{"name":"Cyber Tool Stack cybersecurity glossary","description":"Plain-language cybersecurity definitions with stable slugs and related concepts.","lastModified":"2026-08-12","recordCount":134,"records":[{"slug":"edr","term":"EDR","acronymFor":"Endpoint Detection and Response","definition":"Software that continuously records what happens on endpoints (processes, files, network connections) and detects, investigates, and responds to malicious behavior.","relatedSlugs":["xdr","endpoint","agent","epp"]},{"slug":"xdr","term":"XDR","acronymFor":"Extended Detection and Response","definition":"Extends endpoint detection and response by correlating telemetry from identity, email, and cloud systems alongside endpoint activity, so a single attack spanning multiple systems appears as one connected incident instead of scattered alerts.","relatedSlugs":["edr","siem","telemetry"]},{"slug":"epp","term":"EPP","acronymFor":"Endpoint Protection Platform","definition":"The baseline security agent installed on laptops and servers that blocks known malware, enforces device and application control policy, and reports fleet-wide compliance from one console.","relatedSlugs":["edr","endpoint"]},{"slug":"mdm","term":"MDM","acronymFor":"Mobile Device Management","definition":"A system for enrolling, configuring, and remotely locking or wiping phones and tablets used for work, without requiring physical access to the device.","relatedSlugs":["uem","endpoint"]},{"slug":"uem","term":"UEM","acronymFor":"Unified Endpoint Management","definition":"Device management that covers laptops and desktops alongside phones and tablets from a single console, rather than running separate tools per device type.","relatedSlugs":["mdm","endpoint"]},{"slug":"siem","term":"SIEM","acronymFor":"Security Information and Event Management","definition":"A central system that collects logs from across an environment, correlates them into alerts using detection rules and behavioral baselining, and lets analysts search historical activity during an investigation.","relatedSlugs":["soc","log","detection-rule","ueba"]},{"slug":"iam","term":"IAM","acronymFor":"Identity and Access Management","definition":"The system that manages who employees are, what they're allowed to access, and how that access is granted and revoked over their time at a company.","relatedSlugs":["sso","iga","idp"]},{"slug":"sso","term":"SSO","acronymFor":"Single Sign-On","definition":"A login flow that lets a user authenticate once and gain access to many connected applications, instead of maintaining a separate username and password for each one.","relatedSlugs":["iam","idp"]},{"slug":"mfa","term":"MFA","acronymFor":"Multi-Factor Authentication","definition":"A login flow that requires a second proof of identity beyond a password, such as a push approval, one-time code, or biometric check, so a stolen password alone isn't enough to log in.","relatedSlugs":["passwordless","passkey"]},{"slug":"pam","term":"PAM","acronymFor":"Privileged Access Management","definition":"Software that vaults, rotates, and time-limits the credentials for admin, database, and service accounts capable of causing outsized damage, and records what's done with them.","relatedSlugs":["least-privilege","privileged-account","iam"]},{"slug":"iga","term":"IGA","acronymFor":"Identity Governance and Administration","definition":"The discipline of running periodic access reviews, modeling entitlements as roles, and producing audit evidence that an organization's access actually matches who should have it.","relatedSlugs":["iam","least-privilege"]},{"slug":"soc","term":"SOC","acronymFor":"Security Operations Center","definition":"The team (in-house or vendor-run) responsible for monitoring security alerts around the clock and responding when something looks like a real incident.","relatedSlugs":["siem","mdr","threat-hunting"]},{"slug":"mdr","term":"MDR","acronymFor":"Managed Detection and Response","definition":"A subscription service where a vendor's own analysts monitor an organization's security alerts and respond to routine detections, instead of the customer's team doing it alone.","relatedSlugs":["edr","soc"]},{"slug":"saas","term":"SaaS","acronymFor":"Software as a Service","definition":"Software that's hosted and run by the vendor and accessed over the internet, rather than installed and maintained on the customer's own servers.","relatedSlugs":[]},{"slug":"agent","term":"Agent","definition":"A small piece of software installed on a device that collects activity data and can take local action, such as blocking a process or isolating the machine from the network.","relatedSlugs":["edr","telemetry","endpoint"]},{"slug":"telemetry","term":"Telemetry","definition":"The stream of activity data — process starts, file changes, network connections — that an agent continuously records and sends to a central system for analysis.","relatedSlugs":["agent","siem","ueba"]},{"slug":"zero-trust","term":"Zero Trust","definition":"A security approach that verifies every request based on identity, device, and context, instead of assuming anything is safe just because it's already inside the corporate network.","relatedSlugs":["iam","least-privilege"]},{"slug":"phishing","term":"Phishing","definition":"A social-engineering attack that tricks someone into clicking a malicious link, entering credentials on a fake page, or running an attached file.","relatedSlugs":["mfa","ransomware"]},{"slug":"ransomware","term":"Ransomware","definition":"Malware that encrypts a victim's files and demands payment for the decryption key, often spreading to