THREAT‑WATCH
GLOSSARY
Cybersecurity Glossary
Clear, no-nonsense definitions of the terms that come up most in security and compliance conversations.
Advanced Persistent Threat (APT)
A sophisticated, well-resourced attacker that establishes long-term, stealthy access to a target rather than a quick smash-and-grab.
Attack Surface
The complete set of points where an unauthorized user could try to enter or extract data from a system.
Backup and Recovery
Maintaining copies of data separate from production systems, and the process of restoring from them after data loss or a ransomware attack.
Botnet
A network of malware-infected devices remotely controlled by an attacker, often used to launch DDoS attacks or send spam at scale.
Breach Notification
The legal obligation to inform regulators and, in some cases, affected individuals after a qualifying data breach.
Bring Your Own Device (BYOD)
A policy allowing employees to use their personal phones, laptops, or tablets to access company data and systems.
Brute Force Attack
An attack that systematically tries every possible password combination until it finds the correct one.
Business Continuity Plan (BCP)
A documented plan for keeping critical business functions running during and after a disruptive incident.
Business Email Compromise (BEC)
A targeted fraud where an attacker impersonates an executive, vendor, or partner by email to trick an employee into a wire transfer or data disclosure.
Chain of Custody
The documented, unbroken trail showing who handled a piece of digital evidence, when, and how, from collection through to use in legal proceedings.
Cloud Security Posture Management (CSPM)
Tools that continuously scan cloud environments for misconfigurations, like publicly exposed storage buckets, that create security risk.
Credential Stuffing
An attack that automatically tries username/password pairs stolen from one breach against many other websites, betting on password reuse.
Cross-Site Scripting (XSS)
An attack that injects malicious scripts into web pages viewed by other users, running in their browser with their permissions.
CVE (Common Vulnerabilities and Exposures)
A standardized, unique identifier assigned to a publicly known software vulnerability, used as a common reference across the security industry.
Cyber Insurance
An insurance policy covering financial losses from cyber incidents, such as breach response costs, business interruption, and liability claims.
Cyber Threat Intelligence (CTI)
Information about active and emerging threats, attacker tactics, and indicators of compromise, used to inform detection and defense.
Data Breach
An incident in which sensitive, protected, or confidential data is accessed, disclosed, or stolen without authorization.
Data Loss Prevention (DLP)
Tools and policies that detect and block sensitive data from leaving an organization's control, whether by accident or theft.
Data Protection Officer (DPO)
A designated role responsible for overseeing an organization's data protection strategy and GDPR compliance.
DDoS Attack
A Distributed Denial-of-Service attack floods a system with traffic from many sources at once, making it unavailable to legitimate users.
Digital Forensics
The scientific process of collecting, preserving, and analyzing digital evidence to determine what happened during a security incident.
Disaster Recovery Plan (DRP)
A documented, technical plan for restoring IT systems and data after an outage or destructive event.
DMARC
An email authentication standard that tells receiving mail servers what to do with messages that fail sender-verification checks.
Encryption
The process of converting data into a coded form that can only be read by someone with the correct decryption key.
Endpoint Detection and Response (EDR)
Software that monitors laptops, servers, and other devices for malicious activity and can respond automatically or via a SOC.
Exploit
A piece of code or technique that takes advantage of a specific vulnerability to cause unintended behavior on a system.
Extended Detection and Response (XDR)
An approach that correlates detection data across endpoints, network, cloud, and email into a single view, rather than siloed tools.
Firewall
A network security device or software that monitors and filters incoming and outgoing traffic based on defined security rules.
GDPR
The EU's General Data Protection Regulation, setting rules for how organizations collect, use, and protect personal data.
GRC (Governance, Risk & Compliance)
The combined discipline of setting security policy (governance), managing exposure (risk), and meeting legal/regulatory obligations (compliance).
Identity and Access Management (IAM)
The systems and policies that control who can access what, across every application and system in an organization.
Incident Response
The structured process of detecting, containing, investigating, and recovering from a security incident.
Indicator of Compromise (IOC)
A piece of forensic evidence, like a malicious IP address, file hash, or domain, that suggests a system has been breached.
