Cybersecurity Glossary

A

APT

Advanced Persistent Threat (APT) refers to a prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period. APT actors are typically nation-state groups or sophisticated criminal organizations. Their goal is usually data theft, espionage, or sabotage rather than quick financial gain.

Attack Surface

The attack surface is the total sum of all points where an unauthorized user can try to enter or extract data from a system or network. A larger attack surface means more potential vulnerabilities for adversaries to exploit. Reducing the attack surface is a core principle of security hardening.

Authentication

Authentication is the process of verifying the identity of a user, device, or system before granting access. Common methods include passwords, biometrics, and hardware tokens. Strong authentication mechanisms, especially multi-factor authentication, significantly reduce the risk of unauthorized access.

B

Backdoor

A backdoor is a covert method of bypassing normal authentication or encryption in a computer system or product. Backdoors may be installed intentionally by vendors for maintenance or maliciously by attackers after a compromise. They allow persistent access that can be difficult to detect.

Black Hat

A black hat hacker is a malicious actor who exploits computer systems or networks without authorization for personal gain, espionage, or disruption. The term contrasts with white hat (ethical) hackers who use the same skills defensively. Black hat activities are illegal in most jurisdictions.

Blue Team

The blue team is the defensive security team responsible for protecting an organization's systems against cyberattacks. They monitor networks, respond to incidents, and implement security controls. Blue teams work in contrast to red teams, which simulate offensive attacks.

Botnet

A botnet is a network of internet-connected devices infected with malware and controlled remotely by a threat actor. Botnets are commonly used to launch distributed denial-of-service (DDoS) attacks, send spam, or distribute additional malware. Individual infected devices in the botnet are called bots or zombies.

Breach

A data breach is an incident in which sensitive, protected, or confidential data is accessed, disclosed, or stolen without authorization. Breaches can result from external attacks, insider threats, or misconfigured systems. They may trigger regulatory notification requirements and significant financial penalties.

Brute Force

A brute force attack is a trial-and-error method used to decode encrypted data by systematically trying every possible combination of passwords or keys. Modern brute force attacks leverage automation and specialized hardware to test billions of combinations per second. Strong, complex passwords and account lockout policies mitigate this risk.

Bug Bounty

A bug bounty program incentivizes independent security researchers to discover and responsibly disclose vulnerabilities in exchange for financial rewards. Organizations ranging from tech giants to governments run these programs to supplement internal security testing. They represent a cost-effective way to identify flaws before malicious actors do.

BYOD

Bring Your Own Device (BYOD) is a policy that allows employees to use their personal devices for work purposes. While BYOD increases flexibility and productivity, it introduces security risks because personal devices may lack corporate security controls. Organizations typically address this with mobile device management (MDM) solutions and strict access policies.

C

C2 (Command and Control)

Command and Control (C2) infrastructure refers to the servers and channels used by threat actors to communicate with compromised systems. Attackers use C2 channels to issue instructions, exfiltrate data, and deploy additional payloads to infected machines. Disrupting C2 communications is a key defensive goal during incident response.

CIA Triad

The CIA Triad is the foundational model for information security, representing Confidentiality, Integrity, and Availability. Confidentiality ensures data is only accessible to authorized parties; integrity ensures data accuracy and trustworthiness; availability ensures systems are accessible when needed. All security decisions should be evaluated against this framework.

CISO

The Chief Information Security Officer (CISO) is the senior executive responsible for an organization's information security strategy, governance, and risk management. CISOs balance technical security requirements with business objectives and regulatory compliance. The role has become increasingly prominent as cyber risk is recognized as a top business concern.

Cloud Security

Cloud security encompasses the technologies, policies, and controls designed to protect data, applications, and infrastructure hosted in cloud environments. Unique challenges include shared responsibility models, misconfiguration risks, and identity sprawl across cloud services. Leading cloud security solutions address posture management, workload protection, and data governance.

CVE

Common Vulnerabilities and Exposures (CVE) is a publicly maintained list of known cybersecurity vulnerabilities, each assigned a unique identifier. CVE entries enable security teams and vendors to coordinate patching and communicate clearly about specific vulnerabilities. The CVE system is maintained by MITRE and sponsored by the US government.

Cyber Espionage

Cyber espionage involves the use of digital techniques to covertly access confidential information from governments, corporations, or individuals for political, economic, or military advantage. It is predominantly conducted by nation-state actors or groups acting on their behalf. Targets typically include defense contractors, research institutions, and government agencies.

