They follow a script: confirm the location, classify the emergency, send the right responders — the same way every time, within a minute. Only the unusual calls get escalated to a supervisor. A SOAR playbook is that script for security alerts, executed by software."},"diagram":{"kind":"flow","caption":"Each incoming alert is automatically enriched with context, then a playbook either resolves it or hands an analyst a ready-made case.","nodes":[{"label":"Alert fires","sublabel":"From the SIEM, an endpoint, or a user report"},{"label":"Enrich","sublabel":"Pull user, device, and threat context"},{"label":"Playbook decides","sublabel":"Match against predefined response steps"}],"outcomes":{"pass":{"label":"Handled automatically","sublabel":"Block, contain, ticket, notify"},"block":{"label":"Escalated to analyst","sublabel":"Novel or high-stakes — needs judgment"}}},"keyTermSlugs":["siem","phishing","ioc","sandbox","mttd-mttr"],"sourceUrls":["https://www.microsoft.com/en-us/security/business/security-101/what-is-soar","https://www.paloaltonetworks.com/cyberpedia/what-is-soar","https://www.fortinet.com/resources/articles/automate-security-operations-with-soar"],"verifiedAt":"2026-08-04"}},{"slug":"threat-intelligence","domainSlug":"secops","name":"Threat Intelligence","acronym":"TI","summary":"Collects current information about threat groups, techniques, malicious infrastructure, and active campaigns so teams can tune detections and prioritize relevant threats.","capabilities":[{"key":"curated-ioc-feeds","label":"Curated IOC feeds","description":"Provides vetted lists of malicious IPs, domains, and file hashes."},{"key":"adversary-ttp-profiles","label":"Adversary & TTP profiles","description":"Documents known attacker groups and the techniques they typically use."},{"key":"dark-web-brand-monitoring","label":"Dark web & brand monitoring","description":"Watches for leaked credentials, data, or brand impersonation outside the organization."},{"key":"siem-soar-enrichment","label":"SIEM/SOAR enrichment integration","description":"Automatically feeds intelligence context into alerts and playbooks."},{"key":"vulnerability-exploit-intel","label":"Vulnerability & exploit intelligence","description":"Tracks which vulnerabilities are being actively exploited in the wild."},{"key":"analyst-research-portal","label":"Analyst research portal","description":"Gives analysts a searchable portal to investigate threats manually."}],"relatedCategorySlugs":["siem","soar","vulnerability-management"],"learning":{"slug":"threat-intelligence","title":"How defenders learn an attacker's next move","hook":"You can't defend against threats you've never heard of. This lesson explains how knowledge about attacker groups, tools, and infrastructure gets collected, vetted, and pushed into your defenses.","analogy":{"title":"The neighborhood watch bulletin","body":"When a burglary crew works a city, police brief the neighborhoods: what van the crew drives, how they case houses, which locks they pick. Residents don't have to catch the crew themselves — knowing what to watch for turns a hundred ordinary sightings into an early warning. Threat intelligence is that bulletin, written for networks."},"diagram":{"kind":"hub","caption":"Raw observations from many places are vetted and enriched into intelligence that tunes tools automatically and guides human decisions.","inputs":[{"label":"Malware analysis","sublabel":"What captured samples actually do"},{"label":"Honeypots & sensors","sublabel":"Attacks observed in the wild"},{"label":"Dark web monitoring","sublabel":"Leaked data and criminal chatter"},{"label":"Sharing communities","sublabel":"Indicators exchanged via STIX/TAXII"},{"label":"Incident reports","sublabel":"Lessons from investigated breaches"}],"hub":{"label":"Threat intel program","sublabel":"Vet, enrich, map to MITRE ATT&CK"},"outputs":[{"label":"IOC blocklists","sublabel":"Known-bad IPs, domains, file hashes"},{"label":"Adversary profiles","sublabel":"Who targets you and how they operate"},{"label":"Alert enrichment","sublabel":"Context piped into SIEM and SOAR"},{"label":"Patch priorities","sublabel":"Which flaws are exploited right now"}]},"keyTermSlugs":["ioc","ttp","mitre-attack","c2","stix-taxii"],"sourceUrls":["https://www.ibm.com/think/topics/threat-intelligence","https://www.cloudflare.com/learning/security/glossary/what-is-threat-intelligence/","https://www.cloudflare.com/learning/security/glossary/threat-intelligence-feed/"],"verifiedAt":"2026-08-04"}},{"slug":"vulnerability-management","domainSlug":"secops","name":"Vulnerability Management","acronym":"VM","summary":"Scans devices, servers, and applications for known vulnerabilities, ranks findings using severity and exploit context, and tracks remediation over time.","capabilities":[{"key":"asset-discovery-scanning","label":"Asset discovery & scanning","description":"Finds and scans devices, servers, and applications across the environment."