Plain-language definitions of 30+ cybersecurity terms and acronyms.
Plain-language definitions of cybersecurity terms for business leaders, IT directors, and anyone evaluating security services. No prerequisite knowledge required.
A sophisticated attacker (often state-sponsored) who gains access to a network and remains undetected for an extended period, gradually exfiltrating data or maintaining access for future use. APTs target specific organizations and use custom tools and techniques.
The defensive security team responsible for detecting, preventing, and responding to attacks. Blue team activities include monitoring security alerts, managing firewalls, investigating incidents, and improving security controls.
A structured set of guidelines and requirements that organizations follow to meet regulatory, legal, or industry obligations. Examples include PCI DSS, HIPAA, SOC 2, ISO 27001, and NIST CSF. Each framework specifies controls that must be implemented and verified.
A standardized naming system for publicly known security vulnerabilities. Each CVE is assigned a unique identifier (like CVE-2024-1234) that allows security professionals to reference the same vulnerability consistently across different tools and databases.
A numerical scoring system (0.0 to 10.0) that rates the severity of security vulnerabilities. Scores of 9.0 to 10.0 are Critical, 7.0 to 8.9 are High, 4.0 to 6.9 are Medium, and 0.1 to 3.9 are Low. Used by pen testers to prioritize findings.
Technologies and policies that prevent sensitive data from leaving your organization through unauthorized channels. DLP systems monitor email, file transfers, cloud storage, and endpoint devices to detect and block the transmission of confidential information.
Security software installed on individual computers and servers that continuously monitors for suspicious activity, detects threats, and enables rapid investigation and response. Think of it as antivirus evolved for modern threats. Examples include CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint.
The process of converting readable data into an unreadable format that can only be decoded with a specific key. Encryption protects data both at rest (stored on disk) and in transit (moving across networks). Common standards include AES-256 for data at rest and TLS 1.3 for data in transit.
A piece of code, technique, or sequence of commands that takes advantage of a vulnerability to cause unintended behavior. An exploit turns a theoretical weakness into a practical attack. Not all vulnerabilities have known exploits, and those that do are higher priority to fix.
A network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined rules. Firewalls create a barrier between trusted internal networks and untrusted external networks. Modern firewalls (next-gen or NGFW) can also inspect traffic content and application behavior.
The systems, policies, and processes that manage who can access what resources in your organization. IAM encompasses user accounts, authentication (proving who you are), authorization (what you can do), and access governance (reviewing and revoking access over time).
Network security tools that monitor traffic for suspicious patterns. An IDS alerts when it detects potential attacks. An IPS goes further and automatically blocks malicious traffic. Often deployed at network perimeters and between internal network segments.
The technique attackers use to move from one compromised system to others within your network after gaining initial access. Attackers exploit trust relationships, shared credentials, and network connectivity to reach higher-value targets like domain controllers or database servers.
A security method that requires users to provide two or more verification factors to access a system. Typically combines something you know (password), something you have (phone or hardware key), and sometimes something you are (fingerprint). MFA blocks the vast majority of automated attacks even when passwords are compromised.
A nonprofit organization that produces widely referenced security guidance for web applications. Their OWASP Top 10 list of the most critical web application security risks is the standard reference for web app testing and is updated every few years.
The process of identifying, testing, and deploying software updates that fix known vulnerabilities. Effective patch management requires tracking which systems need updates, testing patches before deployment, and verifying successful installation. Unpatched systems are one of the most common attack vectors.
A controlled, authorized attack against your systems performed by security professionals to identify vulnerabilities before real attackers do. Unlike vulnerability scanning, pen testing involves manual exploitation attempts and tests how vulnerabilities can be chained together. The goal is to demonstrate real business risk, not just list theoretical issues.
A social engineering attack where attackers send fraudulent emails, texts, or messages that appear to come from a trusted source. The goal is to trick recipients into clicking malicious links, downloading malware, or revealing credentials. Spear phishing targets specific individuals with personalized messages. Phishing is the initial access vector in the majority of successful breaches.
The act of exploiting a vulnerability or misconfiguration to gain higher-level permissions than originally granted. Local privilege escalation goes from normal user to administrator on one system. Domain privilege escalation goes from a standard user account to domain administrator across the network.
A collaborative exercise where red team (attackers) and blue team (defenders) work together in real time. The red team executes attack techniques while the blue team attempts to detect and respond. The goal is to improve detection capabilities and response processes through iterative testing.
Malicious software that encrypts your files and demands payment for the decryption key. Modern ransomware operations also steal data before encrypting it, threatening to publish sensitive information if payment is not made (double extortion). Ransomware is typically delivered through phishing emails, exploited vulnerabilities, or compromised credentials.
A vulnerability that allows an attacker to run arbitrary commands on a target system from a remote location without physical access. RCE vulnerabilities are among the most severe because they give attackers direct control over the affected system. They are almost always rated Critical.
An authorized group of security professionals who simulate real-world attacks against your organization using the same tactics, techniques, and procedures as actual threat actors. Unlike pen testing (which is typically scoped to specific systems), red team engagements test your entire security program including people, processes, and technology.
A platform that collects, correlates, and analyzes log data from across your entire IT environment to detect security threats. SIEMs aggregate logs from firewalls, servers, endpoints, applications, and cloud services, then use rules and analytics to identify suspicious patterns. Examples include Splunk, Microsoft Sentinel, and Elastic Security.
A team (either internal or outsourced) that monitors your security systems 24/7, investigates alerts, and responds to incidents. A SOC typically uses a SIEM, EDR, and other tools to maintain visibility. Outsourced SOCs (called MDR or Managed Detection and Response) are common for organizations that cannot staff 24/7 monitoring internally.
The manipulation of people into performing actions or divulging confidential information. Attackers exploit human psychology (urgency, authority, curiosity, fear) rather than technical vulnerabilities. Social engineering includes phishing, vishing (voice calls), pretexting, tailgating, and baiting.
A fractional or outsourced security executive who provides strategic leadership and program management on a part-time basis. A vCISO helps organizations build security programs, manage compliance, respond to board questions, and make risk decisions without the cost of a full-time CISO (which typically commands $200,000 to $400,000+ annually).
A weakness in a system, application, or process that could be exploited by an attacker to gain unauthorized access or cause harm. Vulnerabilities can exist in software code, system configurations, network architecture, or human processes. Not all vulnerabilities are equally dangerous. Risk depends on exploitability, impact, and exposure.
A security tool that monitors and filters HTTP/HTTPS traffic to and from a web application. A WAF protects against common web attacks like SQL injection, cross-site scripting (XSS), and request forgery by analyzing request patterns and blocking malicious traffic before it reaches your application.
A vulnerability that is unknown to the software vendor and has no available patch. Zero-day vulnerabilities are extremely valuable to attackers because there is no fix available. The term comes from the vendor having "zero days" of awareness before the vulnerability is exploited. Zero-day exploits are rare in most pen test findings but common in nation-state attacks.