Advanced Persistent Threat (APT)
A sophisticated, well-resourced attacker that establishes long-term, stealthy access to a target rather than a quick smash-and-grab.
APTs are typically associated with nation-state or highly organized criminal groups pursuing specific, high-value targets over extended periods, sometimes months or years. Rather than triggering obvious alarms, APT activity is designed to blend in with normal traffic, making early detection through behavioral correlation far more valuable than relying on signature-based tools alone.
24/7 SOC Monitoring & MDR →Ransomware
Malware that encrypts files or systems and demands payment for their release, often alongside a threat to leak stolen data.
Modern ransomware attacks typically combine encryption with data theft (the so-called 'double extortion' model) so that even organizations with clean backups face pressure to pay to prevent stolen data from being published. Speed of detection during the early stages of an attack is the single biggest factor in how much damage a ransomware incident causes.
Ransomware Detection & Response →Phishing
Fraudulent messages, usually email, designed to trick recipients into revealing credentials or installing malware.
Phishing remains the most common way attackers gain initial access to an organization. ENISA's 2025 Threat Landscape report attributes 60% of successful intrusions to it. Modern phishing includes targeted variants like spear-phishing (aimed at a specific person) and business email compromise (impersonating a trusted contact to request a fraudulent payment or action).
Phishing Training →Social Engineering
Manipulating people, rather than exploiting software, to gain unauthorized access or information.
Social engineering exploits trust, urgency, or authority rather than technical vulnerabilities: phishing is the most common form, but it also includes pretexting (impersonating someone with a false pretext), baiting, and phone-based scams (vishing). Because it targets human decision-making, technical controls alone can't fully prevent it; training is a necessary complement.
Phishing Training →Zero-Day Vulnerability
A software flaw that's exploited by attackers before the vendor has released a fix, or is even aware of it.
'Zero-day' refers to the vendor having had zero days to fix the flaw before it was exploited or disclosed. Because no patch exists yet, defense relies on detection of anomalous behavior (rather than known-signature matching) and rapid patching once a fix ships, which is why continuous monitoring matters even for fully patched environments.
24/7 SOC Monitoring & MDR →Malware
An umbrella term for any software designed to damage, disrupt, or gain unauthorized access to a system.
Malware includes viruses, worms, trojans, ransomware, spyware, and keyloggers, distinguished from each other mainly by how they spread and what they do once installed. Modern malware is often modular and delivered in stages, an initial small payload downloads and installs further tools, which is one reason early detection of the first-stage payload matters more than trying to catch every possible variant.
Endpoint Protection (EDR) →Trojan
Malware disguised as legitimate software to trick a user into installing it.
Unlike a virus, a trojan doesn't self-replicate; it relies entirely on deception, often bundled with pirated software, fake updates, or email attachments disguised as invoices or documents. Once installed, a trojan commonly opens a backdoor for remote access, steals credentials, or downloads additional malware, all while appearing to function as the legitimate program it impersonated.
Endpoint Protection (EDR) →Botnet
A network of malware-infected devices remotely controlled by an attacker, often used to launch DDoS attacks or send spam at scale.
Individual infected devices ('bots' or 'zombies') check in with a command-and-control server for instructions, letting an attacker coordinate thousands or millions of devices at once without their owners' knowledge. Botnets are commonly rented out as a service to other criminals, which is part of why DDoS-for-hire has become cheap and accessible even to unsophisticated attackers.
Endpoint Protection (EDR) →DDoS Attack
A Distributed Denial-of-Service attack floods a system with traffic from many sources at once, making it unavailable to legitimate users.
DDoS attacks typically use a botnet to generate overwhelming traffic volume, or exploit protocol weaknesses to consume server resources with relatively little attacker traffic (amplification attacks). Unlike most cyberattacks, the goal usually isn't data theft, it's disruption and downtime, often used as a distraction to cover a separate intrusion, or as extortion leverage.
Man-in-the-Middle Attack
An attack where the attacker secretly intercepts and potentially alters communication between two parties who believe they're talking directly to each other.
Common scenarios include intercepting traffic on unsecured public Wi-Fi, DNS spoofing to redirect users to a fake site, or compromising a router to intercept all traffic passing through it. Properly implemented encryption (like HTTPS with valid certificates) is the primary defense, since it makes intercepted traffic unreadable even if the attacker successfully positions themselves in the middle.
SQL Injection
An attack that inserts malicious database commands through a web form or input field to access or manipulate a database.
SQL injection exploits web applications that don't properly validate or sanitize user input before passing it to a database query, letting an attacker read, modify, or delete data they shouldn't have access to, sometimes the entire database. It's been on security vulnerability top-10 lists for over two decades because it remains common in poorly coded applications, despite being well-understood and preventable with parameterized queries.