Cyber Hygiene

Cyber hygiene refers to the routine practices and habits that individuals and organizations adopt to maintain system health and security. Core practices include applying patches promptly, using strong unique passwords, enabling MFA, and regularly backing up data. Good cyber hygiene significantly reduces exposure to the most common attack vectors.

Cyberwarfare

Cyberwarfare involves the use of digital attacks by nation-states or state-sponsored groups to disrupt, damage, or destroy the critical infrastructure or capabilities of an adversary. Operations can target power grids, financial systems, military networks, and communications infrastructure. The line between cyberwarfare and espionage is often deliberately blurred by threat actors.

D

Dark Web

The dark web refers to encrypted online content not indexed by conventional search engines, accessible only through specialized anonymizing browsers such as Tor. It hosts both legitimate privacy-focused services and illicit marketplaces where stolen credentials, ransomware kits, and other criminal services are bought and sold. It is a key venue for cybercriminal commerce.

Data Exfiltration

Data exfiltration is the unauthorized transfer of data from an organization's systems to an external destination controlled by an attacker. It is often the primary goal of intrusion operations and may occur via encrypted channels to evade detection. Double extortion ransomware attacks combine file encryption with threatened public release of exfiltrated data.

DDoS

A Distributed Denial of Service (DDoS) attack overwhelms a target's network, service, or website with traffic from multiple sources — typically a botnet — rendering it unavailable to legitimate users. Volumetric, protocol, and application-layer variants target different parts of infrastructure. DDoS attacks are used for extortion, hacktivism, or as a diversion for simultaneous intrusion.

Defense in Depth

Defense in depth is a security strategy that employs multiple layers of controls so that if one layer fails, others continue to provide protection. The approach draws on a military concept of using multiple redundant defensive lines. In practice it combines perimeter controls, network segmentation, endpoint security, identity controls, and monitoring.

Digital Forensics

Digital forensics is the scientific process of collecting, preserving, analyzing, and presenting digital evidence from computers, networks, and other devices in a legally admissible manner. It is used in criminal investigations, corporate litigation, and post-incident analysis. Proper chain-of-custody handling is essential to ensure evidence integrity.

Double Extortion

Double extortion is a ransomware tactic in which attackers both encrypt victim files and exfiltrate sensitive data before demanding payment. If the ransom is refused, attackers threaten to publicly release the stolen data on leak sites. This approach increases pressure on victims and eliminates the option of simply restoring from backups.

Doxing

Doxing (or doxxing) is the malicious practice of researching and publicly exposing private information about a person, such as their home address, employer, or personal contacts, without consent. It is used as a tool for harassment, intimidation, or to incite others to target the victim. Doxing can have severe real-world consequences for targets.

E

EDR

Endpoint Detection and Response (EDR) is a category of security solutions that continuously monitor endpoint devices to detect, investigate, and respond to advanced threats. EDR tools collect telemetry from endpoints, apply behavioral analytics, and enable rapid containment of threats. They have largely superseded traditional antivirus as the endpoint security standard for enterprises.

Encryption

Encryption is the process of converting data into an unreadable format using cryptographic algorithms so that only authorized parties with the correct key can decrypt and access it. It protects data in transit over networks and data at rest on storage media. Both symmetric and asymmetric encryption play critical roles in modern security architectures.

Endpoint Security

Endpoint security is the practice of securing end-user devices such as desktops, laptops, and mobile devices against cyber threats. Modern endpoint security platforms combine antivirus, EDR, application control, and behavioral analytics into unified agents. As the perimeter has dissolved, endpoint security has become the primary defensive frontier.

Exploit

An exploit is a piece of software, a set of commands, or a sequence of data that takes advantage of a vulnerability in a system to cause unintended behavior. Exploits can achieve outcomes such as privilege escalation, remote code execution, or data theft. Zero-day exploits target vulnerabilities unknown to the vendor and are highly valuable on criminal markets.

F

Fileless Malware

Fileless malware is a type of malicious software that operates entirely in memory without writing files to disk, making it difficult for traditional signature-based security tools to detect. It typically leverages legitimate system tools such as PowerShell or WMI to carry out its objectives. Detection requires behavioral analytics rather than file scanning.

Firewall

A firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predefined security rules. Modern next-generation firewalls (NGFWs) add deep packet inspection, application awareness, and intrusion prevention capabilities. Firewalls form a foundational element of network perimeter defense.

