Skip to content
NewCybercrime Report 2026 · Eight Chapters · A Post Is Not An Incident → Explore The ChaptersCybercrime Report 2026 → Explore
Request A Demo

Site Map · 207 pages

Glossary, Guides and Defence Playbooks

The Knowledge Hub explains security in plain language. The glossary defines the terms, the 101 guides explain a topic from the start, the how-to-defend playbooks give practical steps and the agentic security pages cover AI agents. This page lists every one of them, with a short summary.

101 Guides 23

Agentic Security 13

Glossary 152

  • Glossary
  • Account takeover Account takeover means an attacker gains control of someone else's online account. Learn how it works, how to lower the risk and how it differs from theft.
  • Active Directory Active Directory manages identities in Windows networks. Learn what it does, why attackers target domain accounts and how to cut the risk of misuse.
  • Advanced persistent threat (APT) An advanced persistent threat (APT) is a skilled, well-resourced adversary that targets organizations over time. See the NIST definition and CISA advice.
  • Adversary-in-the-middle (AiTM) Adversary-in-the-middle (AiTM) explained in plain English: how an attacker sits between two parties, what it can capture, and what MITRE and NIST say.
  • AI agents AI agents are software that use AI to pursue goals with tools and actions. Learn how they work and the risks CISA and the NCSC describe for security teams.
  • Attack surface Attack surface explained: what it includes, why it keeps growing, how it differs from a vulnerability, and simple steps to find and reduce it.
  • Backdoor A backdoor is a hidden or undocumented way into a system. Learn what it is, how it works, why it matters and how defenders look for one, in plain English.
  • Bootkit A bootkit is malware that runs before the operating system loads. Learn how it works, where UEFI and network boot fit in, and which controls stop it.
  • Botnet A botnet is a network of hijacked devices that an attacker controls remotely. Learn how botnets work, why IoT devices are exposed and how to cut risk.
  • Brand impersonation Brand impersonation is pretending to be a company or its staff. See how the FTC, CISA and MITRE describe it, the warning signs and ways to reduce it.
  • Brand protection Brand protection stops others from abusing your name, logos and products online. See what it covers, how it works and how it differs from brand management.
  • Brotli Brotli is a lossless compression format used on the web as the content encoding br. Learn how it works and why a decoder bug led to Node2Shell.
  • Brute force attack A brute force attack guesses passwords by trying many combinations. Learn how it works, its MITRE ATT&CK sub-techniques and how to reduce the risk.
  • Bulletproof hosting Bulletproof hosting is infrastructure leased on purpose to cybercriminals. Learn how it works, why it makes takedowns harder and how defenders can respond.
  • Business email compromise (BEC) Business email compromise (BEC) is a scam that tricks staff into sending money or data. Learn how it works, common forms and FBI IC3 advice to reduce risk.
  • Certificate Authority (CA) A certificate authority (CA) issues and revokes the certificates that bind public keys to names. How chains of trust work and what a stolen CA key allows.
  • Cloud security Cloud security explained in plain English: what it protects, why the cloud changes security work, and the common risks named by NIST and OWASP.
  • Command and control (C2) Command and control (C2) is how attackers talk to compromised systems. Learn what a C2 server is, how traffic hides, and what MITRE ATT&CK says to watch.
  • Common Vulnerabilities and Exposures (CVE) CVE is a list of publicly known security flaws, each with a unique ID, a description and a reference. Learn how it works and why it matters.
  • Common Vulnerability Scoring System (CVSS) CVSS explained in plain English: how the 0.0 to 10.0 severity score works, its metric groups, the ratings, and why a score is not the same as risk.
  • Common Weakness Enumeration (CWE) CWE is a community list of common software and hardware weaknesses. Learn how it works, how it differs from CVE and how teams use it to reduce risk.
  • Credential harvesting Credential harvesting is the collection of logins through phishing, keylogging and browser stores. Learn how it works and what helps.
  • Credential stuffing Short definition of credential stuffing as OWASP and MITRE use it, and how it differs from brute force. For detection and defenses, see our full guide.
  • Credential theft Credential theft is stealing account names and passwords. See how MITRE ATT&CK describes it, the main techniques, and the mitigations it lists.
  • Critical infrastructure Critical infrastructure is the set of systems so vital that their loss would hurt security, health or the economy. See NIST's definition and CISA's list.
  • Cross-site scripting (XSS) Cross-site scripting (XSS) explained in plain English: how it works, the three types, what attackers can do and the defences OWASP and MITRE describe.
  • Cyber espionage Cyber espionage is the secret gathering of private information over networks. Learn how collection and exfiltration work and how to reduce the risk.
