Glossary. Terms In Plain Words.

Glossary Term.

Account Takeover.

Also called ATO, account hijacking.

Account takeover is when an attacker gains control of an online account that belongs to someone else, such as an email, bank or work login.

Read The Definition. →

Glossary Term.

Active Directory.

Also called AD, AD DS.

Active Directory is a directory service for managing identities in Windows domain networks, as NIST defines it.

Read The Definition. →

Glossary Term.

Advanced Persistent Threat (APT).

Also called APT, APT group.

An advanced persistent threat (APT) is a skilled, well-resourced adversary that targets an organization over a long period.

Read The Definition. →

Glossary Term.

Adversary-in-the-middle (AiTM).

Also called AiTM, man-in-the-middle.

An adversary-in-the-middle (AiTM) attack is one where an attacker positions themselves between two communicating parties to read or change the data passing between them.

Read The Definition. →

Glossary Term.

AI Agents.

Also called AI agent, agentic AI.

An AI agent is software that uses an AI model to pursue a goal, using data, tools and actions with little step-by-step human input.

Read The Definition. →

Glossary Term.

Attack Surface.

An attack surface is everything an attacker could reach to try to get into your organization.

Read The Definition. →

Glossary Term.

Backdoor.

Also called back door, backdoor malware.

A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk.

Read The Definition. →

Glossary Term.

Bootkit.

A bootkit is malware that runs while a computer starts, before the operating system loads.

Read The Definition. →

Glossary Term.

Botnet.

Also called bot network, zombie network.

A botnet is a group of hijacked internet-connected devices that an attacker controls remotely and uses to carry out large scale attacks.

Read The Definition. →

Glossary Term.

Brand Impersonation.

Also called business impersonation, business impersonator scam.

Brand impersonation is pretending to be a company or its staff to trick people into trusting a message, site or account.

Read The Definition. →

Glossary Term.

Brand Protection.

Also called online brand protection, digital brand protection.

Brand protection is the work of stopping others from abusing your name, logos, products and trademarks.

Read The Definition. →

Glossary Term.

Brotli.

Also called br content encoding.

Brotli is a lossless compression format that makes data smaller so it can be stored or sent faster.

Read The Definition. →

Glossary Term.

Brute Force Attack.

Also called brute-force attack, brute forcing.

A brute force attack is a method of guessing passwords or other secret values by trying many combinations until one works.

Read The Definition. →

Glossary Term.

Bulletproof Hosting.

Also called BPH, bulletproof hosting provider.

Bulletproof hosting is internet infrastructure that is knowingly and intentionally marketed and leased to cybercriminals.

Read The Definition. →

Glossary Term.

Business Email Compromise (BEC).

Also called BEC, email account compromise.

Business email compromise (BEC) is a scam that targets businesses and individuals who make legitimate requests to transfer money.

Read The Definition. →

Glossary Term.

Certificate Authority (CA).

Also called Certification authority.

A certificate authority (CA) is a trusted entity that issues and revokes public key certificates.

Read The Definition. →

Glossary Term.

Cloud Security.

Also called cloud computing security, cloud protection.

Cloud security is the practice of protecting the data, applications and systems that run in cloud computing.

Read The Definition. →

Glossary Term.

Command And Control (C2).

Also called C2, C&C.

Command and control (C2) is how an attacker communicates with systems they have compromised in order to control them.

Read The Definition. →

Glossary Term.

Common Vulnerabilities And Exposures (CVE).

Also called Common Vulnerabilities and Exposures, CVE ID.

CVE, short for Common Vulnerabilities and Exposures, is a list of entries for publicly known cybersecurity vulnerabilities.

Read The Definition. →

Glossary Term.

Common Vulnerability Scoring System (CVSS).

Also called CVSS, CVSS score.

The Common Vulnerability Scoring System (CVSS) is an open standard for describing the severity of a software vulnerability as a number from 0.0 to 10.0.

Read The Definition. →

Glossary Term.

Common Weakness Enumeration (CWE).

Also called Common Weakness Enumeration, CWE list.

Common Weakness Enumeration (CWE) is a community-developed list of common software and hardware weaknesses.

Read The Definition. →

Glossary Term.

Credential Harvesting.

Also called credential harvest, password harvesting.

Credential harvesting is the collection of usernames, passwords and similar login details from many people or systems.

