📖 Cybersecurity Glossary

Two-Factor Authentication

Authentication requiring two verification factors — typically something you know (password) and something you have (phone/token).

Approximate Nearest Neighbor

Vector search technique (e.g. HNSW (Hierarchical Navigable Small World) or IVF (Inverted File Index)) that finds the closest embeddings quickly by trading a little accuracy for speed; the core retrieval step in vector RAG (Retrieval-Augmented Generation).

Agent-to-Agent Protocol

Open protocol (introduced by Google) that lets AI agents discover each other and delegate tasks directly; in a multi-agent pipeline every A2A message crosses a trust boundary and must be treated as untrusted input.

Attribute-Based Access Control

Access control model that evaluates attributes (user, resource, environment) to make authorization decisions.

Access Control List

List of permissions attached to an object, specifying which users or system processes are granted access.

Asset Criticality Score

Qualys TruRisk asset rating (scored 1 to 5) reflecting business importance, environment exposure (Internet vs internal), and regulatory scope (PCI, HIPAA). Multiplied with QDS to calculate aggregate asset TruRisk.

Architecture Decision Record

Lightweight structured document capturing an important architectural decision, context, rationale, security trade-offs, and consequences for cloud and enterprise systems.

Advanced Encryption Standard

Symmetric block cipher (128/192/256-bit keys) used worldwide for encrypting sensitive data at rest and in transit.

Artificial Intelligence

Technology enabling machines to simulate human intelligence — increasingly used in both cyber defense and attacks.

AI Security Posture Management

Continuous discovery, posture assessment, risk scoring, and policy enforcement across AI models, shadow agentic AI, MCP servers, and non-human identities (NHIs) in enterprise SaaS and cloud environments.

Artificial Intelligence Risk Management Framework

National Institute of Standards and Technology voluntary framework (NIST AI 100-1) providing four core functions (Govern, Map, Measure, Manage) to cultivate trust and manage risk across the full AI and MLOps lifecycle.

AI Bill of Materials

Comprehensive inventory of an AI model components, including base weights, training dataset provenance, licenses, fine-tuning checkpoints, and supply chain attestation.

Artificial Intelligence Bill of Materials

Comprehensive inventory of all AI models, autonomous agents (LangGraph, CrewAI, AutoGen), Model Context Protocol (MCP) servers, datasets, and non-human identities discovered across repositories and cloud environments.

AI Management System (ISO/IEC 42001)

Certifiable management system standard for governing AI responsibly, using Plan-Do-Check-Act: AI policy, roles, risk and impact assessments, AI system inventory, and internal audit.

Application Portfolio Management

Enterprise framework and ServiceNow module that catalogs Business Applications, tracks lifecycle stages, evaluates technical risk, and links software architectures to compliance and security assessments.

Advanced Persistent Threat

Sophisticated, long-term cyberattack where an intruder gains access and remains undetected for an extended period.

Attack Surface Management

Continuous discovery and monitoring of all internet-facing assets for vulnerabilities and exposures.

Application Security Posture Management

Centralized platform that ingests, normalizes (SARIF), dedupes, and correlates findings from SAST, SCA, DAST, secrets scanning, and IaC across repos to prioritize real risk and enforce remediation SLAs.

Application Security Verification Standard

OWASP standard defining testable security requirements in three levels (L1 basic, L2 standard, L3 high assurance). Used as a basis for secure coding standards and security acceptance criteria.

Adversarial Threat Landscape for AI Systems

MITRE knowledge base of adversary tactics, techniques, and procedures (TTPs) observed in real-world attacks against AI and machine learning systems.

Account Takeover

Cyberattack where an unauthorized actor or unmanaged AI agent gains control of customer online banking credentials or active sessions, leading to unauthorized fund transfers or profile modifications.

Applicant Tracking System

Software that manages recruiting and hiring processes, often scanning resumes for keywords.