  • Cyber extortion Cyber extortion means pressuring a victim to pay by threatening locked systems or leaked data. Learn how it works and how to reduce the risk.
  • Cyber hygiene Cyber hygiene is the set of routine habits that keep accounts, devices and data secure. Learn the basic practices named by CISA and the NCSC.
  • Dark web The dark web explained: what it is, how Tor works, how forums and marketplaces differ, and why companies watch it for stolen data.
  • Dark web monitoring Dark web monitoring searches criminal forums, markets and leak sites for your stolen data. Learn how it works, what it finds and what to do after an alert.
  • Data breach What a data breach is, how NIST defines a breach, what CISA says about notifying affected people, and how ENISA assesses severity. Plain-language guide.
  • Data exfiltration Data exfiltration is the unauthorized transfer of information from a system. Learn how it works, common techniques and ways to detect it, in plain terms.
  • Data leak site A data leak site is where ransomware operators publish stolen victim data to pressure payment. Learn how it works and how to reduce the risk.
  • DDoS attack A DDoS attack uses many machines to flood one target so real users cannot reach it. Learn how it works, signs to watch for and ways to reduce the risk.
  • Deep web The deep web is the part of the internet that search engines do not index. Learn how it works and how it differs from the dark web, in plain English.
  • Deepfake A deepfake is AI-made video, audio or image that imitates a real person. Learn how deepfakes work, how criminals use them and how to check what you see.
  • Digital executive protection Digital executive protection cuts online risks to senior leaders: fake profiles, leaked data and stolen logins. See how it works and what it covers.
  • Digital footprint A digital footprint is the trail of data left online by people and firms. Learn the active and passive types, why it matters and how to reduce it.
  • Digital forensics What digital forensics is, its four phases (collection, examination, analysis, reporting) and why chain of custody matters, based on NIST guidance.
  • Digital Operational Resilience Act (DORA) DORA is an EU regulation on ICT risk for financial firms. See who adopted it, who it applies to and what it covers, from official EU sources.
  • Digital risk protection (DRP) Digital risk protection (DRP) finds fake sites, leaked data and impersonation outside your network. See how it works and how it differs from threat intel.
  • DMARC, SPF and DKIM DMARC, SPF and DKIM explained in plain English: what each email check does, how they work together, and what they cannot stop. Based on the standards.
  • Double extortion Double extortion is a ransomware tactic: attackers encrypt files, steal data and threaten to publish it. Learn how it works and what CISA advises.
  • Doxing Doxing is the malicious publication of a person's private information. See how attackers gather data and what people and companies can do about it.
  • Email spoofing What is email spoofing? A forged sender makes a message look trusted. Learn how to spot it, how DMARC helps and how it differs from lookalike domains.
  • Endpoint detection and response (EDR) EDR watches laptops and servers for suspicious activity and helps teams respond. Learn how it works, where it falls short and how it differs from a SIEM.
  • Exploit kit An exploit kit scans a visitor's browser for weaknesses and delivers exploit code. Learn how it works, why it matters and how to reduce the risk.
  • Exploit Prediction Scoring System (EPSS) EPSS estimates how likely a published vulnerability is to be exploited in the next 30 days. Learn how scores work and how EPSS differs from CVSS.
  • Exposure management Exposure management is the ongoing work of finding where an organization is open to risk and reducing it. Plain definition using NIST and CISA wording.
  • External attack surface management (EASM) External attack surface management (EASM) finds your internet-facing assets from outside. See how it works and how it differs from vulnerability scanning.
  • False positive A false positive is an alert that wrongly flags harmless activity as malicious. Learn what causes it, why it matters and how teams reduce it.
  • Generative AI Generative AI creates new text, images and audio. See the NIST definition, the OWASP Top 10 risks for LLM apps and the NCSC view on prompt injection.
  • GSS-TSIG GSS-TSIG signs DNS messages with Kerberos keys. Learn what it is, where it is used and how to check whether your BIND server uses it.
  • Hacktivism Hacktivism is hacking done for a political or social cause. Learn what hacktivists do, how DDoS attacks fit in, and how organisations can reduce the risk.
  • Human intelligence (HUMINT) HUMINT means intelligence from human sources. Learn how it differs from OSINT, how threat intelligence teams use it and what risks to manage.
  • Immutable backup An immutable backup cannot be changed or deleted once written. Learn how it works, why ransomware targets backups and what CISA advises on backups.
  • Incident response plan What an incident response plan is, what it covers, and how teams prepare, contain and learn from incidents, using NIST and CISA guidance in short.