Read The Definition. →

Glossary Term.

Credential Stuffing.

Also called password stuffing, credential stuffing attack.

Credential stuffing is the automated trying of stolen username and password pairs on login forms to gain access to accounts.

Read The Definition. →

Glossary Term.

Credential Theft.

Also called credential stealing, stolen credentials.

Credential theft is the stealing of account names, passwords and similar login material so that someone else can use them.

Read The Definition. →

Glossary Term.

Critical Infrastructure.

Also called Critical national infrastructure, CNI.

Critical infrastructure means the systems and assets, physical or virtual, that are so vital that losing them would seriously harm security, the economy, or public health and safety.

Read The Definition. →

Glossary Term.

Cross-site Scripting (XSS).

Also called XSS, cross site scripting.

Cross-site scripting (XSS) is a web application weakness where an attacker gets a malicious script into a trusted website, and the visitor's browser runs it.

Read The Definition. →

Glossary Term.

Cyber Espionage.

Also called cyberespionage, cyber spying.

Cyber espionage is the use of computer networks to secretly gather information that someone wants to keep private.

Read The Definition. →

Glossary Term.

Cyber Extortion.

Also called digital extortion, data extortion.

Cyber extortion is when attackers pressure a victim to pay by threatening harm, such as keeping data locked or publishing stolen data.

Read The Definition. →

Glossary Term.

Cyber Hygiene.

Also called cybersecurity hygiene, basic cyber security.

Cyber hygiene is the set of routine, basic habits that keep devices, accounts and data in good security health.

Read The Definition. →

Glossary Term.

Dark Web.

Also called Darknet.

The dark web is a part of the internet that needs special software, such as the Tor Browser, to reach.

Read The Definition. →

Glossary Term.

Dark Web Monitoring.

Also called dark web scanning, dark web surveillance.

Dark web monitoring is the practice of searching hidden criminal forums, marketplaces and leak sites for your data.

Read The Definition. →

Glossary Term.

Data Breach.

Also called breach, security breach.

A data breach is an event where someone gets access to information they are not authorized to see, or where authorized users use it for a purpose they were not allowed.

Read The Definition. →

Glossary Term.

Data Exfiltration.

Also called exfiltration, data theft.

Data exfiltration is the unauthorized transfer of information from a system.

Read The Definition. →

Glossary Term.

Data Leak Site.

Also called leak site, DLS.

A data leak site is a website where attackers publish data stolen from a victim.

Read The Definition. →

Glossary Term.

DDoS Attack.

Also called distributed denial-of-service attack, denial of service.

A DDoS attack is a distributed denial-of-service attack, where many machines work together to flood one target so that legitimate users cannot reach it.

Read The Definition. →

Glossary Term.

Deep Web.

Also called invisible web, hidden web.

The deep web is the part of the internet that search engines do not index.

Read The Definition. →

Glossary Term.

Deepfake.

Also called synthetic media, AI-generated fake.

A deepfake is a picture, video or audio clip made or changed by artificial intelligence so that it looks or sounds like a real person.

Read The Definition. →

Glossary Term.

Digital Executive Protection.

Also called VIP monitoring, executive digital protection.

Digital executive protection is the work of reducing online risks to a company's senior leaders.

Read The Definition. →

Glossary Term.

Digital Footprint.

Also called online footprint.

A digital footprint is the trail of data a person or organization creates while using the internet.

Read The Definition. →

Glossary Term.

Digital Forensics.

Also called computer forensics, forensics.

Digital forensics is the application of science to identifying, collecting, examining and analyzing data while preserving its integrity and keeping a strict chain of custody.

Read The Definition. →

Glossary Term.

Digital Operational Resilience Act (DORA).

Also called DORA, Regulation (EU) 2022/2554.

The Digital Operational Resilience Act (DORA) is Regulation (EU) 2022/2554, a European Union law on the digital operational resilience of the financial sector.

Read The Definition. →

Glossary Term.

Digital Risk Protection (DRP).

Also called DRP, DRPS.

Digital risk protection (DRP) is a security practice that finds and removes threats to your brand, people and data outside your own network.

Read The Definition. →

Glossary Term.

DMARC, SPF And DKIM.

Also called email authentication, DMARC.

DMARC, SPF and DKIM are three email authentication standards that help a receiving mail system check whether a message really comes from the domain it claims.