as many systems as possible before it's discovered.","relatedSlugs":["phishing","edr"]},{"slug":"threat-hunting","term":"Threat Hunting","definition":"The practice of proactively searching historical activity data for signs of a compromise that never triggered an automatic alert.","relatedSlugs":["edr","siem","soc"]},{"slug":"ueba","term":"UEBA","acronymFor":"User and Entity Behavior Analytics","definition":"Analytics that baseline what's normal for a given user or system and flag deviations from that baseline, catching suspicious activity even without a matching rule.","relatedSlugs":["siem","telemetry"]},{"slug":"idp","term":"IdP","acronymFor":"Identity Provider","definition":"The system that actually authenticates a user's identity and issues the token other applications trust, underpinning single sign-on.","relatedSlugs":["sso","iam","scim"]},{"slug":"scim","term":"SCIM","acronymFor":"System for Cross-domain Identity Management","definition":"A standard protocol for automatically creating, updating, and deactivating user accounts across connected applications as an identity system's records change.","relatedSlugs":["idp","iga"]},{"slug":"passwordless","term":"Passwordless","definition":"Authentication that replaces the password entirely, relying instead on a device, security key, or biometric as the primary credential.","relatedSlugs":["passkey","mfa"]},{"slug":"passkey","term":"Passkey","definition":"A phishing-resistant, passwordless credential stored on a device that uses cryptography to prove identity to a specific website or app, without ever transmitting a shared secret that could be stolen.","relatedSlugs":["passwordless","mfa"]},{"slug":"least-privilege","term":"Least Privilege","definition":"The security principle of granting a person or system only the minimum access needed to do a specific task, rather than broad standing permissions.","relatedSlugs":["privileged-account","pam"]},{"slug":"privileged-account","term":"Privileged Account","definition":"A login — administrator, database, or service account — capable of far more damage than an ordinary user account if it's stolen or misused.","relatedSlugs":["pam","least-privilege"]},{"slug":"detection-rule","term":"Detection Rule","definition":"Logic that turns raw log or telemetry events into a security alert when a specific suspicious pattern is matched.","relatedSlugs":["siem","log"]},{"slug":"log","term":"Log","definition":"A timestamped record of an event generated by a system, application, or device, used for troubleshooting and security investigation.","relatedSlugs":["siem","detection-rule"]},{"slug":"endpoint","term":"Endpoint","definition":"Any laptop, server, or mobile device that runs software and connects to a network — the place where most attacks ultimately execute.","relatedSlugs":["edr","epp","agent"]},{"slug":"dfir","term":"DFIR","acronymFor":"Digital Forensics and Incident Response","definition":"The specialized work of investigating a suspected or confirmed security breach: reconstructing what happened, how far it spread, and preserving evidence that will hold up later.","relatedSlugs":["edr","soc","mdr"]},{"slug":"cve","term":"CVE","acronymFor":"Common Vulnerabilities and Exposures","definition":"A public catalog that assigns a unique identifier to a specific, publicly known software or hardware vulnerability, so vendors, researchers, and tools can all refer to the same flaw unambiguously.","relatedSlugs":["cvss","kev","cwe"]},{"slug":"cvss","term":"CVSS","acronymFor":"Common Vulnerability Scoring System","definition":"An industry-standard formula for scoring how severe a vulnerability is, producing a 0-10 number from factors like how easily it can be exploited and what an attacker gains. The current major version, CVSS 4.0, added metrics for real-world threat activity and automatability that earlier versions lacked.","relatedSlugs":["cve","epss"]},{"slug":"epss","term":"EPSS","acronymFor":"Exploit Prediction Scoring System","definition":"A data-driven score estimating the probability that a specific vulnerability will actually be exploited in the wild within the next 30 days, meant to be used alongside CVSS severity rather than in place of it when deciding what to patch first.","relatedSlugs":["cvss","kev"]},{"slug":"kev","term":"KEV","acronymFor":"Known Exploited Vulnerabilities","definition":"A catalog, maintained by the U.S. Cybersecurity and Infrastructure Security Agency, of vulnerabilities confirmed to be actively exploited by attackers — a fast, evidence-based way to prioritize patching over relying on severity scores alone.","relatedSlugs":["cve","cvss","epss"]},{"slug":"mitre-attack","term":"MITRE ATT&CK","acronymFor":"Adversarial Tactics, Techniques, and Common Knowledge","definition":"A free, continuously updated knowledge base, maintained by the MITRE Corporation, that catalogs real-world attacker behavior as a matrix of tactics (the attacker's goal, like lateral movement) and techniques (how it's done), giving defenders a shared vocabulary for describing and detecting threats.","relatedSlugs":["ttp","ioc","threat-hunting","purple-team"]},{"slug":"ttp","term":"TTP","acronymFor":"Tactics, Techniques, and Procedures","definition":"The way security teams describe attacker behavior at three levels of detail — the high-level goal (tactic), the general method (technique), and the specific implementation (procedure) — most commonly organized using the MITRE ATT&CK framework.","relatedSlugs":["mitre-attack","ioc","ioa"]},{"slug":"ioc","term":"IOC","acronymFor":"Indicator of Compromise","definition":"Forensic evidence