Insider Threat
A security risk originating from someone with legitimate access, such as a current or former employee, contractor, or partner.
ISO 27001
An international standard for information security management systems, and the most widely recognized security certification.
Keylogger
Software or hardware that records every keystroke a user types, commonly used to steal passwords and sensitive information.
Log Management
The practice of collecting, storing, and analyzing the activity records ('logs') generated by systems, applications, and network devices.
Malware
An umbrella term for any software designed to damage, disrupt, or gain unauthorized access to a system.
Man-in-the-Middle Attack
An attack where the attacker secretly intercepts and potentially alters communication between two parties who believe they're talking directly to each other.
Managed Detection and Response (MDR)
An outsourced service that continuously monitors your environment for threats and actively responds to them, not just alerts you.
MITRE ATT&CK
A publicly available knowledge base cataloging real-world attacker tactics and techniques, used as a common reference framework across the security industry.
Multi-Factor Authentication (MFA)
A login method requiring two or more independent proofs of identity, such as a password plus a code from a phone.
Network Segmentation
Dividing a network into smaller, isolated zones so that a breach in one segment can't automatically spread to others.
NIS2 Directive
An EU law setting minimum cybersecurity and incident-reporting requirements for essential and important entities across critical sectors.
OT/ICS Security
Security practices tailored to operational technology and industrial control systems, which run production, utility, and physical infrastructure.
Password Manager
Software that generates, stores, and auto-fills strong, unique passwords for every account, encrypted behind one master password.
Patch Management
The process of identifying, testing, and deploying software updates that fix known security vulnerabilities.
PCI DSS
A security standard required for any organization that stores, processes, or transmits credit card data.
Penetration Testing
An authorized, simulated attack against a system to find exploitable weaknesses before a real attacker does.
Phishing
Fraudulent messages, usually email, designed to trick recipients into revealing credentials or installing malware.
Privileged Access Management (PAM)
Controls specifically for accounts with elevated permissions, like administrators, since those accounts cause the most damage if compromised.
Ransomware
Malware that encrypts files or systems and demands payment for their release, often alongside a threat to leak stolen data.
Risk Assessment
The structured process of identifying, analyzing, and prioritizing security risks based on likelihood and potential impact.
Sandboxing
Running an untrusted file or program in an isolated environment to observe its behavior without risking the real system.
Security Operations Center (SOC)
A team and platform dedicated to continuously monitoring, detecting, and responding to security threats.
Shadow IT
Software, devices, or cloud services used within an organization without the knowledge or approval of the IT/security team.
SIEM (Security Information and Event Management)
A platform that aggregates and correlates log and event data across an organization to support threat detection and compliance reporting.
Single Sign-On (SSO)
A login system letting users authenticate once to access multiple applications, instead of separate passwords for each.
SOC 2
An audit framework and report attesting that a service organization's controls meet defined trust criteria: security, availability, confidentiality, and privacy.
Social Engineering
Manipulating people, rather than exploiting software, to gain unauthorized access or information.
Spyware
Malware that secretly monitors a user's activity and transmits the collected data to an attacker.
SQL Injection
An attack that inserts malicious database commands through a web form or input field to access or manipulate a database.
Supply Chain Attack
An attack that compromises a trusted third-party vendor or software component to reach that vendor's customers.
Threat Hunting
The proactive search for threats already present in an environment that automated detection tools haven't flagged.
Trojan
Malware disguised as legitimate software to trick a user into installing it.
VPN (Virtual Private Network)
A service that encrypts internet traffic and routes it through a secure tunnel, hiding it from anyone on the local network.
Vulnerability Management
The ongoing process of identifying, prioritizing, and remediating security weaknesses across an organization's systems.
Whaling
A phishing attack specifically targeting senior executives, using research-backed, highly personalized pretexts.
Zero Trust Network Access (ZTNA)
A practical implementation of zero trust that grants access to specific applications, not the whole network, after verifying identity and device health each time.
Zero Trust Security
A security model that assumes no user or device should be trusted by default, even inside the network perimeter.
Zero-Day Vulnerability
A software flaw that's exploited by attackers before the vendor has released a fix, or is even aware of it.