Read The Definition. →

Glossary Term.

Double Extortion.

Also called double extortion ransomware.

Double extortion is a ransomware tactic in which attackers both encrypt a victim's files and steal a copy of the data, then threaten to release it.

Read The Definition. →

Glossary Term.

Doxing.

Also called doxxing.

Doxing is the malicious identification and online publication of information about an individual.

Read The Definition. →

Glossary Term.

Email Spoofing.

Also called Sender spoofing, Spoofed email.

Email spoofing is sending an email with a forged sender so that it looks like it came from someone else, such as a trusted company or a colleague.

Read The Definition. →

Glossary Term.

Endpoint Detection And Response (EDR).

Also called EDR, endpoint threat detection and response.

Endpoint detection and response (EDR) is a type of security tool that watches devices such as laptops and servers for suspicious activity.

Read The Definition. →

Glossary Term.

Exploit Kit.

Also called exploit pack, EK.

An exploit kit is a toolset that tries to find a weakness in a visitor's browser or plugins and then delivers exploit code to use it.

Read The Definition. →

Glossary Term.

Exploit Prediction Scoring System (EPSS).

Also called EPSS, exploit prediction score.

The Exploit Prediction Scoring System (EPSS) is a model that estimates how likely it is that a published vulnerability will be exploited in the wild.

Read The Definition. →

Glossary Term.

Exposure Management.

Also called risk exposure management.

Exposure management is the ongoing work of finding where an organization is open to risk, judging how serious each case is, and reducing it.

Read The Definition. →

Glossary Term.

External Attack Surface Management (EASM).

Also called EASM, external attack surface monitoring.

External attack surface management (EASM) is the continuous discovery and review of everything your organization exposes to the internet.

Read The Definition. →

Glossary Term.

False Positive.

Also called false alarm, false alert.

A false positive is an alert that wrongly says something is a problem.

Read The Definition. →

Glossary Term.

Generative AI.

Also called GenAI, Gen AI.

Generative AI is a class of AI models that create new content, such as text, images, audio or video.

Read The Definition. →

Glossary Term.

GSS-TSIG.

Also called Generic Security Service TSIG.

GSS-TSIG is a method for signing DNS messages with keys that come from Kerberos through the GSS-API.

Read The Definition. →

Glossary Term.

Hacktivism.

Also called hacktivist, hacktivist groups.

Hacktivism is the use of hacking to push a political, social or ideological cause.

Read The Definition. →

Glossary Term.

Human Intelligence (HUMINT).

Also called human-source intelligence.

Human intelligence, or HUMINT, is intelligence derived from information collected and provided by human sources.

Read The Definition. →

Glossary Term.

Immutable Backup.

Also called immutable backups, WORM backup.

An immutable backup is a copy of data that cannot be changed or deleted once it has been written.

Read The Definition. →

Glossary Term.

Incident Response Plan.

Also called IRP.

An incident response plan is a written set of instructions for how an organization detects, responds to, and limits the harm from a cyber attack.

Read The Definition. →

Glossary Term.

Indicator Of Compromise (IoC).

Also called IoC.

An indicator of compromise, or IoC, is a piece of evidence that a system may have been breached or is under attack.

Read The Definition. →

Glossary Term.

Infostealer.

Also called Information stealer, Stealer malware.

An infostealer is a type of malware that copies saved passwords, browser cookies and other data from an infected device and sends it to the attacker.

Read The Definition. →

Glossary Term.

Initial Access.

Also called Initial compromise, Initial foothold.

Initial access is the first step in which an attacker gets into a target network.

Read The Definition. →

Glossary Term.

Initial Access Broker.

Also called IAB, Access broker.

An initial access broker is a criminal who gains access to a company network and passes or sells that access to someone else.

Read The Definition. →

Glossary Term.

Insider Threat.

Also called insider risk, insider threats.

An insider threat is the potential for a person with authorized access to, or knowledge of, an organization to use that access to harm it.

Read The Definition. →

Glossary Term.

Kerberoasting.

Kerberoasting is an attack on Windows Active Directory in which an attacker who already has a valid domain login asks for service tickets and then tries to crack them offline to learn a service account password.

Read The Definition. →

Glossary Term.

Known Exploited Vulnerabilities (KEV) Catalog.

Also called KEV, KEV catalog.