that a system has already been breached — a malicious file hash, a known-bad IP address, a suspicious registry key — used to detect or confirm past or ongoing compromise.","relatedSlugs":["ioa","c2","yara"]},{"slug":"ioa","term":"IOA","acronymFor":"Indicator of Attack","definition":"A signal that describes an attacker's intent and behavior in progress — such as a process trying to dump credentials — rather than a static artifact left behind, letting defenses catch an attack while it's still unfolding instead of only after the fact.","relatedSlugs":["ioc","mitre-attack"]},{"slug":"yara","term":"YARA","definition":"A rule-based pattern-matching language and tool used to identify and classify malware by describing textual or binary patterns found in a file, widely used by malware researchers to write and share detection signatures.","relatedSlugs":["ioc","sandbox"]},{"slug":"stix-taxii","term":"STIX/TAXII","acronymFor":"Structured Threat Information eXpression / Trusted Automated eXchange of Indicator Information","definition":"A pair of open standards for describing threat intelligence in a structured, machine-readable format (STIX) and automatically transporting it between sharing partners (TAXII), letting organizations exchange indicators and context without manually reformatting feeds.","relatedSlugs":["ioc","mitre-attack"]},{"slug":"sandbox","term":"Sandbox","definition":"An isolated environment where a suspicious file or link can be opened and observed safely, revealing what it actually does — dropping malware, calling out to a remote server — without risking the real network.","relatedSlugs":["yara","c2"]},{"slug":"c2","term":"C2","acronymFor":"Command and Control","definition":"The infrastructure and channel an attacker uses to remotely control malware already running on a compromised system — issuing commands, exfiltrating data, or pulling down additional tools.","relatedSlugs":["sandbox","lateral-movement","botnet"]},{"slug":"lateral-movement","term":"Lateral Movement","definition":"The stage of an attack where, after gaining an initial foothold, an intruder moves from system to system inside a network to reach more valuable targets, often using stolen credentials rather than new exploits.","relatedSlugs":["c2","privileged-account","kill-chain"]},{"slug":"zero-day","term":"Zero-Day","definition":"A vulnerability that's exploited by attackers before the vendor knows about it or has released a fix, leaving defenders with zero days of advance warning to patch.","relatedSlugs":["cve","kev"]},{"slug":"raas","term":"RaaS","acronymFor":"Ransomware as a Service","definition":"A criminal business model where ransomware developers lease their malware and infrastructure to affiliates who carry out the actual attacks and split the ransom, lowering the technical bar for launching a ransomware attack.","relatedSlugs":["ransomware"]},{"slug":"spear-phishing","term":"Spear Phishing","definition":"A phishing attack tailored to a specific person or organization using researched details — a colleague's name, a real project, a familiar vendor — to appear far more convincing than a generic mass phishing email.","relatedSlugs":["phishing","bec"]},{"slug":"bec","term":"BEC","acronymFor":"Business Email Compromise","definition":"A scam where an attacker impersonates an executive, vendor, or trusted contact — often via a compromised or look-alike account — to trick an employee into wiring money or sharing sensitive data, typically without any malware or malicious link involved.","relatedSlugs":["spear-phishing","phishing"]},{"slug":"smishing","term":"Smishing","definition":"Phishing carried out over SMS text message, typically impersonating a delivery service, bank, or IT department to get a recipient to click a malicious link or share a code on their phone.","relatedSlugs":["phishing","vishing"]},{"slug":"vishing","term":"Vishing","definition":"Phishing carried out over a phone call, often impersonating IT support, a bank, or an executive to pressure the victim into revealing credentials, approving an MFA prompt, or transferring money.","relatedSlugs":["phishing","smishing","mfa-fatigue"]},{"slug":"dmarc-dkim-spf","term":"DMARC, DKIM & SPF","definition":"Three DNS-based email authentication standards that work together to stop domain spoofing: SPF lists which mail servers may send for a domain, DKIM cryptographically signs outgoing messages, and DMARC tells receiving mail servers what to do when a message fails those checks and reports the results back to the domain owner.","relatedSlugs":["bec","phishing"]},{"slug":"mfa-fatigue","term":"MFA Fatigue","definition":"An attack where someone who already has a victim's password sends a flood of push-based MFA approval requests, hoping the victim eventually taps 'approve' just to make the notifications stop — also called MFA bombing or push bombing.","relatedSlugs":["mfa","vishing"]},{"slug":"fido2-webauthn","term":"FIDO2 / WebAuthn","definition":"The open standards underlying passkeys and hardware security keys: WebAuthn is the browser API a website uses to request a cryptographic credential, and FIDO2 is the broader standard, including the protocol between the browser and an authenticator, that makes the credential resistant to phishing.","relatedSlugs":["passkey","mfa"]},{"slug":"saml","term":"SAML","acronymFor":"Security Assertion Markup Language","definition":"An older, XML-based standard for passing authentication and authorization data between an identity provider and an application, still widely used for enterprise single sign-on alongside the newer OIDC