Cross-Site Scripting (XSS)
An attack that injects malicious scripts into web pages viewed by other users, running in their browser with their permissions.
XSS lets an attacker execute code in a victim's browser session, commonly used to steal session cookies, redirect users to phishing pages, or perform actions on the victim's behalf without their knowledge. It exploits websites that don't properly sanitize user-submitted content before displaying it back to other visitors, a very common web application flaw.
Brute Force Attack
An attack that systematically tries every possible password combination until it finds the correct one.
Modern brute force attacks use automated tools that can attempt thousands of password combinations per second, making short or simple passwords crackable in minutes to hours. Defenses include account lockout after failed attempts, rate limiting, longer/more complex password requirements, and MFA, which renders a correctly guessed password insufficient on its own.
Endpoint Protection (EDR) →Credential Stuffing
An attack that automatically tries username/password pairs stolen from one breach against many other websites, betting on password reuse.
Credential stuffing works because people commonly reuse the same password across multiple accounts. Attackers take credential lists from past breaches (often available on criminal marketplaces) and run them at scale against banking, email, and business logins, hoping some percentage still work elsewhere. Unique passwords per account (ideally via a password manager) fully neutralize this attack.
Endpoint Protection (EDR) →Business Email Compromise (BEC)
A targeted fraud where an attacker impersonates an executive, vendor, or partner by email to trick an employee into a wire transfer or data disclosure.
BEC typically doesn't involve malware at all, just a convincingly spoofed or compromised email address and a plausible, urgent request, such as a fake invoice or a request to update payroll banking details. It's consistently one of the costliest categories of cybercrime by direct financial loss, because it targets the payment process directly rather than needing to breach technical defenses.
Phishing Training →Supply Chain Attack
An attack that compromises a trusted third-party vendor or software component to reach that vendor's customers.
Instead of attacking a well-defended target directly, attackers compromise a supplier, software update mechanism, or managed service provider that the target trusts, then use that trusted relationship to reach many downstream victims at once. This is why vetting vendor security and monitoring third-party access has become as important as securing an organization's own systems.
24/7 SOC Monitoring & MDR →Insider Threat
A security risk originating from someone with legitimate access, such as a current or former employee, contractor, or partner.
Insider threats can be malicious (a disgruntled employee deliberately stealing or sabotaging data) or unintentional (an employee falling for phishing, misconfiguring a system, or losing a device). Because insiders already have legitimate access, their activity often doesn't trigger the same alarms as external attackers, making behavioral monitoring and least-privilege access particularly important defenses.
24/7 SOC Monitoring & MDR →Spyware
Malware that secretly monitors a user's activity and transmits the collected data to an attacker.
Spyware can log keystrokes, capture screenshots, track browsing history, or access a device's camera and microphone, typically running silently in the background without visible symptoms. It's often bundled with legitimate-looking free software or installed via a phishing link, and its goal is usually credential theft or ongoing surveillance rather than immediate, visible damage.
Endpoint Protection (EDR) →Keylogger
Software or hardware that records every keystroke a user types, commonly used to steal passwords and sensitive information.
Software keyloggers are typically installed as part of a broader malware infection and run invisibly; hardware keyloggers are physical devices plugged between a keyboard and computer, which require physical access to install but leave no software trace. Either way, the recorded keystrokes, including passwords, credit card numbers, and private messages, are periodically transmitted back to the attacker.
Endpoint Protection (EDR) →Whaling
A phishing attack specifically targeting senior executives, using research-backed, highly personalized pretexts.
Whaling attackers research their target's role, communication style, and business relationships (often via LinkedIn and public filings) to craft a convincing, personalized message, frequently impersonating another executive or board member requesting an urgent wire transfer or sensitive data. Because executives often have broader access and approval authority, a successful whaling attack tends to cause disproportionately large damage.
Phishing Training →Exploit
A piece of code or technique that takes advantage of a specific vulnerability to cause unintended behavior on a system.
A vulnerability is a weakness; an exploit is the working method that actually leverages it, whether to gain access, escalate privileges, or execute code. The gap between a vulnerability being disclosed and a working exploit becoming publicly available is often short, sometimes hours, which is why patching quickly after disclosure matters more than patching eventually.
24/7 SOC Monitoring & MDR →Data Breach
An incident in which sensitive, protected, or confidential data is accessed, disclosed, or stolen without authorization.
A data breach can result from external attack (hacking, ransomware), insider misuse, or simple misconfiguration (like an exposed cloud storage bucket). Under NIS2 and GDPR, breaches meeting certain severity thresholds must be reported to authorities within strict deadlines, which makes fast detection directly relevant to legal compliance, not just security.
Incident Response →