Antivirus

Software that detects, prevents, and removes malware including viruses, worms, trojans, and ransomware.

Best Matching 25

Classic keyword relevance ranking function used by Elasticsearch and OpenSearch; paired with dense vectors in hybrid-search RAG to catch exact IDs, error codes and jargon.

Breach and Attack Simulation

Automated tools that continuously test security controls by simulating real-world attack techniques.

Business Continuity Plan

Documented procedures to maintain essential business functions during and after a disaster.

Business Email Compromise

Social engineering attack where attackers impersonate executives or vendors via email to trick employees into transferring funds or data.

Backend-for-Frontend

Token-handling pattern for browser apps: a server-side component holds OAuth tokens and the browser only gets an HttpOnly, Secure, SameSite session cookie, which keeps tokens out of reach of XSS.

Broken Function Level Authorization

OWASP API5: users can call privileged functions (e.g. admin endpoints, DELETE methods) because the server does not enforce role/scope checks per function.

Border Gateway Protocol

The routing protocol that makes the internet work — exchanges routing information between autonomous systems. BGP hijacking can redirect traffic through attacker-controlled networks.

Broken Object Level Authorization

OWASP API1 (#1 API risk): the API fails to verify that the caller owns or may access the object referenced by an ID, so swapping IDs exposes other users' data.

Broken Object Property Level Authorization

OWASP API3 (combining Mass Assignment & Excessive Data Exposure): API endpoints expose sensitive object properties in responses or allow attackers to modify internal attributes (e.g. isAdmin, balance).

Bring Your Own Device

Policy allowing employees to use personal devices for work. Requires MDM, containerization, and security policies to protect corporate data on unmanaged devices.

Canary String / Canary Token

A unique, intentionally planted phrase or GUID (Globally Unique Identifier) inserted into training datasets, prompts, or databases to detect data leaks, prevent unauthorized model training, or audit data retention.

Convolutional Neural Network

Deep learning architecture specialized for images and video; used in malware-image classification and vision models, and a classic target of adversarial evasion (tiny pixel changes that flip the prediction).

Contrastive Language-Image Pre-training

OpenAI model that embeds images and text into the same vector space, enabling multimodal RAG over diagrams, screenshots and scanned documents.

Corrective Retrieval-Augmented Generation

RAG build pattern that grades retrieved documents and, when relevance is low, rewrites the query or falls back to web search before generating an answer.

Cloud Access Security Broker

Security policy enforcement point between cloud service consumers and providers.

Cloud Controls Matrix

Cybersecurity control framework developed by the Cloud Security Alliance (CSA) providing fundamental security principles and control objectives for cloud customers and providers.

California Consumer Privacy Act

State-level privacy regulation giving California residents control over their personal data.

Change Data Capture

Streams inserts, updates and deletes from a source system as events; in RAG pipelines it triggers re-chunking and re-embedding so the vector index never drifts from the source of truth.

Confidentiality, Integrity, Availability

The three core pillars of information security that guide security program design.

Consumer Financial Protection Bureau

U.S. federal regulatory agency responsible for consumer protection in the financial sector; author of the Section 1033 Open Banking rule mandating secure, credential-free data sharing.

Control ID

Discrete identifier for an individual configuration check or hardening rule in Qualys Policy Compliance (PC), testing a specific technical setting against security baselines.

Cyber Incident Response Team

Specialized team responsible for investigating and responding to cybersecurity incidents.

Center for Internet Security

Nonprofit organization providing best-practice security benchmarks and controls.

Continuous Integration and Continuous Delivery/Deployment

Automated software delivery pipeline that integrates code changes, runs automated security testing (SAST/SCA), and deploys applications safely.

Cloud Infrastructure Entitlement Management

Manages and monitors cloud identities and their permissions — detects over-provisioned access, enforces least privilege, and reduces identity-based attack surface across multi-cloud environments.