standard.","relatedSlugs":["sso","idp","oidc"]},{"slug":"oidc","term":"OIDC","acronymFor":"OpenID Connect","definition":"A modern, JSON/OAuth-based identity standard for single sign-on, favored by newer applications and mobile apps over SAML for being simpler to implement over standard web protocols.","relatedSlugs":["sso","idp","saml"]},{"slug":"jit-access","term":"JIT Access","acronymFor":"Just-in-Time Access","definition":"Granting elevated or privileged access only for a limited time window tied to a specific task, then automatically revoking it, instead of leaving standing permissions active around the clock.","relatedSlugs":["least-privilege","privileged-account"]},{"slug":"microsegmentation","term":"Microsegmentation","definition":"Dividing a network into small, isolated zones — down to the level of individual workloads — with tightly controlled traffic rules between them, so a compromise in one segment can't freely spread laterally to the rest of the environment.","relatedSlugs":["lateral-movement","zero-trust"]},{"slug":"honeypot","term":"Honeypot","definition":"A decoy system, account, or file deliberately left exposed to attract attackers, giving defenders early warning of an intrusion and insight into attacker behavior without risking real assets.","relatedSlugs":["threat-hunting","ioc"]},{"slug":"purple-team","term":"Purple Team","definition":"A collaborative security exercise where offensive (red team) and defensive (blue team) staff work together in real time, comparing what attacks were attempted against what defenses actually caught, to close detection gaps faster than either working alone.","relatedSlugs":["red-team","blue-team"]},{"slug":"red-team","term":"Red Team","definition":"A group that simulates real-world adversary tactics against an organization's people, processes, and technology to test whether defenses actually hold up, typically operating without the defenders' knowledge until after the exercise.","relatedSlugs":["purple-team","pentest"]},{"slug":"blue-team","term":"Blue Team","definition":"The defensive side of a security organization — the analysts and engineers who monitor, detect, and respond to attacks, including those simulated by a red team during an exercise.","relatedSlugs":["purple-team","soc"]},{"slug":"pentest","term":"Pentest","acronymFor":"Penetration Test","definition":"An authorized, time-boxed engagement where a tester actively attempts to exploit vulnerabilities in a system or network, going beyond a vulnerability scan's list of weaknesses to prove which ones are actually exploitable.","relatedSlugs":["red-team","bas"]},{"slug":"mssp","term":"MSSP","acronymFor":"Managed Security Service Provider","definition":"A vendor that operates security tools and processes — like a SIEM or firewall — on an ongoing basis for a customer, distinct from an MDR provider's narrower focus on 24/7 detection and response for a specific set of telemetry.","relatedSlugs":["mdr","soc"]},{"slug":"ndr","term":"NDR","acronymFor":"Network Detection and Response","definition":"Detection and response built around monitoring network traffic rather than endpoint or log data, catching attacker behavior like lateral movement and command-and-control that never touches a monitored endpoint.","relatedSlugs":["edr","xdr","c2"]},{"slug":"itdr","term":"ITDR","acronymFor":"Identity Threat Detection and Response","definition":"Detection and response focused specifically on identity systems — flagging stolen credential use, suspicious privilege escalation, and misconfigured trust relationships in an organization's identity directories.","relatedSlugs":["edr","xdr","iam"]},{"slug":"soar","term":"SOAR","acronymFor":"Security Orchestration, Automation and Response","definition":"Software that automates the repetitive steps of responding to a security alert — pulling context from other tools, opening a case, taking containment action — via predefined playbooks, freeing analysts to focus on judgment calls a machine can't make.","relatedSlugs":["siem","soc"]},{"slug":"ctem","term":"CTEM","acronymFor":"Continuous Threat Exposure Management","definition":"A program model for continuously scoping, discovering, prioritizing, validating, and mobilizing action against an organization's exposures, treating exposure management as an ongoing cycle rather than a periodic vulnerability scan.","relatedSlugs":["attack-surface","bas"]},{"slug":"cnapp","term":"CNAPP","acronymFor":"Cloud-Native Application Protection Platform","definition":"A category of tools that consolidates cloud posture management, workload protection, and identity risk into one platform, aiming to replace a pile of separate point tools with correlated, prioritized findings.","relatedSlugs":["cspm","cwpp","ciem"]},{"slug":"cspm","term":"CSPM","acronymFor":"Cloud Security Posture Management","definition":"Continuously checks cloud account configuration against best-practice benchmarks — an exposed storage bucket, an overly permissive security group — and flags drift before it becomes a breach.","relatedSlugs":["cnapp","kspm"]},{"slug":"cwpp","term":"CWPP","acronymFor":"Cloud Workload Protection Platform","definition":"Security focused on protecting the actual compute workloads running in the cloud — virtual machines, containers, serverless functions — through vulnerability scanning and runtime threat detection, complementing CSPM's focus on account-level configuration.","relatedSlugs":["cnapp","cspm"]},{"slug":"ciem","term":"CIEM","acronymFor":"Cloud Infrastructure Entitlement Management","definition":"Analyzes who and what can actually do inside cloud