H

Hacktivism

Hacktivism is the use of hacking techniques to promote political agendas, social causes, or ideological messages. Hacktivist groups such as Anonymous have targeted government agencies, corporations, and religious organizations through website defacements, DDoS attacks, and data leaks. The line between hacktivism and state-sponsored operations is increasingly blurred.

I

IAB (Initial Access Broker)

Initial Access Brokers (IABs) are cybercriminals who specialize in compromising networks and then selling that access to other threat actors, including ransomware operators. They operate in a specialized division-of-labor ecosystem within the criminal underground. IABs have significantly lowered the barrier to entry for ransomware attacks.

IAM

Identity and Access Management (IAM) is the framework of policies and technologies that ensures the right users have the appropriate access to technology resources. It encompasses authentication, authorization, role-based access control, and lifecycle management for user identities. Robust IAM is foundational to zero trust security architectures.

IDS/IPS

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are security tools that monitor network or system activity for malicious behavior. An IDS alerts on suspicious activity while an IPS can also actively block threats in real time. Modern deployments often integrate IDS/IPS capabilities into next-generation firewalls or SIEM platforms.

Incident Response

Incident response (IR) is an organized approach to addressing and managing the aftermath of a security breach or cyberattack. A formal IR plan defines the process for detecting, containing, eradicating, and recovering from incidents. Effective IR minimizes damage, reduces recovery time, and preserves evidence for forensic analysis.

Indicators of Compromise (IoC)

Indicators of Compromise (IoCs) are artifacts or evidence found on a network or endpoint that indicate a likely security breach or intrusion. Examples include suspicious IP addresses, file hashes, domain names, and registry keys associated with known malware. Sharing IoCs through threat intelligence platforms helps organizations detect and block known threats.

Insider Threat

An insider threat is a security risk that originates from within the organization, such as employees, contractors, or business partners who have authorized access to systems. Insider threats may be malicious (deliberate data theft or sabotage) or negligent (accidental exposure). They are among the most difficult threats to detect because perpetrators have legitimate access.

K

Kill Chain

The Cyber Kill Chain is a framework developed by Lockheed Martin describing the stages of a cyberattack: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. It helps defenders understand attacker behavior and identify opportunities to detect and disrupt attacks. The MITRE ATT&CK framework extends this concept with more granular tactics.

L

Lateral Movement

Lateral movement refers to techniques attackers use to progressively move through a network in search of key assets and data after gaining an initial foothold. Methods include pass-the-hash, remote service exploitation, and abuse of legitimate administrative tools. Detecting lateral movement is critical to limiting the blast radius of a breach.

Living off the Land (LotL)

Living off the Land (LotL) is an attack technique in which adversaries use legitimate, pre-existing tools and features of the target operating system — such as PowerShell, WMI, or certutil — to conduct malicious activities. Because these are authorized system tools, LotL attacks are harder to detect with signature-based defenses. Detection requires behavioral analytics.

M

Malware

Malware is any software intentionally designed to cause disruption, damage, or unauthorized access to computer systems. It encompasses viruses, worms, trojans, ransomware, spyware, and adware. The malware ecosystem is highly commercialized, with criminal groups offering Malware-as-a-Service products on dark web forums.

MFA

Multi-Factor Authentication (MFA) requires users to provide two or more verification factors to gain access to a resource — typically something they know (password), something they have (token), and something they are (biometric). MFA is one of the single most effective controls for preventing account compromise. Even SMS-based MFA is substantially better than passwords alone.

MITRE ATT&CK

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques derived from real-world observations. It provides a common taxonomy for describing attacker behavior that is used by security teams for threat modeling, detection engineering, and red team planning. The framework is maintained by MITRE Corporation and is free to use.

N

Nation-State Actor

Nation-state actors are government-sponsored or government-directed hacking groups that conduct cyber operations on behalf of their countries. They typically possess advanced capabilities, significant resources, and long-term objectives such as espionage, intellectual property theft, or destructive attacks. Major nation-state actors include groups attributed to Russia, China, Iran, and North Korea.

Network Segmentation

Network segmentation is the practice of dividing a computer network into smaller, isolated subnetworks to limit the spread of threats and reduce the attack surface. Properly segmented networks ensure that a breach in one zone cannot easily propagate to others. Microsegmentation takes this further by applying controls at the individual workload level.

