Glossary
Cybersecurity glossary
Plain-language definitions of the terms that come up in security assessments, managed security, and compliance, each with a link to authoritative guidance.
Offensive Security
Attack Surface Management
Attack surface management is the continuous discovery, inventory, and monitoring of an organization's internet-facing assets and the exposures they present. It matters because unknown or forgotten assets, such as shadow IT and stale subdomains, are frequent entry points for attackers.
Penetration Testing
Penetration testing is an authorized, simulated attack against a system, network, or application to identify and safely exploit security weaknesses. It matters because it validates whether vulnerabilities are actually exploitable and demonstrates real business impact, going beyond a list of theoretical flaws.
Phishing
Phishing is a form of social engineering in which attackers send fraudulent messages, often email, that appear to come from a trusted source to trick recipients into revealing credentials, clicking malicious links, or opening harmful attachments. It matters because phishing remains one of the most common initial access methods in real-world breaches.
Red Teaming
Red teaming is a goal-oriented adversarial exercise where security professionals emulate the tactics, techniques, and procedures of real threat actors to test an organization's detection and response capabilities. Unlike a standard penetration test, it is scenario driven and often stealthy, measuring how well people, processes, and technology withstand a determined attacker.
Secure Code Review
Secure code review is the systematic examination of application source code, using manual analysis and automated tools, to find security flaws before software is deployed. It matters because catching vulnerabilities such as injection or broken access control early in development is far cheaper and safer than fixing them in production.
Social Engineering
Social engineering is the manipulation of people into divulging confidential information or performing actions that compromise security, exploiting human trust rather than technical flaws. It matters because even strong technical controls can be bypassed when an attacker convinces an employee to grant access or reveal credentials.
Vulnerability Assessment
A vulnerability assessment is a systematic review that identifies, quantifies, and prioritizes security weaknesses in systems and software, typically using automated scanning combined with expert validation. It matters because it gives organizations a prioritized view of exposure so they can remediate the most critical issues first.
Managed Security
Endpoint Detection and Response
Endpoint detection and response is a security technology that continuously records endpoint activity and analyzes it to detect, investigate, and respond to suspicious behavior on devices such as laptops and servers. It matters because endpoints are common targets, and EDR provides the visibility needed to catch attacks that bypass preventive controls.
Extended Detection and Response
Extended detection and response is an approach that correlates security telemetry across multiple layers, such as endpoints, network, email, and cloud, into a unified detection and response platform. It matters because attacks often span several domains, and combining signals reduces blind spots and speeds investigation.
Incident Response
Incident response is the organized process of preparing for, detecting, containing, eradicating, and recovering from cybersecurity incidents, and digital forensics is the discipline of collecting and analyzing evidence to understand what happened. Together, DFIR matters because a structured response limits damage, preserves evidence, and speeds recovery after an attack.
Managed Detection and Response
Managed detection and response is a service that combines technology and human expertise to monitor an organization's environment, detect threats, and respond on the customer's behalf. It matters because many organizations lack the staff or tooling to run continuous detection and response in-house, and MDR provides that capability as a service.
Security Information and Event Management
Security information and event management is technology that aggregates, normalizes, and correlates log and event data from across an environment to support monitoring, alerting, and investigation. It matters because it gives security teams a central place to detect patterns and meet compliance logging requirements.
Security Operations Center
A security operations center is a centralized function where people, processes, and technology continuously monitor, detect, analyze, and respond to cybersecurity events. It matters because around-the-clock visibility and coordinated response shorten the time attackers can operate undetected.
Threat Intelligence
Threat intelligence is evidence-based knowledge about existing or emerging threats, including attacker context, indicators, and recommended actions, used to inform defensive decisions. It matters because it helps organizations anticipate and prioritize risks rather than react only after an incident occurs.
Governance & Compliance
Governance, Risk, and Compliance
Governance, risk, and compliance is an integrated approach that aligns security strategy and controls with business objectives, manages risk, and ensures adherence to laws, regulations, and standards. It matters because it turns scattered security and compliance efforts into a coordinated, accountable program.
Risk Assessment
A risk assessment is the process of identifying threats and vulnerabilities, and evaluating the likelihood and potential impact of adverse events on an organization's assets and operations. It matters because it provides the basis for prioritizing security investments and making informed, risk-based decisions.
Third-Party Risk Management
Third-party risk management is the practice of identifying, assessing, and mitigating the security and compliance risks introduced by vendors, suppliers, and other external partners. It matters because organizations are increasingly breached through their supply chain, making a partner's weaknesses the organization's exposure.
Virtual Chief Information Security Officer
A virtual chief information security officer is an experienced security leader engaged on a fractional or outsourced basis to provide executive-level strategy, governance, and program oversight. It matters because many organizations need senior security leadership and direction without the cost of a full-time executive hire.
Identity & Access
AI Security
LLM Security
LLM security is the practice of identifying and mitigating risks specific to applications that use large language models, including prompt injection, insecure output handling, sensitive information disclosure, and supply chain issues. It matters because AI features introduce new attack surfaces that traditional application security testing does not fully cover.
Prompt Injection
Prompt injection is an attack against applications built on large language models in which crafted input manipulates the model into ignoring its intended instructions or performing unintended actions. It matters because it can lead to data leakage, unauthorized actions, or bypassed safety controls in AI-powered features.