  • Indicator of compromise (IoC) Indicator of compromise (IoC) explained: what counts as one, how teams use IoCs, their limits, and how to handle a match without jumping to conclusions.
  • Infostealer An infostealer is malware that copies saved passwords and session cookies. Learn how it works, why it matters and how to reduce the risk.
  • Initial access Initial access is the first step where an attacker gets into a network. See MITRE ATT&CK tactic TA0001, common entry techniques and how to reduce the risk.
  • Initial access broker An initial access broker sells entry to company networks. See how brokers get in, how buyers such as ransomware groups use it, and how to reduce the risk.
  • Insider threat An insider threat is the potential for someone with authorized access to harm an organization. See what CISA and NIST say and how mitigation works.
  • Kerberoasting Kerberoasting explained: how attackers crack Active Directory service account tickets offline, why it matters and the MITRE ATT&CK mitigations that help.
  • Known Exploited Vulnerabilities (KEV) catalog The CISA KEV catalog lists vulnerabilities attackers already use. See how entries are added, what the due dates mean and how to use the catalog.
  • Lateral movement Lateral movement is how an attacker moves from one system to others inside a network. Learn how it works, common techniques and how to reduce it.
  • Law enforcement takedown A law enforcement takedown seizes servers and domains that criminals use. See how a real multinational operation worked and what it means for defenders.
  • Leaked credentials Leaked credentials are logins exposed outside their owner's control. Learn how they leak, how they get reused, and how to lower the risk to accounts.
  • Least privilege Least privilege gives users and systems only the access they need. Learn what it means, how to apply it and how to spot access that has crept up.
  • Living off the land (LOTL) Living off the land (LOTL) means attackers use legitimate tools already on a system, not custom malware. Learn why it is hard to spot and how to cut risk.
  • Lookalike domain A lookalike domain imitates a real web address with small changes. Learn how MITRE and CISA describe them, why they fool people and how to detect them.
  • Malicious package A malicious package is software shared through a trusted registry that carries harmful code. Learn how it works, why it matters and how to reduce the risk.
  • Malvertising Malvertising uses malicious or hijacked online ads to spread malware or steal logins. Learn how it works, an FBI example, and CISA and NCSC advice.
  • Malware
  • Malware loader A malware loader is a program that delivers other malware onto a computer. Learn what it is, how it works, why it matters and how to reduce the risk.
  • Malware-as-a-service (MaaS) Malware-as-a-service (MaaS) explained: how criminals sell or rent malware, how it links to ransomware, and how organisations can reduce the risk.
  • Mercenary spyware Mercenary spyware explained: what commercial spyware takes from a device, how zero-click and ad-based delivery work, and how to protect high-risk staff.
  • MFA fatigue MFA fatigue floods a user with approval prompts until one is accepted. Learn how the attack works, why it matters and how to reduce the risk.
  • MITRE ATT&CK MITRE ATT&CK is an open knowledge base of adversary tactics and techniques. Learn what tactics and techniques mean and how the matrices are organised.
  • Multi-factor authentication (MFA) Multi-factor authentication asks for two or more kinds of proof to log in. Learn the three factors, how attackers bypass MFA, and how to make it stronger.
  • Network segmentation Network segmentation splits a network into separate zones so an intruder cannot move freely. Learn how it works, why CISA backs it and how to improve it.
  • NIS2 Directive What the NIS2 Directive (EU) 2022/2555 is, who adopted it, which essential and important entities it covers and what it broadly asks for, from EU sources.
  • Non-human identity Non-human identity explained: service accounts, API keys and tokens, how NIST and OWASP describe them, and the ten risks OWASP lists for them.
  • Obfuscation Obfuscation makes code, files or data hard to read or analyze. Learn how attackers use encoding and encryption to hide content and how defenders respond.
  • Open-source intelligence (OSINT) Open-source intelligence (OSINT) is information gathered from public sources. Learn how attackers use it for reconnaissance and how to reduce exposure.
  • Passkeys Passkeys replace passwords with a key pair approved by a fingerprint or PIN. See how they work and why CISA and the NCSC call them phishing-resistant.
  • Password manager A password manager creates, stores and fills in passwords for you. Learn how it works, and what CISA, NCSC and NIST say, and how to protect it.
  • Password spraying Password spraying tries a few common passwords across many accounts to avoid lockouts. Learn how it works, how to spot it and how to cut the risk.
  • Paste sites (Pastebin) What is Pastebin and why do attackers use paste sites? Learn how breaches show up in pastes, how monitoring works and what to do when you are found.