Chief Information Security Officer

Executive accountable for the security program; in an AI security operating model, sets AI guardrails and risk appetite and oversees model scanning, runtime monitoring, and AI threat detection.

Customer Identity and Access Management

IAM capability focused on managing external customer identities at scale. Handles registration, social login, consent, MFA, and self-service for consumer-facing applications. Key vendors: Okta (Auth0), Ping Identity (PingOne AIC), ForgeRock.

Configuration Management Database

Centralized repository of IT assets and configuration items (CIs), tracking system ownership, business criticality, hardware/software details, and dependencies for vulnerability management.

Cloud-Native Application Protection Platform

Unified security platform combining CSPM, CWPP, CIEM, and IaC scanning for cloud-native apps.

Control Objectives for Information Technologies

IT governance framework by ISACA for aligning IT with business goals and managing risk.

GitHub CodeQL Semantic Analysis Engine

Semantic code analysis engine powering GitHub Advanced Security (GHAS) that treats code as data, compiling ASTs and control-flow graphs into queryable relational databases for deep taint tracking.

Center of Excellence

Central hub team in a hub-and-spoke operating model that owns standards, paved-road tooling, red teaming, and high-risk reviews, while embedded champions handle lower-risk work.

Sigstore Cosign Container & Artifact Signing

Open-source CLI tool for container image and AI model artifact signing, verification, and storage in OCI registries using keyless OpenID Connect (OIDC) identities.

CrewAI Multi-Agent Framework

Python framework for orchestrating role-based multi-agent AI systems — each agent has a role, goal, and backstory. Used for building collaborative AI teams that delegate tasks autonomously.

Cross-Site Request Forgery

Attack that tricks a user's browser into making unwanted requests to a site where they are authenticated.

Content Security Policy

HTTP response header that restricts which scripts, styles, and resources a page may load. A strict nonce-based CSP limits the impact of XSS bugs that slip past output encoding.

Cloud Security Posture Management

Continuous monitoring of cloud configurations for compliance violations and misconfigurations.

Common Vulnerability Scoring System

Industry-standard severity scoring system (0-10) for specific vulnerabilities, maintained by FIRST.org.

Common Vulnerabilities and Exposures

Unique identifier for a specific discovered vulnerability in a specific product. Maintained by MITRE/NVD.

Common Weakness Enumeration

Catalog of software/hardware weakness types maintained by MITRE. Used to classify bug categories.

Cloud Workload Protection Platform

Runtime protection for VMs, containers, and serverless workloads including vulnerability scanning.

Common Weakness Scoring System

Risk scoring system (0-100) for CWE weakness types, maintained by MITRE.

Data Analysis Expressions

Formula language used in Microsoft Power BI, Analysis Services, and Power Pivot for calculating vulnerability metrics (MTTR, SLA compliance %, backlog aging buckets, and burn-down velocities) across relational star schemas.

Data Version Control

Open-source version control system for machine learning datasets, models, and pipelines that uses Git-like versioning and SHA-256 content hashes to guarantee dataset immutability and provenance across MLOps workflows.

Dynamic Application Security Testing

Testing running applications for vulnerabilities by sending malicious inputs and observing responses.

Distributed Denial of Service

Attack that overwhelms a target with traffic from multiple sources to make it unavailable.

Development, Security, Operations

Practice of integrating security throughout the entire software development lifecycle.

Data Flow Diagram

Diagram of external entities, processes, data stores, and data flows with trust boundaries marked. The starting artifact for STRIDE threat modeling.

Data Loss Prevention

Tools and processes that prevent sensitive data from leaving the organization unauthorized.

DomainKeys Identified Mail

Email authentication method using cryptographic signatures to verify email integrity and sender domain authenticity. Works with SPF and DMARC for email security.

Domain-based Message Authentication, Reporting & Conformance

Email authentication protocol that builds on SPF and DKIM to prevent email spoofing.