},{"key":"risk-based-prioritization","label":"Risk-based prioritization","description":"Ranks vulnerabilities by real-world exploitability and business impact, not just severity score."},{"key":"remediation-tracking","label":"Remediation & patch tracking","description":"Tracks whether identified vulnerabilities actually get fixed over time."},{"key":"authenticated-scanning","label":"Authenticated & unauthenticated scanning","description":"Scans with or without credentials to see deeper into configured systems."},{"key":"compliance-benchmark-reporting","label":"Compliance & benchmark reporting","description":"Reports posture against standards like CIS benchmarks and PCI DSS."},{"key":"ticketing-cmdb-integration","label":"Ticketing & CMDB integration","description":"Syncs findings and asset data with IT service management systems."}],"relatedCategorySlugs":["asm-bas","sast","grc-compliance"],"learning":{"slug":"vulnerability-management","title":"Why you can't patch everything, and how to choose","hook":"A single scan can return tens of thousands of known flaws. This lesson explains the cycle teams use to find them, decide which handful actually matter, and prove they got fixed.","analogy":{"title":"The emergency room triage nurse","body":"An emergency room can't treat patients in arrival order — a triage nurse sends chest pain ahead of a sprained ankle, every time. Vulnerability management triages software flaws the same way: not \"how bad could this be in theory,\" but \"is anyone actually exploiting it, and does it sit on a machine that matters?\""},"diagram":{"kind":"cycle","caption":"Vulnerability management is a repeating loop, because new flaws are disclosed and new systems appear every single day.","steps":[{"label":"Discover assets","sublabel":"You can't scan what you don't know about"},{"label":"Scan for known flaws","sublabel":"Match software versions against CVEs"},{"label":"Prioritize by real risk","sublabel":"KEV, EPSS, and asset importance"},{"label":"Fix or mitigate","sublabel":"Patch, reconfigure, or shield"},{"label":"Verify & report","sublabel":"Rescan to confirm the fix landed"}]},"keyTermSlugs":["cve","cvss","epss","kev","ctem"],"sourceUrls":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog","https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities","https://www.tanium.com/blog/what-is-continuous-threat-exposure-management-ctem","https://www.vectra.ai/topics/vulnerability-management"],"verifiedAt":"2026-08-04"}},{"slug":"asm-bas","domainSlug":"secops","name":"Attack Surface Management & Breach/Attack Simulation","acronym":"ASM/BAS","summary":"Maps systems reachable from outside the organization and safely exercises attack techniques to measure whether existing controls detect or block them.","capabilities":[{"key":"external-attack-surface-discovery","label":"External attack surface discovery","description":"Continuously finds internet-facing assets, domains, and shadow IT before attackers do."},{"key":"exposure-prioritization","label":"Exposure prioritization","description":"Ranks discovered exposures using adversary and exploitability context."},{"key":"breach-attack-simulation","label":"Breach and attack simulation","description":"Safely simulates real attack techniques against live defenses to test control effectiveness."},{"key":"control-validation","label":"Security control validation","description":"Measures whether existing tools actually detect or block the simulated attacks."},{"key":"attack-path-mapping","label":"Attack path mapping","description":"Shows the chained steps an attacker could take from an exposure to real impact."},{"key":"continuous-testing","label":"Continuous testing","description":"Re-runs simulations on a schedule to catch drift and regressions over time."