  • Patch management Patch management is the process of identifying, prioritizing, installing and verifying patches across an organization. Learn the steps and why it matters.
  • PCI DSS What PCI DSS (Payment Card Industry Data Security Standard) is, who issues it, who it applies to and what it broadly asks for, from official PCI SSC pages.
  • Penetration testing Penetration testing means mimicking real attacks to find ways around security features. Learn how a test works, its common phases and what NIST says.
  • Persistence Persistence is how an attacker keeps access after the first break-in, even across restarts and password changes. Learn how it works and how to spot it.
  • Phishing Phishing explained: how fake messages trick people into giving up passwords, money or access, the main forms, warning signs and layers of defence.
  • Phishing kit A phishing kit is a ready-made bundle of fake pages, emails and scripts that lets criminals run phishing scams. Learn how kits work and how to spot them.
  • Phishing takedown A phishing takedown gets a fake website removed or blocked. Learn the steps, who can act, why evidence matters and how takedown differs from monitoring.
  • Phishing-as-a-service (PhaaS) Phishing-as-a-service (PhaaS) explained in plain English: how criminals rent ready-made phishing kits, and what the FBI and ENISA say about it.
  • Privilege escalation Privilege escalation is when an attacker gains higher permissions, such as admin or root. See MITRE ATT&CK TA0004, common techniques and how to reduce it.
  • Proof-of-concept exploit A proof-of-concept exploit is code that shows a vulnerability can be exploited. Learn how it is used, why public PoC raises risk and how to respond.
  • Ransomware Ransomware encrypts files and demands payment. Learn how attacks work, common ways in, the threat to leak data, and the defences CISA recommends.
  • Ransomware-as-a-service (RaaS) Ransomware-as-a-service lets a core group supply ransomware while affiliates run the attacks. Learn how RaaS works and how to reduce the risk.
  • Reconnaissance Reconnaissance is the stage where attackers gather information to plan later operations. Learn how it works, why it matters and how to spot it.
  • Remote access trojan (RAT) A remote access trojan (RAT) lets an attacker control a computer from afar. Learn what it is, how it works, why it matters and how to spot one.
  • Remote code execution (RCE) Remote code execution (RCE) lets an attacker run code on a system from afar. Learn how it works, what it can do, and how to reduce the risk.
  • Remote Desktop Protocol (RDP) Remote Desktop Protocol (RDP) lets users control another Windows computer. Learn how attackers misuse it with valid credentials and how to reduce the risk.
  • Sandbox A sandbox is a restricted environment where untrusted software runs with limited permissions. Learn how it works and how attackers try to detect it.
  • Security awareness training Security awareness training teaches people to spot threats such as phishing messages. Learn what a program covers and how NIST and CISA describe it.
  • Security information and event management (SIEM) SIEM explained in plain English: what security information and event management is, how it centralizes logs, and why teams use it, based on NIST and CISA.
  • Security misconfiguration Security misconfiguration is an unsafe setup of systems, apps or cloud services. Learn common examples, why it matters and how to harden against it.
  • Security operations center (SOC) A security operations center (SOC) is the team that monitors an organization's systems, finds cyber incidents and responds. See what a SOC does.
  • Security orchestration, automation and response (SOAR) SOAR automates parts of incident response. Learn what security orchestration, automation and response means, what NIST says, and how it fits with a SIEM.
  • Service principal A service principal is the identity an app uses in a Microsoft Entra tenant. How it signs in, what it can access, and why stolen secrets are risky.
  • Session cookie Learn what a session cookie is, how session hijacking and cookie theft work, and which OWASP controls help websites reduce the risk, in plain English.
  • Session hijacking Session hijacking takes over a logged-in session by stealing the session token. Learn how it works, why it matters and ways to detect and reduce it.
  • Shadow AI Shadow AI is staff using AI tools without approval. See what the NCSC says about it, the data risks it creates and how organisations can respond.
  • Shadow IT Shadow IT means devices, services and tools used for work without the organisation knowing. Learn why it happens, why it is risky and how to find it.
  • SIM swapping SIM swapping is when a criminal gets a carrier to move your phone number to their own SIM card. See how it works, the warning signs and how to lower…
  • Sinkhole A sinkhole redirects malicious network traffic to a harmless destination. Learn how researchers and law enforcement use it against botnets today.
  • Smishing Smishing is phishing by text message. Learn what CISA and NCSC say about it, how fake links work, and simple steps to spot and report suspicious texts.
  • SMS bombing SMS bombing floods a phone number with text messages, often by abusing one-time code features. Learn how it works and how to rate limit it.
  • Social engineering Social engineering tricks people into sharing information or access. Learn how it works, common forms such as phishing, and how to reduce the risk.