The Known Exploited Vulnerabilities (KEV) catalog is a list of vulnerabilities that have been exploited in real attacks.

Read The Definition. →

Glossary Term.

Lateral Movement.

Also called moving laterally, network pivoting.

Lateral movement is when an attacker who has gained access to one system moves on to other systems and accounts in the same network.

Read The Definition. →

Glossary Term.

Law Enforcement Takedown.

Also called Botnet takedown, Infrastructure takedown.

A law enforcement takedown is a coordinated action in which police and prosecutors shut down or seize the servers, domains or other infrastructure that criminals use.

Read The Definition. →

Glossary Term.

Leaked Credentials.

Also called exposed credentials, compromised credentials.

Leaked credentials are usernames, passwords or other login details that have become exposed outside the control of their owner.

Read The Definition. →

Glossary Term.

Least Privilege.

Also called principle of least privilege, PoLP.

Least privilege is a security principle that gives each user, process or system only the access it needs to do its job, and no more.

Read The Definition. →

Glossary Term.

Living Off The Land (LOTL).

Also called LOTL, living-off-the-land.

Living off the land (LOTL) is an attack style in which adversaries use legitimate tools and processes already present on a system instead of custom malware.

Read The Definition. →

Glossary Term.

Lookalike Domain.

Also called look-alike domain, homograph domain.

A lookalike domain is a web address made to look like a real one, for example by changing a few characters or using a different top-level domain.

Read The Definition. →

Glossary Term.

Malicious Package.

Also called malicious packages, poisoned package.

A malicious package is a software package that has been made or changed to carry harmful code, then shared through a package source that developers trust.

Read The Definition. →

Glossary Term.

Malvertising.

Also called malicious advertising, malicious ads.

Malvertising is the use of online adverts to deliver malicious activity, such as a forced redirect to a harmful site or a malware payload.

Read The Definition. →

Glossary Term.

Malware.

Also called Malicious software.

Malware is any software made to harm a device, steal data or give an attacker control without consent.

Read The Definition. →

Glossary Term.

Malware Loader.

Also called loader, downloader.

A malware loader is a program whose main job is to get other malware onto a computer.

Read The Definition. →

Glossary Term.

Malware-as-a-service (MaaS).

Also called MaaS, malware as a service.

Malware-as-a-service (MaaS) is a criminal business model where developers sell or rent ready-made malware to other criminals.

Read The Definition. →

Glossary Term.

Mercenary Spyware.

Also called Commercial spyware.

Mercenary spyware is surveillance software that a private company builds and sells, usually to governments, to take over a person's phone or computer in secret.

Read The Definition. →

Glossary Term.

MFA Fatigue.

Also called MFA bombing, MFA prompt bombing.

MFA fatigue is an attack that floods a user with multi-factor authentication prompts until they approve one.

Read The Definition. →

Glossary Term.

MITRE ATT&CK.

Also called ATT&CK, ATT&CK framework.

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read The Definition. →

Glossary Term.

Multi-factor Authentication (MFA).

Also called two-factor authentication, 2FA.

Multi-factor authentication (MFA) is a way to log in that needs two or more different kinds of proof, such as a password and a code from an authentication app.

Read The Definition. →

Glossary Term.

Network Segmentation.

Also called segmentation, network segregation.

Network segmentation is the practice of splitting a network into separate parts, so that a problem in one part does not spread freely to the others.

Read The Definition. →

Glossary Term.

NIS2 Directive.

Also called NIS2, NIS 2.

The NIS2 Directive, Directive (EU) 2022/2555, is a European Union cybersecurity law adopted by the European Parliament and the Council on 14 December 2022.

Read The Definition. →

Glossary Term.

Non-human Identity.

Also called NHI, non-person entity.

A non-human identity (NHI) is a digital identity that belongs to software or a device, not to a person.

Read The Definition. →

Glossary Term.

Obfuscation.

Also called code obfuscation, file obfuscation.

Obfuscation is the act of making code, files or data hard to read, discover or analyze.

Read The Definition. →

Glossary Term.

Open-source Intelligence (OSINT).

Also called OSINT, open source intelligence.

Open-source intelligence (OSINT) is information gathered from publicly available sources such as websites, news sites, social media and search engines.

Read The Definition. →

Glossary Term.

Passkeys.

Also called passkey, FIDO passkey.