environments, surfacing excessive or unused permissions across human and machine identities that a role's name alone wouldn't reveal.","relatedSlugs":["cnapp","least-privilege"]},{"slug":"kspm","term":"KSPM","acronymFor":"Kubernetes Security Posture Management","definition":"Posture management scoped specifically to Kubernetes clusters — checking RBAC rules, pod security settings, and network policies against hardening benchmarks like the CIS Kubernetes Benchmark.","relatedSlugs":["cspm","cnapp"]},{"slug":"iac","term":"IaC","acronymFor":"Infrastructure as Code","definition":"Defining and provisioning infrastructure — servers, networks, cloud resources — through version-controlled configuration files like Terraform or CloudFormation instead of manual setup, which also means a misconfiguration can be scanned and caught before anything is ever deployed.","relatedSlugs":["cspm","sbom"]},{"slug":"sbom","term":"SBOM","acronymFor":"Software Bill of Materials","definition":"A formal, machine-readable inventory of every open-source and third-party component that makes up a piece of software, so an organization can quickly tell whether a newly disclosed vulnerability affects anything it runs.","relatedSlugs":["vex","supply-chain-attack","cve"]},{"slug":"vex","term":"VEX","acronymFor":"Vulnerability Exploitability eXchange","definition":"A companion standard to SBOM that states whether a known vulnerability in a listed component is actually exploitable in the way the software uses it, cutting down the noise of vulnerabilities that technically exist but can't be triggered.","relatedSlugs":["sbom","cve"]},{"slug":"cwe","term":"CWE","acronymFor":"Common Weakness Enumeration","definition":"A catalog of general categories of security weaknesses in software design or code — like SQL injection or improper input validation — as distinct from CVE, which tracks specific, individual instances of a vulnerability in a specific product.","relatedSlugs":["cve","owasp-top-10"]},{"slug":"owasp-top-10","term":"OWASP Top 10","definition":"A regularly updated, community-researched ranking of the most critical web application security risks, published by the OWASP Foundation and widely used as a baseline checklist for secure development. The current edition, OWASP Top 10:2025, was the first major update since 2021.","relatedSlugs":["cwe","waf"]},{"slug":"supply-chain-attack","term":"Supply Chain Attack","definition":"An attack that compromises a trusted upstream component — a software dependency, a build pipeline, a vendor's update mechanism — so the malicious code rides along into every downstream organization that uses it.","relatedSlugs":["typosquatting","sbom"]},{"slug":"typosquatting","term":"Typosquatting","definition":"Publishing a malicious package or domain with a name deliberately similar to a popular one — a common misspelling or swapped character — hoping a developer or user installs or visits the fake by mistake.","relatedSlugs":["supply-chain-attack"]},{"slug":"secrets-sprawl","term":"Secrets Sprawl","definition":"The accumulation of API keys, passwords, and certificates scattered across source code, config files, chat messages, and CI/CD systems instead of a managed vault, each one a potential credential an attacker could find and reuse.","relatedSlugs":["hsm","tokenization"]},{"slug":"hsm","term":"HSM","acronymFor":"Hardware Security Module","definition":"A dedicated, tamper-resistant hardware device that generates, stores, and uses cryptographic keys, so the keys themselves never have to leave secure hardware even when software using them is compromised.","relatedSlugs":["envelope-encryption","byok-hyok"]},{"slug":"envelope-encryption","term":"Envelope Encryption","definition":"A key-management pattern where data is encrypted with a fast, disposable data key, and that data key is itself encrypted with a more tightly controlled master key, so rotating the master key doesn't require re-encrypting all the underlying data.","relatedSlugs":["hsm"]},{"slug":"byok-hyok","term":"BYOK / HYOK","acronymFor":"Bring Your Own Key / Hold Your Own Key","definition":"Two models for who controls the encryption keys protecting data in a cloud service: Bring Your Own Key lets a customer supply keys the provider still has some access to, while Hold Your Own Key keeps keys entirely outside the provider's infrastructure.","relatedSlugs":["hsm","envelope-encryption"]},{"slug":"tokenization","term":"Tokenization","definition":"Replacing a piece of sensitive data, like a credit card number, with a nonsensitive placeholder token that has no exploitable value on its own, while the real value is kept in a separate, tightly controlled vault.","relatedSlugs":["data-classification"]},{"slug":"data-classification","term":"Data Classification","definition":"Labeling data by sensitivity — public, internal, confidential, restricted — so that access controls, encryption, and handling rules can be applied automatically based on what a piece of data actually is.","relatedSlugs":["dspm","tokenization"]},{"slug":"dspm","term":"DSPM","acronymFor":"Data Security Posture Management","definition":"Continuously discovers where sensitive data actually lives across cloud and SaaS environments and who can reach it, catching forgotten copies and risky exposure that a data inventory built once, by hand, would miss.","relatedSlugs":["data-classification","cspm"]},{"slug":"pki","term":"PKI","acronymFor":"Public Key Infrastructure","definition":"The combined system of certificate authorities, enrollment processes, and policies that issues, distributes, renews, and revokes