Cybersecurity Glossary

Also: 3-2-1 backup · immutable backup · disaster recovery

Backup and recovery is the practice of maintaining recoverable copies of data and systems, and verifying that restoration actually works, so that an organisation can recover from destruction, corruption, or ransomware.

Also: buffer overrun · stack overflow vulnerability · heap overflow

A buffer overflow is a memory-safety vulnerability in which a program writes more data into a fixed-size memory buffer than it can hold, corrupting adjacent memory and potentially allowing an attacker to alter program execution.

Also: vulnerability reward program · VRP

A bug bounty is a programme in which an organisation offers monetary rewards to external security researchers who responsibly report vulnerabilities in its systems.

Also: BEC · CEO fraud · invoice fraud

Business email compromise (BEC) is a fraud in which an attacker impersonates or hijacks a trusted business email account to induce fraudulent payments or data disclosure, typically without deploying any malware.

Also: CA · TLS certificate · PKI

A certificate authority (CA) is a trusted organisation that issues digital certificates binding a cryptographic public key to a verified identity, such as a domain name, enabling encrypted and authenticated connections.

Also: artifact signing · binary signing

Code signing is the practice of cryptographically signing software artifacts so that recipients can verify who produced them and confirm the code has not been altered since signing.

Also: Common Platform Enumeration

CPE (Common Platform Enumeration) is a structured naming scheme for identifying software, hardware, and operating systems in a machine-readable way, used to state precisely which products and versions a vulnerability affects.

Also: account takeover · ATO

Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.

Also: Common Vulnerabilities and Exposures · CVE ID · CVE identifier

CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.

Also: Common Vulnerability Scoring System · CVSS score · base score

CVSS (Common Vulnerability Scoring System) is an open standard that scores the technical severity of a vulnerability from 0.0 to 10.0, based on factors such as attack complexity, required privileges, and impact on confidentiality, integrity, and availability.

Also: exfil · data theft

Data exfiltration is the unauthorised transfer of data out of an organisation's environment by an attacker, typically the final objective of an intrusion.

Also: DLP · data leak prevention

Data loss prevention (DLP) refers to tools and policies that detect and block sensitive information from leaving an organisation through channels such as email, cloud uploads, or removable media.

Also: layered security · defence in depth

Defense in depth is a security strategy that layers multiple independent controls so that the failure or bypass of any single control does not result in compromise.

Also: substitution attack · namespace confusion

Dependency confusion is a supply chain attack in which an attacker publishes a malicious package to a public registry using the same name as an organisation's internal private package, causing build tooling to fetch the attacker's version instead.

Also: data extortion · exfiltration extortion

Double extortion is a ransomware tactic in which attackers steal a copy of an organisation's data before encrypting it, so that refusing to pay risks both operational disruption and public release of the stolen information.

Also: breach detection gap · time to detect

Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.

Also: Endpoint Detection and Response · XDR

EDR (Endpoint Detection and Response) is security software installed on endpoints that continuously records process, file, and network activity, detects suspicious behaviour, and enables remote investigation and containment.

Also: Exploit Prediction Scoring System

EPSS (Exploit Prediction Scoring System) estimates the probability that a given vulnerability will be exploited in the wild within the next 30 days, expressed as a percentage between 0 and 100.

Also: exploit code · proof of concept · PoC

An exploit is code or a technique that takes advantage of a specific vulnerability to cause unintended behaviour, such as executing attacker-supplied code, bypassing authentication, or crashing a service.

Also: IR · DFIR · security incident response

Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.

Also: IOC · IoC · indicators

An indicator of compromise (IOC) is an observable artifact — such as a file hash, IP address, domain, or registry key — that suggests a system may have been breached.

Also: IAB · access broker

An initial access broker (IAB) is a criminal specialist who breaches organisations and then sells that access to other attackers, such as ransomware affiliates, rather than monetising the intrusion themselves.

Also: malicious insider · insider risk

An insider threat is a security risk originating from someone with legitimate authorised access to an organisation's systems, whether acting maliciously, negligently, or through a compromised account.

Also: Known Exploited Vulnerabilities · CISA KEV

The KEV (Known Exploited Vulnerabilities) catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities with confirmed evidence of active exploitation in the wild.

Also: pivoting · east-west movement

Lateral movement is the process by which an attacker who has compromised one system moves through a network to reach additional systems, typically hunting for higher-value data or credentials.

Also: malicious software · trojan · worm · rootkit

Malware is any software written to cause harm to a system, network, or user, including viruses, worms, trojans, rootkits, spyware, and ransomware.

Also: memory-safe language · memory safety bug

Memory safety is the property of a program being unable to access memory outside the bounds of what it legitimately owns, preventing entire vulnerability classes such as buffer overflows, use-after-free, and data races.

Also: network segmentation · east-west segmentation

Microsegmentation is the practice of dividing a network into small isolated zones with explicit policies governing traffic between them, so that a compromised system cannot freely communicate with unrelated systems.

Also: ATT&CK · ATT&CK framework · TTPs

MITRE ATT&CK is a public knowledge base that catalogues real-world adversary tactics, techniques, and procedures, organised into a matrix that maps how attackers progress through an intrusion.

