Cybersecurity Glossary
Demystifying the jargon. A reference guide to common security terms and acronyms.
Advanced Persistent Threat (APT)
A prolonged, targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period. APTs are typically sponsored by nation-states or well-funded criminal organizations.
Attack Surface
The sum of all possible entry points (attack vectors) where an unauthorized user can attempt to enter data or extract data from an environment.
Botnet
A network of private computers infected with malicious software and controlled as a group without the owners' knowledge, often used for DDoS attacks, spam campaigns, or cryptocurrency mining.
CVE (Common Vulnerabilities and Exposures)
A publicly disclosed list of cybersecurity vulnerabilities. Each CVE has a unique identifier and severity score (CVSS) to help organizations prioritize patching.
DDoS (Distributed Denial of Service)
An attack that attempts to disrupt normal traffic to a targeted server, service, or network by overwhelming the target with a flood of internet traffic from multiple sources.
Endpoint Detection and Response (EDR)
Security technology that continuously monitors endpoints (computers, mobile devices) to detect, investigate, and respond to threats in real time.
Firewall
A network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules, establishing a barrier between trusted and untrusted networks.
IDS/IPS
Intrusion Detection System (IDS) monitors network traffic for suspicious activity and issues alerts. Intrusion Prevention System (IPS) also actively blocks detected threats.
MFA (Multi-Factor Authentication)
An authentication method requiring two or more verification factors, such as something you know (password), have (device), or are (biometric), to gain access to a resource.
MTTR (Mean Time to Respond)
The average time it takes for a security team to respond to and remediate a security incident after it is detected. Lower MTTR indicates a more effective security operation.
Penetration Testing
An authorized, simulated cyberattack on a computer system to evaluate its security posture, identify vulnerabilities, and test the effectiveness of existing controls.
Phishing
A social engineering attack where attackers send fraudulent messages, typically email, designed to trick recipients into revealing sensitive information or installing malware.
Ransomware
Malicious software that encrypts a victim's files and demands payment (ransom) for the decryption key. Modern ransomware often also exfiltrates data for double extortion.
SIEM (Security Information and Event Management)
A solution that provides real-time analysis of security alerts generated by applications and network hardware. SIEM aggregates and correlates log data to identify anomalies.
SOC (Security Operations Center)
A centralized unit that monitors, detects, investigates, and responds to cybersecurity incidents on a 24/7 basis using people, processes, and technology.
Threat Intelligence
Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice, used to inform decisions about the subject's response.
Vulnerability
A weakness in a system, application, or network that can be exploited by a threat actor to gain unauthorized access or cause harm. Vulnerabilities are rated by CVSS severity scores.
Zero Trust
A security model that assumes no user or system is trustworthy by default, even within the corporate network. Every access request must be verified, authenticated, and authorized before being granted.
Zero-Day
A software vulnerability that is unknown to the vendor and has no available patch. Zero-day exploits are particularly dangerous because defenders have no advance warning.