}],"relatedCategorySlugs":["vulnerability-management","dfir","threat-intelligence"],"learning":{"slug":"asm-bas","title":"Seeing your network the way an attacker does","hook":"Attackers don't start with your org chart — they start with whatever is visible from the internet. This lesson covers finding your exposed assets before attackers do, then safely testing whether your defenses would even notice an attack.","analogy":{"title":"The burglar you hired","body":"Imagine paying a friendly burglar to circle your house every week. First they list every window you forgot to latch — including the shed you forgot you owned. Then they rattle each one to see whether the alarm actually rings. Finding forgotten entry points is one half of this category; testing the alarm is the other."},"diagram":{"kind":"cycle","caption":"Discovery and simulation run as one continuous loop, because both the attack surface and the defenses change constantly.","steps":[{"label":"Map exposed assets","sublabel":"Domains, servers, cloud services, shadow IT"},{"label":"Prioritize exposures","sublabel":"What's reachable, exploitable, valuable"},{"label":"Simulate real attacks","sublabel":"Safely replay known attacker techniques"},{"label":"Score the defenses","sublabel":"Did controls block, detect, or miss it?"},{"label":"Fix gaps and rerun","sublabel":"Close holes, then retest for drift"}]},"keyTermSlugs":["attack-surface","easm","bas","ctem","pentest"],"sourceUrls":["https://www.paloaltonetworks.com/cyberpedia/easm-external-attack-surface-management","https://en.wikipedia.org/wiki/Breach_and_attack_simulation","https://pentera.io/glossary/breach-and-attack-simulation-bas/","https://www.cycognito.com/learn/attack-surface-management/"],"verifiedAt":"2026-08-04"}},{"slug":"dfir","domainSlug":"secops","name":"Digital Forensics & Incident Response","acronym":"DFIR","summary":"The specialized toolkit and expertise brought in once a breach is suspected or confirmed — reconstructing exactly what happened, how far it spread, and what evidence proves it, so the incident can be contained and explained.","capabilities":[{"key":"forensic-acquisition","label":"Endpoint & memory forensic acquisition","description":"Captures disk, memory, and system artifacts for detailed forensic analysis."},{"key":"timeline-reconstruction","label":"Timeline reconstruction","description":"Rebuilds the sequence of attacker actions across affected systems."},{"key":"malware-analysis","label":"Malware analysis","description":"Analyzes malicious files to understand their behavior and origin."},{"key":"ir-playbooks-retainer","label":"Incident response playbooks & retainer","description":"Provides pre-built response procedures and on-call expert support during a breach."},{"key":"chain-of-custody","label":"Evidence chain-of-custody","description":"Maintains legally defensible handling of evidence for potential litigation."},{"key":"root-cause-scope-analysis","label":"Root-cause & scope analysis","description":"Determines how an attacker got in and how far they reached."}],"relatedCategorySlugs":["edr-xdr","siem","soar","backup-recovery"],"learning":{"slug":"dfir","title":"What happens after a breach is confirmed","hook":"When a real intrusion is discovered, someone has to answer four questions fast: how did they get in, where did they go, what did they take, and are they still here. This lesson walks through that investigation.","analogy":{"title":"The crash investigators","body":"After an aviation incident, investigators don't guess — they recover the black box, reconstruct the timeline second by second, and publish what failed so it can't happen the same way twice. DFIR teams do the same with disk images, memory snapshots, and logs instead of flight recorders — while also putting out the fire."},"diagram":{"kind":"cycle","caption":"Incident response runs as a loop: lessons from each incident feed back into preparation for the next one.","steps":[{"label":"Prepare","sublabel":"Plans, playbooks, tooling, practice runs"},{"label":"Detect & analyze","sublabel":"Confirm it's real and scope the damage"},{"label":"Contain","sublabel":"Isolate systems, cut attacker access"},{"label":"Eradicate & recover","sublabel":"Remove footholds, restore clean systems"},{"label":"Learn & improve","sublabel":"Feed findings back into