Dynamic Multipoint VPN

Cisco technology that enables scalable hub-and-spoke and spoke-to-spoke VPN tunnels dynamically — eliminates the need for static point-to-point tunnels.

Demilitarized Zone

Network segment that sits between the internal network and the internet, hosting public-facing services while isolating the internal network.

Domain Name System

System that translates domain names to IP addresses. Often targeted for DNS hijacking and tunneling.

Denial of Service

Attack that floods a system with traffic or requests to exhaust resources and make it unavailable to legitimate users.

DevOps Research and Assessment

Framework measuring software delivery performance through 4 key metrics: Deployment Frequency, Lead Time for Changes, Change Failure Rate, and Mean Time to Recovery. Elite performers deploy on-demand with <1hr lead time. Tracked by IDPs to measure platform impact.

Data Protection Impact Assessment

GDPR Article 35 assessment required before high-risk personal data processing; for AI systems, owned by Privacy / Legal and covers training data, RAG corpora, and output risks.

Demonstrating Proof of Possession

OAuth extension (RFC 9449) that binds access and refresh tokens to a client-held key pair, so a stolen token can't be replayed by an attacker who lacks the private key.

Damage, Reproducibility, Exploitability, Affected users, Discoverability

Threat-ranking model that scores each factor 1-10 and averages them; used after STRIDE to prioritize threats such as indirect prompt injection or cross-tenant leakage in AI systems.

Datagram Transport Layer Security

TLS equivalent for UDP-based communication — provides encryption, authentication, and integrity for datagram protocols. Used in VPNs (AnyConnect), WebRTC, and IoT.

Data Security Posture Management

Discovers, classifies, and protects sensitive data across cloud environments, ensuring proper access controls and compliance.

Disaster Recovery Plan

Documented plan for recovering IT systems and data after a disaster or major outage.

extended Berkeley Packet Filter

Linux kernel technology that runs sandboxed programs on kernel events; runtime sensors such as Falco and Tetragon use it to watch process, file, and network activity inside containers, e.g. a shell spawned in a model inference pod.

Exact Data Match

DLP technique that detects sensitive data by matching exact values (SSNs, account numbers) from a data source — more accurate than regex patterns with fewer false positives.

Enterprise Data Warehouse

Centralized analytical data repository (e.g. Snowflake, Google BigQuery, AWS Redshift, Databricks) that aggregates security findings, asset metadata, and CMDB context for high-performance BI reporting in Tableau and Power BI.

External Key Manager

Hold Your Own Key (HYOK) architecture pattern (e.g. AWS XKS, Google Cloud EKM) where encryption keys remain stored inside customer-managed on-premises HSMs outside the cloud provider.

Endpoint Detection and Response

Continuous monitoring and response to advanced threats on endpoints using behavioral analysis.

Endpoint Protection Platform

Integrated security solution combining antivirus, anti-malware, firewall, and device control on endpoints. Foundation layer before EDR/XDR capabilities.

Exploit Prediction Scoring System

Probabilistic model predicting the likelihood a vulnerability will be exploited in the wild within 30 days.

Enterprise Vulnerability Management

Comprehensive program and operating model governing end-to-end vulnerability discovery, risk prioritization (CVSS/EPSS/SSVC), remediation SLAs, ServiceNow VR tracking, and exception governance across applications and infrastructure.

Excessive AI Agent Autonomy

An agentic AI threat (OWASP LLM06) where AI agents are granted more permissions than necessary and autonomously execute high-risk actions (file deletion, API calls, payments) without human approval. A single prompt injection can cascade into catastrophic outcomes.

Forescout eyeControl

Forescout enforcement component that automates security policies, restricts network access, and quarantines non-compliant devices.

Forescout eyeExtend

Forescout integration layer that coordinates context-sharing and orchestrates automated workflows with third-party security tools (firewalls, SIEM, vuln scanners).

Forescout eyeSight

Forescout foundational agentless visibility component that automatically discovers and classifies all IP-connected devices connected to the network.