O

OSINT

Open Source Intelligence (OSINT) is the collection and analysis of information gathered from publicly available sources, including websites, social media, public records, and academic publications. It is used by both security professionals for reconnaissance and threat intelligence gathering, and by adversaries for targeting potential victims. OSINT is a foundational skill in penetration testing and threat hunting.

P

Patch Management

Patch management is the systematic process of acquiring, testing, and installing updates to software and firmware to fix vulnerabilities and improve functionality. Unpatched systems are among the most common entry points for attackers. An effective patch management program prioritizes critical patches based on vulnerability severity and business risk.

Penetration Testing

Penetration testing (or pen testing) is an authorized simulated cyberattack on a system, network, or application to identify exploitable vulnerabilities before real attackers do. Pen tests can be black box (no prior knowledge), white box (full knowledge), or gray box (partial knowledge) engagements. Results are documented in reports that guide remediation efforts.

Phishing

Phishing is a social engineering attack in which adversaries send fraudulent communications — typically email — that appear to come from a trusted source to trick victims into revealing credentials, clicking malicious links, or downloading malware. It remains the most common initial access vector for cyberattacks. Spear phishing tailors the attack to a specific individual.

Privilege Escalation

Privilege escalation is an attack technique in which a threat actor gains elevated access to resources beyond those initially granted, moving from a standard user account to administrative or root privileges. Vertical escalation grants higher-level permissions; horizontal escalation gains access to resources of another user at the same level. Attackers use it to expand their reach after initial compromise.

Proxy

In a security context, a proxy server acts as an intermediary between a client and the internet, which can be used for content filtering, anonymization, or traffic inspection. Attackers abuse proxy infrastructure — including residential proxies — to mask their true origin and evade IP-based detection. Threat actors often route their operations through multi-hop proxy chains.

R

RaaS

Ransomware-as-a-Service (RaaS) is a criminal business model in which ransomware developers lease their malware to affiliates in exchange for a percentage of ransom payments. This model has dramatically scaled ransomware operations by enabling technically unsophisticated actors to carry out attacks. Major RaaS operations include LockBit, BlackCat/ALPHV, and Clop.

Ransomware

Ransomware is a type of malicious software that encrypts a victim's files or locks their systems, demanding payment in cryptocurrency in exchange for the decryption key. Modern ransomware groups operate as sophisticated criminal enterprises using a Ransomware-as-a-Service model. Recovery without paying typically requires secure, offline backups and often takes weeks.

Red Team

A red team is a group of security professionals who simulate adversarial attacks against an organization to test the effectiveness of its defenses. Unlike penetration testing, red team engagements are broader, longer, and goal-oriented — designed to test the entire kill chain. Red team findings directly inform blue team defensive improvements.

Remote Code Execution (RCE)

Remote Code Execution (RCE) is a class of vulnerability that allows an attacker to run arbitrary commands or malicious code on a target system over a network without physical access. RCE vulnerabilities are among the most severe, often earning the highest CVSS scores. They frequently serve as the initial exploitation step in a broader attack chain.

Rootkit

A rootkit is a collection of malicious software designed to hide its presence and the presence of other malware by subverting the operating system. Advanced rootkits operate at the kernel level, making them extremely difficult to detect and remove. Rootkit detection often requires offline scanning tools or complete system reimaging.

S

SIEM

Security Information and Event Management (SIEM) is a platform that aggregates, correlates, and analyzes security log data from across an organization's IT environment to detect threats and support compliance. SIEM tools provide centralized visibility and enable automated alerting on suspicious patterns. Modern SIEM solutions incorporate machine learning and threat intelligence feeds.

SOAR

Security Orchestration, Automation, and Response (SOAR) platforms help security teams manage and respond to threats by automating repetitive tasks and orchestrating workflows across security tools. SOAR reduces mean time to respond (MTTR) and allows analysts to focus on higher-value tasks. It is often deployed alongside SIEM to operationalize alert triage and incident response.

SOC

A Security Operations Center (SOC) is a centralized team and facility dedicated to monitoring, detecting, analyzing, and responding to cybersecurity incidents on an ongoing basis. SOC analysts work with SIEM, EDR, and other tools to protect the organization around the clock. Managed SOC (MSOCs) and MDR services offer outsourced SOC capabilities for organizations that lack internal resources.