defenses"}]},"keyTermSlugs":["dfir","dwell-time","lateral-movement","tabletop-exercise","ransomware"],"sourceUrls":["https://csrc.nist.gov/Projects/incident-response/life-cycle-resources","https://www.techtarget.com/searchsecurity/definition/digital-forensics-and-incident-response-DFIR","https://www.paloaltonetworks.com/cyberpedia/digital-forensics-and-incident-response","https://linfordco.com/blog/nist-sp-800-61/"],"verifiedAt":"2026-08-04"}},{"slug":"backup-recovery","domainSlug":"resilience","name":"Backup & Cyber Recovery","acronym":"BCDR","summary":"Keeps protected copies of data and systems for recovery after ransomware, accidental deletion, or a destructive outage. Recovery testing verifies that those copies can be restored within the required time.","capabilities":[{"key":"immutable-backups","label":"Immutable backups","description":"Stores backup copies that can't be altered, encrypted, or deleted for a set retention period, so a clean recovery point survives even if attackers reach the backup system itself."},{"key":"air-gapped-vaulting","label":"Air-gapped vaulting","description":"Keeps an isolated recovery copy in a separate, network-segmented or offline vault that ransomware spreading through the production network can't reach."},{"key":"ransomware-anomaly-detection","label":"Ransomware anomaly detection","description":"Scans backups for signs of mass encryption or unusual change rates, flagging a ransomware attack and helping pinpoint the last clean recovery point."},{"key":"dr-orchestration","label":"DR orchestration & recovery testing","description":"Automates failover to standby infrastructure and regularly tests that a recovery actually works, instead of assuming the backups will restore when they're needed."},{"key":"workload-coverage","label":"Broad workload coverage","description":"Backs up many kinds of workloads — VMs, SaaS apps, Kubernetes, cloud services, and endpoints — from one platform rather than a separate tool per system."},{"key":"granular-restore","label":"Granular restore","description":"Recovers at the level actually needed — a single file, mailbox, VM, or database — and can bring workloads back quickly instead of only restoring everything at once."}],"relatedCategorySlugs":["dfir","edr-xdr","grc-compliance"],"learning":{"slug":"backup-recovery","title":"The copy of your data ransomware can't touch","hook":"Ransomware crews now hunt down backups first, because a company that can restore has no reason to pay. This lesson explains the tiers of copies built to survive even that.","analogy":{"title":"The vault in another town","body":"Think of your vital documents: you keep the originals at home, a photocopy in a desk drawer, and one more copy in a bank vault in another town — a vault with a time lock that nobody, not even the bank manager, can open early. A burglar can ransack the house and even force the manager's hand, but the time-locked copy stays untouchable."},"diagram":{"kind":"layers","caption":"Each backup tier survives a bigger disaster than the one above it, ending with copies even a compromised administrator can't destroy.","layers":[{"label":"Production data","sublabel":"The live systems attackers hit first"},{"label":"Local backup","sublabel":"Fast restores for everyday mistakes"},{"label":"Offsite copy","sublabel":"Survives fire, theft, or a site outage"},{"label":"Immutable / air-gapped copy","sublabel":"Can't be altered or deleted, even by admins"},{"label":"Tested restores","sublabel":"Proof the recovery actually works"}]},"keyTermSlugs":["immutable-backup","air-gap","3-2-1-backup-rule","rto-rpo","ransomware"],"sourceUrls":["https://www.cisa.gov/stopransomware/ransomware-guide","https://www.sentinelone.com/cybersecurity-101/cybersecurity/3-2-1-backup-strategy/","https://www.techtarget.com/searchSecurity/definition/double-extortion-ransomware"],"verifiedAt":"2026-08-04"}},{"slug":"grc-compliance","domainSlug":"grc","name":"GRC & Compliance Automation","acronym":"GRC","summary":"Maps security controls to frameworks such as SOC 2 and ISO 27001, collects evidence, tracks risks and exceptions, and produces records for auditors, customers, and regulators.","capabilities":[{"key":"control-framework-mapping","label":"Control & framework mapping","description":"Maps internal controls to frameworks like SOC 2, ISO 27001, and NIST."},{"key":"continuous-control-monitoring","label":"Continuous control monitoring","description":"Automatically checks that controls remain in place between formal audits."},{"key":"risk-register","label":"Risk register & assessments","description":"Tracks identified risks, owners, and treatment plans in one place."