Financial-grade API

OpenID Foundation security profile for high-value APIs (open banking, payments). FAPI 2.0 requires PKCE, PAR, and sender-constrained tokens (DPoP or mTLS).

Fast Identity Online

Authentication standard enabling passwordless login using biometrics or security keys.

Financial Data Exchange

Open, interoperable technical standard for secure, permissioned, credential-free financial data sharing using OAuth 2.0 and DPoP; replaces screen scraping in open banking.

File Integrity Monitoring

Detecting unauthorized changes to critical system files, configurations, and content.

Forescout Cybersecurity Platform

Enterprise cybersecurity platform providing agentless device discovery, posture assessment, and dynamic network access control (eyeSight, eyeControl, eyeExtend) across IT, IoT, OT, and IoMT.

Generative Adversarial Network

Two neural networks (generator and discriminator) trained against each other to produce realistic synthetic data; behind many deepfakes and synthetic identity fraud.

General Data Protection Regulation

EU regulation on data protection and privacy, with strict requirements for handling personal data.

GPT-Generated Unified Format

Single-file model format used by llama.cpp and local LLM runtimes. It carries no pickle code, but loader parser bugs and embedded Jinja chat templates (CVE-2024-34359 SSTI) make it a model-scanning target.

Graphics Processing Unit

Parallel processor used to train and serve AI models; GPU clusters need isolation (e.g. NVIDIA MIG), usage monitoring, and cost alerts because they host model weights and are costly to abuse.

GitHub Advanced Security

Enterprise application security suite natively integrated into GitHub, comprising CodeQL SAST, secret scanning with push protection, Dependabot SCA, and Copilot Autofix.

Gramm-Leach-Bliley Act

U.S. federal law requiring financial institutions to explain their information-sharing practices to customers and safeguard sensitive Non-Public Personal Information (NPI) via administrative, technical, and physical security controls under the FTC Safeguards Rule.

Graph Neural Network

Deep learning architecture that operates on graph-structured data — used in cybersecurity for malware detection, network intrusion analysis, threat actor attribution, and fraud detection by modeling relationships between entities.

Governance, Risk, and Compliance

Integrated approach to managing governance, enterprise risk, and regulatory compliance.

Generic Routing Encapsulation

Tunneling protocol that encapsulates packets inside IP packets — used to create point-to-point tunnels between networks. Often combined with IPSec for encryption.

Globally Unique Identifier

A 128-bit pseudo-random value used to uniquely identify resources, records, or canary strings across distributed software systems and AI data pipelines without a central coordinator.

Hypothetical Document Embeddings

Query-rewrite technique where the LLM (Large Language Model) drafts a hypothetical answer, and that draft is embedded to retrieve closer-matching real documents.

Health Insurance Portability and Accountability Act

US regulation for protecting sensitive patient health information from being disclosed without consent.

Host-based Intrusion Detection System

Monitors a single host for suspicious activity, unauthorized changes, and policy violations.

Host-based Intrusion Prevention System

Monitors system calls, file modifications, and registry changes on individual hosts to detect and block exploitation attempts in real-time.

Human-in-the-Loop

Security control requiring human approval before AI agents execute high-risk actions — prevents autonomous systems from making destructive decisions without oversight.

Hardware Security Module

Physical device that safeguards and manages digital keys for encryption and decryption.

Hold Your Own Key

The strictest key control model where cryptographic keys never leave the customer's on-premises HSM, and cloud services invoke external key APIs to perform encryption/decryption operations.

Infrastructure as Code

Managing infrastructure through machine-readable definition files rather than manual processes.

Identity and Access Management

Framework of policies and technologies for managing digital identities and controlling resource access.

Interactive Application Security Testing

Combines SAST and DAST by analyzing code from within a running application for real-time results.