  • Software bill of materials (SBOM) An SBOM is a nested inventory of the components that make up software. Learn what it holds, how it works and how it helps manage supply chain risk.
  • Spear phishing Spear phishing is phishing aimed at a chosen target. Learn how attachment and link attacks work, how they differ from phishing, and how to reduce risk.
  • SQL injection SQL injection explained in plain English: how the attack works, what it can expose, and the defences OWASP recommends, such as parameterized queries.
  • Stealer logs Stealer logs are data bundles copied from infected devices by information-stealing malware. Learn what they hold, how they are detected and how to respond.
  • STIX and TAXII What are STIX and TAXII? STIX describes threat intelligence in a shared format and TAXII transports it over HTTPS. Learn the difference and the parts.
  • Supply chain attack A supply chain attack hits a target through the products or services it relies on. See the NIST and MITRE definitions, how it works and how to reduce risk.
  • Tactics, techniques and procedures (TTPs) TTPs describe how an attacker behaves, from broad goals to specific actions. Learn the three levels as NIST and MITRE ATT&CK define them, with examples.
  • Third-party risk Third-party risk is the chance a vendor or supplier harms your security. Learn how it works, what CISA, NIST and ENISA say, and how to reduce it.
  • Third-party risk management (TPRM) Third-party risk management (TPRM) finds, checks and monitors vendor risk. See the steps, the rules in the EU, APAC and US, and how it differs.
  • Threat actor A threat actor is an individual or group that poses a threat. Learn how NIST and MITRE describe threat actors, how they are named and why it matters.
  • Threat attribution Threat attribution links an attack to the group believed behind it. See how CISA and MITRE describe group names, overlaps and why it is a judgement.
  • Threat feed A threat feed is a stream of threat indicators from an outside source. Learn how feeds work, why quality matters and how they differ from intelligence.
  • Threat hunting Threat hunting is the proactive search for attackers in a network. Learn how it works, what hunters look for and how it differs from waiting for alerts.
  • Threat intelligence Threat intelligence explained in plain English: what it is, how the intelligence cycle works, its three levels, and how a team can put it to use.
  • Threat intelligence platform (TIP) A threat intelligence platform collects and shares cyber threat information in one place. Learn how it works, what STIX and TAXII are, and how it differs.
  • Threat modeling Threat modeling analyzes a system to find what could go wrong. See the four key questions from OWASP and the Threat Modeling Manifesto, and the NIST view.
  • Tor network Learn what the Tor network is, how onion routing and onion services work, who uses Tor, and why security teams watch for it. Plain-English definition.
  • Traffic Light Protocol (TLP) TLP explained: what TLP:RED, TLP:AMBER, TLP:GREEN and TLP:CLEAR mean, how far each label lets you share threat intelligence, and how to apply them.
  • Trojan A Trojan is a program that looks useful but hides a malicious function. Learn what it is, how it works, why it matters and how to lower the risk.
  • Typosquatting Typosquatting is registering look-alike domains to trick people. Learn how it works, common patterns, why it matters and how to detect and reduce it.
  • Underground forum An underground forum is an online community where cybercriminals trade tools and services and share skills. Learn how they work and how defenders use them.
  • Vishing (voice phishing) Vishing is voice phishing: scam phone calls that trick people into sharing data or access. Learn how it works and how to reduce your risk today.
  • Vulnerability intelligence Vulnerability intelligence adds context such as exploitation and EPSS to scan results, so you fix the weaknesses that matter most first.
  • Vulnerability management Vulnerability management is the ongoing work of finding, reporting and fixing weaknesses. Learn the phases and how it differs from patching.
  • Vulnerability prioritization Vulnerability prioritization decides which flaws to fix first. See how CVSS, EPSS, the KEV catalog and SSVC work together and why severity is not enough.
  • Web shell A web shell is a script on a web server that lets an attacker run commands remotely. Learn how it works, what MITRE says and how to spot and reduce…
  • Wiper malware Wiper malware destroys data or disks to disrupt availability. Learn how it works, how MITRE describes it, and which backup and access controls can help.
  • YARA and Sigma rules YARA rules match patterns in files, Sigma rules match events in logs. Learn how each format works, how Sigma converts to SIEM queries and when to use them.
  • Zero trust Zero trust gives no implicit trust based on network location. See how NIST and CISA describe it and how it differs from a zero trust architecture.
  • Zero-day vulnerability A zero-day vulnerability is a flaw its maker does not know about yet. See how it differs from n-day and KEV flaws, with real cases from October 2026.

How to defend 19