},{"key":"audit-evidence-collection","label":"Audit evidence collection","description":"Automatically gathers and organizes proof of control operation for auditors."},{"key":"policy-management","label":"Policy management","description":"Manages the lifecycle of security policies, from drafting to employee attestation."},{"key":"vendor-risk-tracking","label":"Vendor & third-party risk tracking","description":"Assesses and monitors the security posture of vendors and partners."}],"relatedCategorySlugs":["iga","security-awareness-training","vulnerability-management"],"learning":{"slug":"grc-compliance","title":"How a company proves it's actually secure","hook":"Customers, auditors, and regulators all ask the same question: show me evidence. This lesson explains how security promises get mapped to controls, monitored year-round, and proven without a last-minute panic.","analogy":{"title":"The restaurant health inspection","body":"A good restaurant doesn't just cook safely — it keeps fridge temperature logs, cleaning rotas, and supplier records so the health inspector can verify everything in an afternoon. GRC tooling is that logbook for security: the controls run all year, the evidence collects itself, and inspection day stops being a scramble."},"diagram":{"kind":"cycle","caption":"Compliance work runs as a continuous loop rather than a once-a-year scramble before the auditor arrives.","steps":[{"label":"Map controls","sublabel":"Match safeguards to SOC 2, ISO 27001, NIST"},{"label":"Monitor continuously","sublabel":"Automated checks catch drift the day it happens"},{"label":"Collect evidence","sublabel":"Configs, logs, and records gathered automatically"},{"label":"Track risks & fix gaps","sublabel":"Every risk gets an owner and a plan"},{"label":"Audit & attest","sublabel":"Hand auditors an organized, current file"}]},"keyTermSlugs":["grc","soc-2","iso-27001","nist-csf","risk-register"],"sourceUrls":["https://www.diligent.com/resources/guides/grc","https://compyl.com/grc-learning-center/","https://fedresources.com/how-continuous-monitoring-and-validation-actually-work-in-governance-risk-and-compliance-grc-tools/"],"verifiedAt":"2026-08-04"}},{"slug":"security-awareness-training","domainSlug":"grc","name":"Security Awareness Training","acronym":"SAT","summary":"Teaches employees to recognize phishing and other social-engineering attacks through simulated attacks and short training modules, and gives security teams a way to measure and reduce human risk across the organization.","capabilities":[{"key":"phishing-simulation","label":"Phishing simulation campaigns","description":"Sends realistic simulated phishing emails to measure and train employee response."},{"key":"training-content-library","label":"Training content library","description":"Provides short, ongoing microlearning modules on security topics."},{"key":"risk-scoring","label":"Risk scoring by user & department","description":"Identifies which employees or teams pose the highest human risk."},{"key":"completion-tracking","label":"Compliance & completion tracking","description":"Tracks who completed required training for audit and compliance purposes."},{"key":"culture-behavior-analytics","label":"Culture & behavior analytics","description":"Measures security culture trends across the organization over time."},{"key":"automated-remediation-assignment","label":"Automated remedial assignment","description":"Automatically assigns extra training to employees who fail a simulation."}],"relatedCategorySlugs":["email-security","grc-compliance","iam-sso"],"learning":{"slug":"security-awareness-training","title":"Why companies phish their own employees","hook":"The easiest way into most companies isn't a software flaw — it's a convincing email. This lesson explains how simulated attacks and short lessons turn employees from targets into sensors.","analogy":{"title":"The fire drill","body":"Buildings don't just install smoke alarms and hope for the best — they run fire drills, so when real smoke appears, people don't freeze; they already know the exits. A simulated phishing email is a fire drill for your inbox: a safe chance to practice spotting the trick before a real attacker sends one."