digital certificates, binding public keys to verified identities so machines and people can trust one another. It's the plumbing underneath TLS, code signing, and most machine-to-machine authentication.","relatedSlugs":["certificate-authority","machine-identity","hsm"]},{"slug":"certificate-authority","term":"Certificate Authority","definition":"A trusted organization or system that issues digital certificates, vouching that a given public key really belongs to the named website, service, or device. Public CAs like Let's Encrypt or DigiCert are trusted by browsers and operating systems out of the box; private CAs issue certificates trusted only inside a single organization.","relatedSlugs":["pki","acme","machine-identity"]},{"slug":"acme","term":"ACME","acronymFor":"Automatic Certificate Management Environment","definition":"An open protocol (RFC 8555) that automates proving domain control and then requesting, issuing, and renewing TLS certificates between a client and a certificate authority — the mechanism behind Let's Encrypt that replaced manual certificate paperwork with an API call a server can run entirely on its own.","relatedSlugs":["certificate-authority","pki"]},{"slug":"machine-identity","term":"Machine Identity","definition":"The credentials — certificates, keys, and tokens — that let non-human actors like servers, services, containers, and API clients prove who they are to each other, as opposed to the usernames and passwords that identify people. Machine identities now vastly outnumber human ones, and each is another certificate that can expire or be forged if it isn't managed.","relatedSlugs":["pki","certificate-authority","privileged-account"]},{"slug":"air-gap","term":"Air Gap","definition":"Keeping a system or backup copy physically or network-isolated from any connected system, so it can't be reached or encrypted by ransomware or other malware spreading through the network.","relatedSlugs":["immutable-backup","ransomware","3-2-1-backup-rule"]},{"slug":"immutable-backup","term":"Immutable Backup","definition":"A backup copy stored so it cannot be modified, encrypted, or deleted for a set retention period — even by an administrator account — guaranteeing a clean recovery point survives even if ransomware compromises the backup system itself.","relatedSlugs":["air-gap","rto-rpo","3-2-1-backup-rule"]},{"slug":"3-2-1-backup-rule","term":"3-2-1 Backup Rule","definition":"A backup best practice: keep at least three copies of your data, on two different types of media, with one copy stored offsite. The modern 3-2-1-1-0 variant adds one offline or immutable copy and zero recovery errors — meaning restores are regularly tested and confirmed to work.","relatedSlugs":["immutable-backup","air-gap","rto-rpo","ransomware"]},{"slug":"rto-rpo","term":"RTO / RPO","acronymFor":"Recovery Time Objective / Recovery Point Objective","definition":"Two targets that define how much disaster an organization can tolerate: RTO is how long systems can be down before recovery, and RPO is how much data — measured in time — can be lost since the last good backup.","relatedSlugs":["immutable-backup","tabletop-exercise","3-2-1-backup-rule"]},{"slug":"tabletop-exercise","term":"Tabletop Exercise","definition":"A discussion-based walkthrough of a simulated incident, where stakeholders talk through their planned response step by step, used to find gaps in an incident response plan before a real breach forces the issue.","relatedSlugs":["rto-rpo","dfir"]},{"slug":"grc","term":"GRC","acronymFor":"Governance, Risk, and Compliance","definition":"The combined discipline of setting policy (governance), identifying and managing what could go wrong (risk), and proving adherence to laws and standards (compliance) — usually the umbrella term for the programs and tools that manage all three together.","relatedSlugs":["risk-register","soc-2"]},{"slug":"soc-2","term":"SOC 2","definition":"An audit report, defined by the AICPA (the American Institute of CPAs) — SOC stands for System and Organization Controls — that evaluates a service organization's controls around security, availability, and related trust criteria. SOC 2 is the specific report enterprise SaaS customers most often require, as distinct from SOC 1's focus on financial reporting controls.","relatedSlugs":["grc","iso-27001"]},{"slug":"iso-27001","term":"ISO 27001","definition":"An international standard, published by the International Organization for Standardization, for building and certifying a formal information security management system — the standard many enterprise customers outside the U.S. (and increasingly within it) require as proof of a vendor's security program, playing a similar role to SOC 2.","relatedSlugs":["soc-2","grc"]},{"slug":"pci-dss","term":"PCI DSS","acronymFor":"Payment Card Industry Data Security Standard","definition":"A security standard, set by the major card networks, that any organization storing, processing, or transmitting credit card data must comply with — covering network segmentation, encryption, and access control specifically around cardholder data.","relatedSlugs":["grc","hipaa"]},{"slug":"hipaa","term":"HIPAA","acronymFor":"Health Insurance Portability and Accountability Act","definition":"A U.S. federal law that sets security and privacy requirements for protected health information, binding on healthcare providers, insurers, and the vendors that handle health data on their behalf.","relatedSlugs":["pci-dss","gdpr"]},{"slug":"gdpr","term":"GDPR","acronymFor":"General Data Protection Regulation","definition":"The European Union's