Social Engineering

Social engineering is the manipulation of people into performing actions or divulging confidential information through psychological deception rather than technical hacking. Techniques include phishing, vishing (voice), pretexting, and baiting. Humans remain the most exploitable link in the security chain, making security awareness training essential.

Spear Phishing

Spear phishing is a highly targeted form of phishing in which attackers customize their communications using specific information about the target — such as their name, role, or recent activities — to increase credibility. It is far more effective than generic phishing campaigns and is the initial access method of choice for many APT groups. Business email compromise (BEC) is a financially motivated variant.

Supply Chain Attack

A supply chain attack targets less-secure elements in the supply chain — such as a software vendor, managed service provider, or hardware supplier — to ultimately compromise the attacker's true target downstream. The SolarWinds and MOVEit attacks are prominent examples. Supply chain attacks are particularly dangerous because they can compromise thousands of organizations through a single vendor breach.

T

Threat Actor

A threat actor is any individual, group, or entity that conducts or has the intent to conduct malicious cyber activities. Categories include nation-state actors, organized criminal groups, hacktivists, insider threats, and opportunistic script kiddies. Understanding the likely threat actors targeting your industry helps prioritize defensive investments.

Threat Hunting

Threat hunting is the proactive, human-driven process of searching through networks and systems for advanced threats that have evaded automated security controls. Hunters develop hypotheses based on threat intelligence and attacker TTPs, then investigate to confirm or disprove them. It complements reactive detection by finding threats that automated tools miss.

Threat Intelligence

Threat intelligence (TI) is evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, and actionable advice. It enables organizations to make faster, better-informed security decisions. Threat intelligence is classified by type: strategic (for executives), tactical (TTPs), technical (IoCs), and operational (specific campaigns).

Trojan

A Trojan horse (or simply Trojan) is malicious software disguised as legitimate software to trick users into installing it. Unlike viruses or worms, Trojans do not self-replicate but rely on social engineering to spread. Once installed, they can create backdoors, exfiltrate data, or download additional malware.

TTPs

Tactics, Techniques, and Procedures (TTPs) describe the behavior and methods used by threat actors to conduct cyberattacks. Tactics represent the high-level objective (e.g., initial access); techniques describe how the tactic is achieved; procedures are specific implementations. The MITRE ATT&CK framework organizes adversary TTPs into a structured, searchable matrix.

V

Vishing

Vishing (voice phishing) is a social engineering attack conducted over the telephone or VoIP, where attackers impersonate trusted entities — such as tech support, banks, or government agencies — to extract sensitive information or money from victims. AI-generated voice cloning has dramatically improved vishing attack credibility. It is a key component of many business email compromise and fraud schemes.

VPN

A Virtual Private Network (VPN) creates an encrypted tunnel between a device and a network, protecting data in transit and masking the user's IP address. VPNs are used legitimately by organizations to enable secure remote access. However, unpatched VPN appliances are a common attack vector, and threat actors also abuse VPN services to anonymize their operations.

Vulnerability

A vulnerability is a weakness in a system, application, or process that could be exploited to cause harm. Vulnerabilities are classified by severity using the Common Vulnerability Scoring System (CVSS) and assigned CVE identifiers. Timely vulnerability identification and patching is one of the most impactful risk reduction activities an organization can undertake.

W

Watering Hole Attack

A watering hole attack is a targeted strategy in which adversaries compromise websites that are commonly visited by the intended victims. When targets browse the compromised site, malware is silently delivered to their systems. The attack is named after the predator tactic of lying in wait near a watering hole.

X

XDR

Extended Detection and Response (XDR) is a security solution that unifies data collection and threat detection across endpoints, networks, cloud workloads, and email into a single platform. XDR extends EDR capabilities beyond the endpoint to provide a holistic view of threats across the entire environment. It aims to reduce alert fatigue and speed up detection and response.

Z

Zero Trust

Zero Trust is a security framework based on the principle 'never trust, always verify' — requiring strict identity verification and least-privilege access for every user, device, and application, regardless of whether they are inside or outside the network perimeter. It assumes that breaches are inevitable and limits blast radius through continuous verification and microsegmentation. Zero Trust is now a foundational strategy for modern enterprise security.

Zero-Day

A zero-day vulnerability is a software flaw that is unknown to the vendor and for which no patch exists, giving defenders zero days to prepare. Zero-day exploits are highly valuable to both nation-state actors and cybercriminals and are actively traded on exploit markets. Once a zero-day is discovered and disclosed, it is no longer technically a zero-day.