},"diagram":{"kind":"cycle","caption":"Training runs as a repeating loop of simulation, teaching, and measurement rather than a one-time annual course.","steps":[{"label":"Simulate an attack","sublabel":"A realistic but harmless phishing email"},{"label":"Train in the moment","sublabel":"Clickers get a short lesson right away"},{"label":"Measure behavior","sublabel":"Click rates — and crucially, report rates"},{"label":"Adapt and repeat","sublabel":"Harder scenarios for higher-risk groups"}]},"keyTermSlugs":["phishing","spear-phishing","bec","smishing","vishing","passkey"],"sourceUrls":["https://csrc.nist.gov/projects/awareness-training-education","https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf","https://en.wikipedia.org/wiki/Internet_Security_Awareness_Training","https://hoxhunt.com/guide/security-awareness-training"],"verifiedAt":"2026-08-04"}},{"slug":"email-security","domainSlug":"grc","name":"Email Security","summary":"Filters phishing, malware, impersonation, and scam messages before they reach an employee, and provides tools to investigate or remove messages that arrive.","capabilities":[{"key":"phishing-malware-detection","label":"Phishing & malware detection","description":"Blocks malicious links, attachments, and known phishing patterns in inbound email."},{"key":"bec-detection","label":"Business email compromise detection","description":"Flags impersonation and social-engineering attempts that lack a malicious payload."},{"key":"sandboxing","label":"Link & attachment sandboxing","description":"Detonates suspicious links and files in an isolated environment before delivery."},{"key":"domain-authentication-enforcement","label":"DMARC/SPF/DKIM enforcement","description":"Enforces sender authentication standards to block domain spoofing."},{"key":"user-reported-phishing-workflow","label":"User-reported phishing workflow","description":"Lets employees report suspicious emails and routes them for rapid review."},{"key":"email-dlp","label":"Data loss prevention for email","description":"Blocks sensitive data from leaving the organization through outbound email."}],"relatedCategorySlugs":["security-awareness-training","dlp","threat-intelligence"],"learning":{"slug":"email-security","title":"How a scam email gets caught before you see it","hook":"Email is still where most attacks begin — often not with malware, but with a message that simply asks the right person to do the wrong thing. This lesson follows an email through the checks that decide whether it ever reaches an inbox.","analogy":{"title":"The mailroom that opens everything","body":"A careful corporate mailroom doesn't drop packages straight on desks. Staff compare the return address with where the parcel was actually posted, x-ray anything suspicious, and pull aside the letter that claims to be from the CEO but was mailed from a city she's never visited. Only what passes every check gets delivered upstairs."},"diagram":{"kind":"flow","caption":"Each message is authenticated, its links and attachments tested, and its intent analyzed before it can reach the inbox.","nodes":[{"label":"Message arrives","sublabel":"Inbound mail from the internet"},{"label":"Authenticate the sender","sublabel":"SPF, DKIM, and DMARC checks"},{"label":"Analyze content & intent","sublabel":"Links, attachments, impersonation cues"}],"outcomes":{"pass":{"label":"Delivered","sublabel":"Passes authentication and analysis"},"block":{"label":"Quarantined","sublabel":"Held for review — the user never sees it"}}},"keyTermSlugs":["phishing","spear-phishing","bec","dmarc-dkim-spf","sandbox"],"sourceUrls":["https://www.cloudflare.com/learning/email-security/business-email-compromise-bec/","https://www.microsoft.com/en-us/security/business/security-101/what-is-business-email-compromise-bec","https://www.proofpoint.com/us/threat-reference/business-email-compromise","https://dmarcian.com/yahoo-and-google-dmarc-required/"],"verifiedAt":"2026-08-04"}},{"slug":"ai-security-posture-governance","domainSlug":"ai-security","name":"AI Security Posture & Governance","acronym":"AI-SPM","summary":"Inventories AI models, applications, agents, data flows, and services; maps their ownership and risk; and helps teams govern AI use against policy and control frameworks.","capabilities":[{"key":"ai-asset-discovery","label":"AI asset discovery","description":"Finds models, AI services, applications, agents, and related infrastructure across development and production environments."},{"key":"ai-inventory-ownership","label":"Inventory & ownership","description":"Maintains an inventory of AI assets, their owners, lineage, purpose, and deployment status."