Reference
Glossary
Every cybersecurity term used across this site, defined in plain language and sorted alphabetically.
A
Air-gapPhysically isolating a network or system so it has no connection to untrusted networks - common in OT/ICS environments.
Attack surfaceThe total set of points where an attacker could try to enter or extract data from an environment.
B
BCP (Business Continuity Plan)A plan for keeping business operations running during a disruption - broader than IT disaster recovery, covering people and processes.
BEC (Business Email Compromise)Fraud where an attacker impersonates a trusted party over email to trigger a payment or data disclosure.
C
CIS Controls v8A prioritized set of defensive safeguards published by the Center for Internet Security, used here for question-level detail.
CISA KEVThe U.S. Cybersecurity and Infrastructure Security Agency catalog of vulnerabilities confirmed to be actively exploited in the wild.
Compounding riskThis site's term for two or more individually moderate gaps that combine into a materially worse risk than either alone.
ContainerizationPackaging an application with its dependencies into a portable, isolated unit (e.g. Docker) that runs consistently across environments.
CVECommon Vulnerabilities and Exposures - the standardized public identifier assigned to a specific known security flaw.
D
DDoSDistributed Denial of Service - flooding a system with traffic from many sources to make it unavailable to legitimate users.
DevSecOpsEmbedding security checks directly into software development and deployment pipelines rather than reviewing at the end.
DKIMDomainKeys Identified Mail - cryptographically signs outbound email so recipients can verify it genuinely came from your domain.
DLPData Loss Prevention - tooling that detects and blocks sensitive data from leaving an organization improperly.
DMARCA policy layer built on SPF and DKIM telling receiving mail servers what to do with messages that fail authentication.
E
EDREndpoint Detection & Response - software that monitors devices for malicious behavior and can isolate or remediate automatically.
ExfiltrationUnauthorized transfer of data out of an organization, typically the final stage of a data breach.
H
HardeningReducing a system's attack surface by disabling unnecessary services, tightening configuration, and applying secure defaults.
I
IAMIdentity & Access Management - the policies and systems governing who can access what, and under what conditions.
Immutable backupA backup that cannot be altered or deleted for a set period, protecting recovery data from ransomware encryption.
Incident Response PlanA documented, rehearsed procedure defining roles, severity levels, communications, and steps taken during a security incident.
ISMSInformation Security Management System - the documented, scoped, management-reviewed structure at the heart of ISO 27001.
ISO 27001An international standard for establishing and certifying an Information Security Management System.
J
Jump hostA hardened, monitored intermediate server that administrators must pass through to reach sensitive systems.
K
KEVKnown Exploited Vulnerability - a flaw with confirmed active exploitation, warranting faster remediation than severity score alone suggests.
L
Lateral movementAn attacker progressing from an initially compromised system deeper into a network to reach higher-value targets.
Least privilegeGranting each account only the minimum access needed for its role, rather than broad access by default.
M
Maturity tierA qualitative stage (Partial, Risk Informed, Repeatable, Adaptive) describing how deliberately an organization manages cyber risk.
MDRManaged Detection & Response - an outsourced service providing continuous monitoring, threat hunting, and incident response.
MFAMulti-factor authentication - requiring more than one independent proof of identity before granting access.
MicrosegmentationDividing a network into very granular zones so a compromise in one zone cannot reach others without passing controls.
MSPManaged Service Provider - an outsourced provider handling IT operations, sometimes including security functions.
N
NIS2An EU directive imposing cybersecurity risk-management and incident-notification duties on essential and important entities.
NIST CSF 2.0The NIST Cybersecurity Framework, organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
NVDNational Vulnerability Database - the U.S. government repository of standardized vulnerability data and severity scoring.
O
OT / ICSOperational Technology / Industrial Control Systems - computing that controls physical processes, prioritizing safety and availability over confidentiality.
P
Penetration testAn authorized simulated attack performed to validate whether defenses actually hold up in practice.
PhishingDeceptive messages designed to trick recipients into revealing credentials, opening malware, or authorizing fraudulent actions.
Prompt injectionAn attack against AI systems where malicious instructions hidden in content cause the model to act against its operator's intent.
R
RansomwareMalware that encrypts data, or threatens to leak it, and demands payment for restoration or silence.
RCERemote Code Execution - a vulnerability class letting an attacker run arbitrary code on a system over a network.
Risk registerA living record of identified risks with likelihood, impact, a named owner, treatment plan, and review date.
RPORecovery Point Objective - the maximum amount of data loss, measured in time, that an organization can tolerate.
RTORecovery Time Objective - the maximum acceptable time to restore a system after an outage.
S
SASTStatic Application Security Testing - analyzing source code for security flaws before the application is run.
SCADASupervisory Control and Data Acquisition - systems used to monitor and control industrial processes at scale.
SD-WANSoftware-Defined Wide Area Network - centrally managed, software-controlled routing across distributed network sites.
Secrets managementStoring and rotating credentials, API keys, and certificates in a dedicated vault rather than in code or config files.
SegmentationDividing a network into isolated zones so that compromise of one area does not automatically grant access to others.
SIEMSecurity Information & Event Management - centralizes, correlates, and alerts on security logs across an environment.
SOC 2An audit standard covering security and related controls, frequently required by enterprise buyers of SaaS products.
SPFSender Policy Framework - a DNS record declaring which mail servers are authorized to send email for your domain.
SQL injectionInjecting malicious database commands through unvalidated application input, often to read or alter an entire database.
Supply chain attackCompromising a trusted vendor, library, or software update to reach that vendor's downstream customers.
T
Tabletop exerciseA discussion-based rehearsal where a team walks through an incident scenario to test plans before a real event.
Threat actorAn individual or group conducting malicious activity, ranging from criminal groups to state-sponsored operations.
V
Vulnerability scanningAutomated checks against systems to identify known vulnerabilities and misconfigurations on a recurring basis.
Z
Zero trustA model that never assumes trust based on network location, verifying every access request explicitly instead.
Zero-dayA vulnerability being exploited before a patch exists, or before defenders are aware of it.
ZTNAZero Trust Network Access - granting per-application access after verification, replacing broad VPN network access.