A passkey is a sign-in credential, based on FIDO standards, that replaces a password.

Read The Definition. →

Glossary Term.

Password Manager.

Also called password vault.

A password manager is a program that creates, stores and fills in your passwords for you.

Read The Definition. →

Glossary Term.

Password Spraying.

Also called password spray, low and slow password attack.

Password spraying is a brute force technique where an attacker tries one password, or a small list of common passwords, against many accounts.

Read The Definition. →

Glossary Term.

Paste Sites (Pastebin).

Also called Pastebin, paste site.

A paste site is a public website where anyone can post a block of text to share, such as code or notes.

Read The Definition. →

Glossary Term.

Patch Management.

Also called patching, enterprise patch management.

Patch management is the process of identifying, prioritizing, acquiring, installing, and verifying patches, updates, and upgrades across an organization.

Read The Definition. →

Glossary Term.

PCI DSS.

Also called PCI DSS, Payment Card Industry Data Security Standard.

PCI DSS, the Payment Card Industry Data Security Standard, is a standard that sets technical and operational requirements designed to protect payment account data.

Read The Definition. →

Glossary Term.

Penetration Testing.

Also called pen test, pentest.

Penetration testing is security testing in which evaluators mimic real-world attacks to find ways around the security features of an application, system or network.

Read The Definition. →

Glossary Term.

Persistence.

Also called maintaining access, foothold.

Persistence is the set of actions an attacker takes to keep access to a system after the first break-in.

Read The Definition. →

Glossary Term.

Phishing.

Phishing is a message that pretends to come from someone you trust, with the aim of getting you to hand over a password, money or access.

Read The Definition. →

Glossary Term.

Phishing Kit.

Also called phishing toolkit, phish kit.

A phishing kit is a ready-made package of items used to run phishing scams.

Read The Definition. →

Glossary Term.

Phishing Takedown.

Also called phishing site takedown, domain takedown.

Phishing takedown is the process of getting a phishing website, or its hosting, removed or blocked.

Read The Definition. →

Glossary Term.

Phishing-as-a-service (PhaaS).

Also called PhaaS, phishing as a service.

Phishing-as-a-service (PhaaS) is a model where cyber threat actors provide access to phishing kits to others in exchange for a one-time fee or subscription.

Read The Definition. →

Glossary Term.

Privilege Escalation.

Also called Privilege elevation, Elevation of privilege.

Privilege escalation is when an attacker gains higher-level permissions than they started with.

Read The Definition. →

Glossary Term.

Proof-of-concept Exploit.

Also called PoC exploit, PoC.

A proof-of-concept exploit is code that shows a vulnerability can be exploited.

Read The Definition. →

Glossary Term.

Ransomware.

Also called ransomware attack, crypto-ransomware.

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read The Definition. →

Glossary Term.

Ransomware-as-a-service (RaaS).

Also called RaaS, ransomware as a service.

Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims.

Read The Definition. →

Glossary Term.

Reconnaissance.

Also called recon, pre-attack reconnaissance.

Reconnaissance is the stage where an attacker gathers information to plan later operations.

Read The Definition. →

Glossary Term.

Remote Access Trojan (RAT).

Also called RAT, remote access tool.

A remote access trojan, or RAT, is malware that lets an attacker control a computer from a distance.

Read The Definition. →

Glossary Term.

Remote Code Execution (RCE).

Also called RCE, arbitrary code execution.

Remote code execution (RCE) is when an attacker runs code of their choice on another person's system from a distance.

Read The Definition. →

Glossary Term.

Remote Desktop Protocol (RDP).

Also called RDP, remote desktop.

Remote Desktop Protocol, or RDP, is a Windows feature that lets a person open an interactive session on another computer over a network.

Read The Definition. →

Glossary Term.

Sandbox.

Also called sandboxing, sandbox environment.

A sandbox is a restricted, controlled environment where software can run without reaching the rest of a system.

Read The Definition. →

Glossary Term.

Security Awareness Training.

Also called cyber awareness training, security awareness program.

Security awareness training teaches people in an organization how to recognize and handle cyber threats.

Read The Definition. →

Glossary Term.

Security Information And Event Management (SIEM).

Also called SIEM, SIEM tool.

Security information and event management (SIEM) is software that collects log records from many systems into one place.

Read The Definition. →

Glossary Term.

Security Misconfiguration.