Internet Content Adaptation Protocol

Protocol for offloading HTTP content to external servers for processing — used by proxies and web gateways for antivirus scanning, DLP, and content filtering.

Identity Management

Systems and processes for managing the lifecycle of digital identities — creation, modification, deactivation, and deletion of user accounts across enterprise systems.

Internal Developer Platform

Self-service layer built by platform engineering teams that abstracts infrastructure complexity — developers provision, deploy, and manage services through golden paths and software catalogs without DevOps tickets. Tools: Backstage, Port.io, Cortex, Humanitec.

Insecure Direct Object Reference

Access control flaw (CWE-639) where changing an object ID in a request exposes another user's data. Same class as OWASP API BOLA; fixed with caller-scoped queries and centralized authorization.

Intrusion Detection System

System that monitors network traffic for suspicious activity and issues alerts.

Identity Governance and Administration

Processes for managing digital identity lifecycle including provisioning, access reviews, and SoD.

Identity Governance as a Service

Cloud-delivered IGA platform model where governance capabilities (access certifications, SoD, role management) are consumed as a service. Key vendors: Saviynt, SailPoint IdentityNow. Eliminates on-prem IGA infrastructure.

Indicator of Compromise

Forensic evidence such as IP addresses, file hashes, or domains that indicate a potential security breach.

Internet of Things

Network of interconnected devices (sensors, cameras, smart devices) that collect and exchange data — expanding the attack surface.

IP Address Management

Centralized planning, tracking, and management of IP address spaces across on-prem data centers, branch offices, and multi-cloud VPCs/VNets to prevent CIDR overlapping.

Intrusion Prevention System

Network security tool that monitors traffic and takes action to block detected threats.

Internet Protocol Security

Suite of protocols for securing IP communications by authenticating and encrypting each packet. Operates in Transport Mode (payload only) or Tunnel Mode (entire packet). Core of site-to-site VPNs.

IAM Roles for Service Accounts

AWS EKS mechanism that associates Kubernetes ServiceAccounts with AWS IAM roles using OIDC federation, issuing pods short-lived ephemeral credentials without hardcoding static access keys.

International Organization for Standardization

Global body that publishes security standards including ISO 27001 (ISMS), ISO 42001 (AI), and ISO 22301 (BCM).

Information Technology

The use of computers, networks, and systems to store, process, and manage data and information.

Information Technology Service Management

Framework and platforms (e.g., ServiceNow, Jira Service Management) for managing IT services, ticketing workflows, incident resolution, and SLA-governed vulnerability remediation dispatches.

Interactive Voice Response

Automated telephony system that interacts with callers using voice and keypad input. An example of Level 1 (Reactive) AI agents — follows pre-programmed rules and responds to direct inputs.

Just-In-Time (Access)

Security model that provides temporary, time-limited privileged access only when needed.

JFrog Platform (Artifactory + Xray)

Universal artifact management (Artifactory) and binary-level SCA/vulnerability scanning (Xray). Supports Docker, Maven, npm, PyPI, Helm, and 30+ package types. Integrates into IDP golden paths as the artifact store and security gate — blocks vulnerable packages before they reach production.

JSON Web Encryption

RFC 7516 format for encrypting JWT contents, so claims stay confidential (unlike JWS, which is only signed and readable by anyone).

JSON Web Key Set

JSON data structure representing a set of public keys used to verify JWT signatures. Hosted at a well-known endpoint — critical for OAuth2/OIDC token validation.

JSON Web Signature

RFC 7515 format for digitally signed JWTs. It guarantees integrity and authenticity but NOT confidentiality, because the payload is only base64url-encoded.

JSON Web Token

Compact, URL-safe token format for securely transmitting information between parties as a JSON object.

Knowledge Graph

Graph of entities and relationships (e.g. Neo4j) that GraphRAG traverses to answer multi-hop and root-cause questions vector search alone misses.

Known Exploited Vulnerabilities

CISA-maintained catalog of vulnerabilities that are actively exploited in the wild.