},{"key":"ai-risk-posture","label":"AI risk posture","description":"Identifies risky configurations, exposed assets, unapproved services, and missing safeguards."},{"key":"ai-policy-governance","label":"Policy & governance","description":"Defines and evaluates policies for approved models, providers, data use, and AI application behavior."},{"key":"ai-framework-mapping","label":"Framework mapping","description":"Maps AI risks and controls to frameworks such as the NIST AI RMF and OWASP guidance."},{"key":"shadow-ai-monitoring","label":"Shadow AI monitoring","description":"Detects unsanctioned workforce use of AI applications and services."}],"relatedCategorySlugs":["grc-compliance","dspm","cnapp-cspm","ai-security-testing-model-assurance"],"learning":{"slug":"ai-security-posture-governance","title":"Finding and governing the AI you actually use","hook":"An organization cannot secure models, applications, agents, and AI services it does not know exist. This lesson shows how AI discovery becomes an owned inventory, a risk posture, and an enforceable governance program.","analogy":{"title":"The aircraft register","body":"An airline cannot maintain a safe fleet from expense reports alone. It needs a register of every aircraft, who operates it, where it flies, which parts it contains, and when it was last inspected. AI posture management builds the same operating picture for models, services, applications, data flows, and agents — including the unofficial ones employees adopted on their own."},"diagram":{"kind":"cycle","caption":"AI posture is maintained as a continuous loop because models, providers, prompts, data connections, and agent permissions change constantly.","steps":[{"label":"Discover","sublabel":"Models, apps, services, agents, shadow AI"},{"label":"Assign ownership","sublabel":"Purpose, team, data, provider, lifecycle"},{"label":"Assess risk","sublabel":"Exposure, access, data, controls, impact"},{"label":"Apply policy","sublabel":"Approve, restrict, remediate, or retire"},{"label":"Monitor change","sublabel":"Catch new assets and posture drift"}]},"keyTermSlugs":["ai-security","shadow-ai","agentic-ai"],"sourceUrls":["https://www.nist.gov/itl/ai-risk-management-framework","https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1","https://www.cisa.gov/news-events/alerts/2023/11/26/cisa-and-uk-ncsc-unveil-joint-guidelines-secure-ai-system-development"],"verifiedAt":"2026-08-12"}},{"slug":"ai-security-testing-model-assurance","domainSlug":"ai-security","name":"AI Security Testing & Model Assurance","acronym":"AI Red Teaming","summary":"Tests AI models and applications for prompt injection, jailbreaks, data leakage, unsafe behavior, and model supply-chain risks before and after deployment.","capabilities":[{"key":"ai-red-teaming","label":"AI red teaming","description":"Runs adversarial tests against models and applications to uncover exploitable or unsafe behavior."},{"key":"prompt-injection-testing","label":"Prompt-injection testing","description":"Tests whether untrusted instructions can override intended system behavior or controls."},{"key":"jailbreak-safety-testing","label":"Jailbreak & safety testing","description":"Evaluates resistance to policy bypasses, harmful outputs, and other unsafe behaviors."},{"key":"model-artifact-scanning","label":"Model artifact scanning","description":"Inspects model files and serialized artifacts for malicious code, tampering, and unsafe components."},{"key":"ai-supply-chain-assurance","label":"AI supply-chain assurance","description":"Tracks model provenance, dependencies, integrity, and risk before deployment."},{"key":"continuous-ai-evaluation","label":"Continuous AI evaluation","description":"Repeats security tests as models, prompts, tools, data, and application behavior change."}],"relatedCategorySlugs":["sast","dast","sca-supply-chain","asm-bas","ai-application-agent-security"],"learning":{"slug":"ai-security-testing-model-assurance","title":"How defenders break an AI system before attackers do","hook":"AI behavior changes with prompts, models, retrieved content, tools, and updates, so a single vulnerability scan cannot establish safety. This lesson explains adversarial testing and model supply-chain assurance.","analogy":{"title":"Crash tests and parts inspection","body":"A car maker checks both the parts arriving at the factory and the finished car in a crash test. AI assurance works the same way: scan model artifacts and dependencies before they enter the pipeline, then challenge the assembled application with hostile prompts and realistic attack paths. A clean part does not prove a safe car, and one successful crash test does not cover every future model update."