Also called misconfiguration, security misconfigurations.

Security misconfiguration is a weakness caused by systems, software or cloud services being set up in an unsafe way.

Read The Definition. →

Glossary Term.

Security Operations Center (SOC).

Also called SOC, security operations center.

A security operations center (SOC) is the team and function that monitors an organization's systems and networks and responds to cybersecurity incidents.

Read The Definition. →

Glossary Term.

Security Orchestration, Automation And Response (SOAR).

Also called SOAR, security orchestration, automation, and response.

Security orchestration, automation and response (SOAR) is a security strategy that automates parts of the incident response process.

Read The Definition. →

Glossary Term.

Service Principal.

Also called Application identity, Enterprise application.

A service principal is the identity an application uses inside a Microsoft Entra tenant.

Read The Definition. →

Glossary Term.

Session Cookie.

Also called session token, session ID.

A session cookie is a small piece of data a website stores in your browser to recognize you after you sign in.

Read The Definition. →

Glossary Term.

Session Hijacking.

Also called session hijack, cookie hijacking.

Session hijacking is an attack in which someone takes over a logged-in web session by stealing or abusing the session token.

Read The Definition. →

Glossary Term.

Shadow AI.

Also called unapproved AI use, shadow AI use.

Shadow AI is the use of AI tools by staff without the organization's approval.

Read The Definition. →

Glossary Term.

Shadow IT.

Also called shadow technology, unsanctioned IT.

Shadow IT is the set of devices, services and tools that people use for work without the organization knowing about them.

Read The Definition. →

Glossary Term.

SIM Swapping.

Also called SIM swap, SIM swap scam.

SIM swapping is a scam in which a criminal gets a mobile carrier to move a victim's phone number to a SIM card the criminal controls.

Read The Definition. →

Glossary Term.

Sinkhole.

Also called DNS sinkhole, sinkholing.

A sinkhole is the redirection of network traffic from its original destination to a new one where the traffic has a harmless or limited effect.

Read The Definition. →

Glossary Term.

Smishing.

Also called SMS phishing, text message phishing.

Smishing is a form of social engineering that uses SMS, or text, messages.

Read The Definition. →

Glossary Term.

SMS Bombing.

Also called SMS bomber, OTP bombing.

SMS bombing is the flooding of a phone number with a large number of text messages, usually by abusing website or app features that send verification codes.

Read The Definition. →

Glossary Term.

Social Engineering.

Also called social engineering attack.

Social engineering is the act of tricking a person into revealing information, giving access or committing fraud.

Read The Definition. →

Glossary Term.

Software Bill Of Materials (SBOM).

Also called software bill of materials, software BOM.

A software bill of materials (SBOM) is a nested inventory, a list of ingredients that make up software components, according to CISA.

Read The Definition. →

Glossary Term.

Spear Phishing.

Also called spearphishing, targeted phishing.

Spear phishing is phishing aimed at a chosen person or group instead of a large crowd.

Read The Definition. →

Glossary Term.

SQL Injection.

Also called SQLi, SQL injection attack.

SQL injection is an attack where someone sends database commands through an input field, and the application runs them against its database.

Read The Definition. →

Glossary Term.

Stealer Logs.

Also called infostealer logs, stealer log.

Stealer logs are bundles of data collected from an infected device by information-stealing malware.

Read The Definition. →

Glossary Term.

STIX And TAXII.

Also called STIX, TAXII.

STIX and TAXII are two open standards for sharing cyber threat intelligence.

Read The Definition. →

Glossary Term.

Supply Chain Attack.

Also called software supply chain attack.

A supply chain attack reaches its target by exploiting weaknesses in the products or services the target depends on.

Read The Definition. →

Glossary Term.

Tactics, Techniques And Procedures (TTPs).

Also called TTPs, TTP.

Tactics, techniques and procedures (TTPs) describe the behavior of an attacker.

Read The Definition. →

Glossary Term.

Third-party Risk.

Also called vendor risk, supplier risk.

Third-party risk is the chance that an outside organization you rely on, such as a vendor, supplier or service provider, harms your security.

Read The Definition. →

Glossary Term.

Third-party Risk Management (TPRM).

Also called TPRM, vendor risk management.

Third-party risk management (TPRM) is the program a company uses to find, assess and reduce the risks that come from vendors, suppliers and service providers.