Also: MFA · 2FA · two-factor authentication

Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.

Also: n day vulnerability · known vulnerability · one-day

An n-day is a vulnerability that has already been publicly disclosed and patched, but remains exploitable on systems that have not yet applied the update.

Also: National Vulnerability Database

The NVD (National Vulnerability Database) is the US government repository, maintained by NIST, that enriches published CVE records with CVSS severity scores, affected product identifiers, and references.

Also: FIDO2 · WebAuthn · passwordless

A passkey is a phishing-resistant credential based on public-key cryptography that replaces passwords: the private key never leaves the user's device, and authentication is cryptographically bound to the legitimate site's domain.

Also: bcrypt · Argon2 · scrypt · password storage

Password hashing is the practice of storing passwords as the output of a deliberately slow, salted one-way function, so that a breach of the credential database does not immediately yield usable plaintext passwords.

Also: Update Tuesday · monthly patch cycle

Patch Tuesday is the second Tuesday of each month, on which Microsoft and several other major vendors release their scheduled batch of security updates, giving administrators a predictable cadence for planning maintenance.

Also: pentest · pen test · ethical hacking

Penetration testing is an authorised, time-boxed assessment in which security professionals attempt to exploit vulnerabilities in a defined target to demonstrate real-world impact and provide remediation guidance.

Also: phishing attack · credential phishing

Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.

Also: PhaaS · phishing kit

Phishing-as-a-service (PhaaS) is a subscription model in which criminal platforms sell ready-made phishing kits, hosting, and credential-capture infrastructure to customers who lack the skill to build them.

Also: PoLP · least privilege access

The principle of least privilege holds that every user, process, and system should be granted only the minimum permissions necessary to perform its function, and no more.

Also: privesc · local privilege escalation · LPE · elevation of privilege

Privilege escalation is the act of exploiting a flaw or misconfiguration to gain a higher level of access than originally granted, such as moving from an unprivileged user account to administrator or root.

Also: crypto-ransomware · ransomware attack

Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.

Also: RaaS

Ransomware-as-a-service (RaaS) is a criminal business model in which ransomware developers lease their malware and infrastructure to affiliates, who carry out the actual intrusions and share a percentage of ransom proceeds with the operators.

Also: red teaming · adversary simulation · purple team

A red team is a group that simulates realistic adversary behaviour against an organisation to test not just its technical defences but its ability to detect and respond to an intrusion in progress.

Also: RCE · arbitrary code execution · remote code exec

Remote code execution (RCE) is a class of vulnerability that allows an attacker to run arbitrary code on a target system over a network, without physical access to that machine.

Also: deterministic build · bit-for-bit reproducibility

A reproducible build is one where compiling the same source code with the same environment always produces a byte-for-byte identical binary, allowing anyone to independently verify that a distributed binary genuinely corresponds to its published source.

Also: coordinated disclosure · CVD · vulnerability disclosure

Responsible disclosure, also called coordinated vulnerability disclosure, is the practice of privately reporting a vulnerability to the affected vendor and allowing a defined period for a fix before publishing details.

Also: Software Bill of Materials

An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component and dependency contained in a piece of software, including version numbers and licence information.

Also: SOC · security operations centre

A security operations center (SOC) is the team and function responsible for continuously monitoring an organisation's environment for security threats, triaging alerts, and initiating incident response.

Also: Security Information and Event Management

A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.

Also: Supply-chain Levels for Software Artifacts

SLSA (Supply-chain Levels for Software Artifacts) is a security framework that defines graduated levels of build integrity, describing increasingly rigorous requirements for how software artifacts are produced and verified.

Also: human hacking · pretexting

Social engineering is the manipulation of people into performing actions or disclosing information that compromises security, exploiting trust, authority, urgency, or helpfulness rather than technical vulnerabilities.

Also: SSCS · supply chain integrity

Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.

Also: software supply chain attack · third-party compromise

A supply chain attack compromises an organisation indirectly by targeting a trusted supplier, dependency, or software update mechanism, so that malicious code arrives through a channel the victim already trusts.

Also: TTX · incident simulation

A tabletop exercise is a discussion-based simulation in which a team walks through their response to a hypothetical security incident, testing decision-making and procedures without touching production systems.

Also: proactive threat detection · cyber threat hunting

Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.

Also: Transport Layer Security · SSL · HTTPS

TLS (Transport Layer Security) is the cryptographic protocol that encrypts data in transit between clients and servers, providing confidentiality, integrity, and server authentication — most visibly as the S in HTTPS.

Also: package typosquatting · URL typosquatting

Typosquatting is the practice of registering package names or domains that closely resemble legitimate ones, relying on user typos or inattention to deliver malicious content to victims who intended to reach the real thing.

Also: UAF · dangling pointer

A use-after-free is a memory-safety vulnerability in which a program continues to use a pointer to memory that has already been released, allowing an attacker who can control what occupies that memory to influence program behaviour.

Also: patch management · VM program

Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.

Also: zero trust architecture · ZTA · BeyondCorp

Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.

Also: 0-day · zero day vulnerability · zero-day exploit

A zero-day is a software vulnerability that attackers know about and exploit before the vendor has released a patch, leaving defenders zero days to prepare a fix.