},"diagram":{"kind":"cycle","caption":"Assurance repeats across the lifecycle: inspect components, test assembled behavior, fix failures, and rerun whenever the system changes.","steps":[{"label":"Inspect artifacts","sublabel":"Models, code, lineage, integrity, dependencies"},{"label":"Define threats","sublabel":"Prompt injection, leakage, theft, abuse"},{"label":"Run attacks","sublabel":"Automated probes plus expert red teaming"},{"label":"Score failures","sublabel":"Reproducible evidence, not a safety claim"},{"label":"Fix and retest","sublabel":"Regression tests follow every material change"}]},"keyTermSlugs":["ai-red-teaming","prompt-injection","jailbreak","model-poisoning","model-extraction"],"sourceUrls":["https://csrc.nist.gov/pubs/ai/100/2/e2025/final","https://atlas.mitre.org/","https://owasp.org/www-project-top-10-for-large-language-model-applications/"],"verifiedAt":"2026-08-12"}},{"slug":"ai-application-agent-security","domainSlug":"ai-security","name":"AI Application & Agent Security","acronym":"AI Runtime","summary":"Protects AI applications and agents at runtime by inspecting prompts, responses, retrieved content, tool calls, and data flows, then enforcing policy before unsafe actions complete.","capabilities":[{"key":"prompt-response-inspection","label":"Prompt & response inspection","description":"Inspects model inputs and outputs for attacks, sensitive data, malware, and policy violations."},{"key":"runtime-ai-firewall","label":"Runtime AI firewall","description":"Allows, blocks, redacts, or transforms AI traffic inline according to security policy."},{"key":"agent-tool-control","label":"Agent & tool control","description":"Constrains which tools, APIs, data sources, and actions an AI agent may use."},{"key":"retrieval-content-protection","label":"Retrieval content protection","description":"Checks retrieved documents and external content for poisoning, hidden instructions, and malicious payloads."},{"key":"ai-data-loss-prevention","label":"AI data-loss prevention","description":"Detects and prevents sensitive information from entering or leaving AI systems."},{"key":"ai-runtime-monitoring","label":"AI runtime monitoring","description":"Records AI interactions and behavior so teams can detect attacks, investigate incidents, and tune controls."}],"relatedCategorySlugs":["waf-api-security","dlp","pam","siem","ai-security-testing-model-assurance"],"learning":{"slug":"ai-application-agent-security","title":"Putting guardrails around AI applications and agents","hook":"An AI application can read untrusted content, expose sensitive data, and call powerful tools. This lesson follows one interaction through the controls that inspect context, constrain actions, and record what happened.","analogy":{"title":"A supervised contractor","body":"Giving an AI agent tools is like hiring a contractor and handing over keys, a company card, and access to internal files. A responsible supervisor checks each request, limits which rooms and purchases are allowed, watches for instructions planted by strangers, and keeps an audit trail. The contractor may be capable and helpful, but capability is exactly why boundaries matter."},"diagram":{"kind":"flow","caption":"A runtime control evaluates the request, retrieved context, model response, and proposed tool action before data or authority crosses a trust boundary.","nodes":[{"label":"Request arrives","sublabel":"User input and identity context"},{"label":"Inspect context","sublabel":"Prompt, retrieved content, sensitive data"},{"label":"Constrain action","sublabel":"Model output, tool call, permissions, policy"}],"outcomes":{"pass":{"label":"Allow & record","sublabel":"Policy-compliant interaction"},"block":{"label":"Block or redact","sublabel":"Attack, unsafe action, or data risk"}}},"keyTermSlugs":["agentic-ai","prompt-injection","ai-security","shadow-ai"],"sourceUrls":["https://owasp.org/www-project-top-10-for-large-language-model-applications/","https://atlas.mitre.org/","https://www.nist.gov/artificial-intelligence/ai-research-security-and-resilience"],"verifiedAt":"2026-08-12"}}]}