Read The Definition. →

Glossary Term.

Threat Actor.

Also called Actor, Threat group.

A threat actor is an individual or a group that poses a threat to an organization or system.

Read The Definition. →

Glossary Term.

Threat Attribution.

Also called Cyber attribution, Attack attribution.

Threat attribution is the process of linking an attack or a campaign to the group or state believed to be behind it.

Read The Definition. →

Glossary Term.

Threat Feed.

Also called Threat intelligence feed, Cyber threat feed.

A threat feed is a stream of cyber threat information, such as indicators of compromise, that an organization receives from an outside source.

Read The Definition. →

Glossary Term.

Threat Hunting.

Also called cyber threat hunting, proactive threat hunting.

Threat hunting is the practice of proactively searching a network for signs of an attacker instead of waiting for an alert.

Read The Definition. →

Glossary Term.

Threat Intelligence.

Also called Cyber threat intelligence, CTI.

Threat intelligence is threat information that has been aggregated, transformed, analyzed, interpreted or enriched to give the context needed for decisions.

Read The Definition. →

Glossary Term.

Threat Intelligence Platform (TIP).

Also called TIP, threat intelligence management platform.

A threat intelligence platform (TIP) is a tool that collects threat information from many places, stores it in one place and helps security teams use it.

Read The Definition. →

Glossary Term.

Threat Modeling.

Also called threat modeling, system threat modeling.

Threat modeling is the practice of analyzing a system to find what could go wrong with its security and privacy.

Read The Definition. →

Glossary Term.

Tor Network.

Also called Tor, The Onion Router.

The Tor network is a group of volunteer-operated servers that lets people improve their privacy and security on the Internet.

Read The Definition. →

Glossary Term.

Traffic Light Protocol (TLP).

Also called TLP, TLP labels.

The Traffic Light Protocol (TLP) is a set of four labels, TLP:RED, TLP:AMBER, TLP:GREEN and TLP:CLEAR, that tell the person receiving shared information how far they may pass it on.

Read The Definition. →

Glossary Term.

Trojan.

Also called Trojan horse, trojan malware.

A Trojan is a program that appears to have a useful function but also has a hidden, potentially malicious function.

Read The Definition. →

Glossary Term.

Typosquatting.

Also called URL hijacking.

Typosquatting is registering a domain name that looks almost like a real one, such as a common misspelling or a different ending.

Read The Definition. →

Glossary Term.

Underground Forum.

Also called cybercrime forum, hacker forum.

An underground forum is an online community where cybercriminals advertise, buy and sell products and services, and share expertise.

Read The Definition. →

Glossary Term.

Vishing (voice Phishing).

Also called voice phishing, phone phishing.

Vishing is voice phishing, a scam where an attacker uses a phone call or voice message to trick someone into giving up information or access.

Read The Definition. →

Glossary Term.

Vulnerability Intelligence.

Vulnerability intelligence is information about software weaknesses that helps you decide which ones to fix first.

Read The Definition. →

Glossary Term.

Vulnerability Management.

Also called vulnerability management program, vulnerability management process.

Vulnerability management is the ongoing work of finding, reporting and fixing weaknesses in software and devices before attackers can exploit them.

Read The Definition. →

Glossary Term.

Vulnerability Prioritization.

Also called vulnerability triage, risk-based vulnerability management.

Vulnerability prioritization is the way security teams decide which software flaws to fix first.

Read The Definition. →

Glossary Term.

Web Shell.

Also called webshell, web backdoor script.

A web shell is a script placed on a web server that gives an attacker a way to run commands on that server from a remote location.

Read The Definition. →

Glossary Term.

Wiper Malware.

Also called wiper, data wiper.

Wiper malware is malicious software that destroys data or makes systems unusable by overwriting or deleting files or disk contents.

Read The Definition. →

Glossary Term.

YARA And Sigma Rules.

Also called YARA rules, Sigma rules.

YARA and Sigma rules are two kinds of written detection rules used by security teams.

Read The Definition. →

Glossary Term.

Zero Trust.

Also called zero trust architecture, ZTA.

Zero trust is a security approach that gives no implicit trust to a user, device or system just because of where it sits on a network.

Read The Definition. →

Glossary Term.

Zero-day Vulnerability.

Also called zero-day, 0-day.

A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown.

Read The Definition. →