data protection law, giving individuals rights over their personal data and requiring organizations that process it to meet strict security, consent, and breach-notification obligations, with steep fines for violations.","relatedSlugs":["hipaa","data-classification"]},{"slug":"fedramp","term":"FedRAMP","acronymFor":"Federal Risk and Authorization Management Program","definition":"The U.S. government's standardized process for security-assessing and authorizing cloud services for use by federal agencies, letting a cloud vendor get certified once and reused across many agencies instead of being individually vetted by each.","relatedSlugs":["grc","nist-csf"]},{"slug":"cmmc","term":"CMMC","acronymFor":"Cybersecurity Maturity Model Certification","definition":"A U.S. Department of Defense certification program requiring contractors and subcontractors handling defense-related information to prove they meet a tiered set of cybersecurity practices before winning certain contracts.","relatedSlugs":["fedramp","nist-csf"]},{"slug":"nist-csf","term":"NIST CSF","acronymFor":"National Institute of Standards and Technology Cybersecurity Framework","definition":"A widely adopted, voluntary framework that organizes cybersecurity activity into functions — Govern, Identify, Protect, Detect, Respond, Recover — used as a common structure for building or assessing a security program.","relatedSlugs":["cis-controls","grc"]},{"slug":"cis-controls","term":"CIS Controls","definition":"A prioritized, practical set of safeguards published by the Center for Internet Security, grouped into implementation groups by organizational maturity — often used as a concrete starting checklist alongside a broader framework like NIST CSF.","relatedSlugs":["nist-csf","grc"]},{"slug":"risk-register","term":"Risk Register","definition":"A tracked, living list of an organization's identified risks, each with an owner, likelihood and impact rating, and a treatment plan — the central artifact most GRC programs and audits are built around.","relatedSlugs":["grc","tabletop-exercise"]},{"slug":"attack-surface","term":"Attack Surface","definition":"Every point where an attacker could potentially get in or extract data — exposed servers, APIs, cloud accounts, employee accounts — the thing exposure management programs work to continuously discover and shrink.","relatedSlugs":["caasm","easm","ctem"]},{"slug":"caasm","term":"CAASM","acronymFor":"Cyber Asset Attack Surface Management","definition":"Aggregates data from existing tools — EDR, cloud, identity, vulnerability scanners — into one queryable inventory of every asset an organization has, closing the gaps that come from no single tool seeing everything.","relatedSlugs":["attack-surface","easm"]},{"slug":"easm","term":"EASM","acronymFor":"External Attack Surface Management","definition":"Continuously discovers and monitors an organization's internet-facing assets — including forgotten subdomains and shadow IT nobody remembers standing up — from the outside, the same vantage point an attacker starts from.","relatedSlugs":["attack-surface","caasm"]},{"slug":"bas","term":"BAS","acronymFor":"Breach and Attack Simulation","definition":"Software that continuously and safely runs simulated attack techniques against an environment to measure whether existing defenses actually detect or block them, rather than trusting that a control works just because it's installed.","relatedSlugs":["pentest","ctem"]},{"slug":"dwell-time","term":"Dwell Time","definition":"The length of time an attacker is present inside an environment before being detected — a key metric for measuring how well detection capabilities are actually working, since a longer dwell time generally means more damage done.","relatedSlugs":["mttd-mttr","threat-hunting"]},{"slug":"mttd-mttr","term":"MTTD / MTTR","acronymFor":"Mean Time to Detect / Mean Time to Respond","definition":"Two core SOC performance metrics: MTTD measures how long it takes to notice something malicious happened, and MTTR measures how long it then takes to contain and resolve it, together showing whether a security program is getting faster over time.","relatedSlugs":["dwell-time","soc"]},{"slug":"kill-chain","term":"Kill Chain","definition":"A model that breaks an attack into a sequence of stages — reconnaissance, weaponization, delivery, exploitation, and so on through actions on objectives — on the premise that breaking any single link stops the whole attack.","relatedSlugs":["mitre-attack","lateral-movement"]},{"slug":"defense-in-depth","term":"Defense in Depth","definition":"A security strategy that layers multiple, different controls — network, endpoint, identity, data — so that if an attacker gets past one, another independent layer still stands between them and the target.","relatedSlugs":["zero-trust","kill-chain"]},{"slug":"shift-left","term":"Shift Left","definition":"Moving security testing and review earlier in the software development process — into the IDE and pull request instead of a pre-release gate — so flaws are caught and fixed while they're still cheap to change.","relatedSlugs":["devsecops"]},{"slug":"devsecops","term":"DevSecOps","definition":"A practice and culture that builds security checks directly into the software delivery pipeline — automated scanning, policy-as-code gates — rather than treating security as a separate review that happens after development is done.","relatedSlugs":["shift-left","iac"]},{"slug":"infrastructure-security","term":"Infrastructure Security","definition":"An umbrella term for securing the layers applications run on — networks, servers, containers, and cloud services — as opposed to the application code itself. This map deliberately splits that umbrella by where each control lives: Network & Perimeter (traffic and the perimeter), Cloud Security (cloud infrastructure and container/Kubernetes security), and Security Operations (vulnerability management).","relatedSlugs":["iac","cspm","microsegmentation"]},{"slug":"waf","term":"WAF","acronymFor":"Web Application Firewall","definition":"A filter that sits in front of a web application or API, inspecting incoming requests for attack patterns like SQL injection and cross-site scripting and blocking them before they reach the application.","relatedSlugs":["ddos","owasp-top-10"]},{"slug":"ddos","term":"DDoS","acronymFor":"Distributed Denial-of-Service","definition":"An attack that floods a target with traffic from many sources at once — often a botnet — to overwhelm its capacity and knock it offline for legitimate users.","relatedSlugs":["botnet","waf"]},{"slug":"botnet","term":"Botnet","definition":"A network of compromised devices, controlled remotely by an attacker through command-and-control infrastructure, used collectively to launch DDoS attacks, send spam, or carry out other automated abuse at scale.","relatedSlugs":["c2","ddos"]},{"slug":"dns-filtering","term":"DNS Filtering","definition":"Blocking access to known-malicious or policy-violating domains at the DNS resolution step, before a connection is ever made — a lightweight control that stops a lot of malware and phishing infrastructure with minimal setup.","relatedSlugs":["waf","c2"]},{"slug":"sase","term":"SASE","acronymFor":"Secure Access Service Edge","definition":"An architecture that converges networking (like SD-WAN) and security services (like SWG and ZTNA) into one cloud-delivered platform, replacing a stack of separate branch and data-center appliances.","relatedSlugs":["sse","ztna","swg"]},{"slug":"sse","term":"SSE","acronymFor":"Security Service Edge","definition":"The security-focused subset of SASE — ZTNA, SWG, and CASB delivered from the cloud — without the SD-WAN networking half, for organizations that want converged security without replacing their existing network connectivity.","relatedSlugs":["sase","ztna","casb"]},{"slug":"ztna","term":"ZTNA","acronymFor":"Zero Trust Network Access","definition":"Grants access to a specific internal application on a per-request basis, verifying identity and device posture every time, instead of putting a remote user on the corporate network the way a traditional VPN does.","relatedSlugs":["sase","zero-trust"]},{"slug":"swg","term":"SWG","acronymFor":"Secure Web Gateway","definition":"Inspects and filters outbound web traffic for malware, phishing sites, and policy violations, typically as a cloud-delivered service that a user's traffic routes through before reaching the open internet.","relatedSlugs":["sase","dns-filtering"]},{"slug":"casb","term":"CASB","acronymFor":"Cloud Access Security Broker","definition":"Sits between users and cloud applications to enforce visibility and data-protection policy — discovering unsanctioned app use and controlling what happens to sensitive data inside approved SaaS applications.","relatedSlugs":["sase","sse"]},{"slug":"ai-security","term":"AI Security","definition":"The discipline of identifying, testing, governing, and reducing security risks in machine-learning models, generative-AI applications, and autonomous agents across their development and operating lifecycle.","relatedSlugs":["prompt-injection","ai-red-teaming","agentic-ai"]},{"slug":"prompt-injection","term":"Prompt Injection","definition":"An attack in which untrusted instructions supplied directly by a user or indirectly through retrieved content attempt to override an AI application's intended instructions, policy, or tool-use boundaries.","relatedSlugs":["jailbreak","agentic-ai","ai-security"]},{"slug":"jailbreak","term":"AI Jailbreak","definition":"A prompt or interaction pattern designed to make an AI system bypass its safety or policy restrictions and produce behavior that the system was intended to refuse.","relatedSlugs":["prompt-injection","ai-red-teaming"]},{"slug":"model-poisoning","term":"Model Poisoning","definition":"Deliberate manipulation of training data, model weights, fine-tuning inputs, or related artifacts so a model learns hidden, biased, or malicious behavior.","relatedSlugs":["model-extraction","ai-security"]},{"slug":"model-extraction","term":"Model Extraction","definition":"An attack that uses repeated queries, stolen artifacts, or other access to reproduce a model's behavior or recover valuable information about its parameters and intellectual property.","relatedSlugs":["model-poisoning","ai-security"]},{"slug":"agentic-ai","term":"Agentic AI","definition":"An AI system that can plan and take actions through tools, APIs, data sources, or other agents, creating security consequences beyond simply generating text or images.","relatedSlugs":["prompt-injection","ai-security"]},{"slug":"ai-red-teaming","term":"AI Red Teaming","definition":"Structured adversarial testing of an AI model or application to uncover exploitable behavior, policy failures, data leakage, unsafe outputs, and weaknesses in surrounding controls.","relatedSlugs":["jailbreak","prompt-injection","ai-security"]},{"slug":"shadow-ai","term":"Shadow AI","definition":"AI applications, models, agents, or services used inside an organization without formal approval, inventory, risk review, or consistent security and data-governance controls.","relatedSlugs":["ai-security","agentic-ai"]}]}