Key Management Service

Cloud service for creating and managing cryptographic keys used to encrypt data.

Key Risk Indicator

Forward-looking quantitative metric indicating changes in an organization's risk profile or tracking when risk exposures approach established risk appetite limits.

Kubernetes Security Posture Management

Automates security and compliance for Kubernetes clusters — detects misconfigurations, excessive permissions, and vulnerabilities in containerized environments.

Long Short-Term Memory

Type of RNN (Recurrent Neural Network) that remembers long sequences; used for time series and log analysis before transformers became dominant.

Layer 2 Tunneling Protocol

VPN tunneling protocol that operates at Layer 2 — typically paired with IPSec for encryption (L2TP/IPSec). Less performant than IKEv2 but widely supported.

LangGraph Stateful Agent Framework

LangChain framework for building stateful, multi-agent AI workflows using directed graphs — supports cycles, persistence, and human-in-the-loop. Ideal for complex conditional agent logic.

Local Administrator Password Solution

Microsoft solution that automatically manages and randomizes unique administrator passwords on local computer accounts across domain-joined Windows machines, preventing pass-the-hash lateral pivots.

Lightweight Directory Access Protocol

Protocol for accessing and maintaining distributed directory information services.

Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, Non-compliance

Privacy-focused threat modeling framework, used alongside STRIDE for features that process personal data.

Large Language Model

AI model trained on vast text data capable of generating and understanding human language.

Low-Rank Adaptation

Parameter-efficient fine-tuning technique that freezes the base LLM and adds small trainable matrices (adapters) to specific layers — trains only 0.1-1% of parameters while achieving near full fine-tuning accuracy.

Media Access Control Security (802.1AE)

Layer 2 cryptographic protocol providing line-rate hardware encryption and integrity verification across point-to-point Ethernet links and dedicated cloud interconnect circuits (AWS Direct Connect, Azure ExpressRoute).

Multi-Agent System

Architecture where several specialist AI agents (e.g. supervisor, researcher, analyst, critic) coordinate on one task; needs per-agent identity, shared-state integrity checks, loop and cost caps, and end-to-end tracing.

Model Context Protocol

Open JSON-RPC standard connecting LLMs to external developer tools, enterprise databases, and APIs with strict schema validation and security sandboxing.

Mobile Device Management

Enterprise solution for managing and securing mobile devices — enforce security policies, remote wipe, app management, and compliance checking for BYOD and corporate devices.

Managed Detection and Response

Outsourced security service providing 24/7 threat monitoring, detection, and response.

Multi-Factor Authentication

Authentication method requiring two or more verification factors (knowledge, possession, inherence).

MITRE Corporation

Not-for-profit research organization operating federally funded R&D centers, maintaining CVE, CWE, CAPEC, and the MITRE ATT&CK framework.

Adversarial Tactics, Techniques & Common Knowledge

Knowledge base of adversary tactics and techniques used for threat modeling and security assessments.

Man in the Middle

Attack where an adversary secretly intercepts and potentially alters communication between two parties.

Machine Learning

Subset of AI where systems learn from data to improve performance — used in anomaly detection, threat hunting, and UEBA.

Machine Learning Detection & Response

Real-time cybersecurity defense category (pioneered by HiddenLayer) that inspects AI model inference inputs and outputs inline (<5ms) to intercept prompt injection, extraction, and adversarial evasion.

Machine Learning Operations

Practices and engineering toolchains for deploying, automating, monitoring, and governing machine learning workflows and models reliably in production.

Machine Learning Security Operations

Integration of security, privacy, and compliance into every phase of the MLOps lifecycle — covering data pipeline integrity, SafeTensors conversion, model scanning, Cosign attestation, adversarial red teaming, and runtime inline defense.

AI Model Drift

Silent degradation of AI model outputs over time as real-world data distribution shifts from training data. Causes reliability erosion, incorrect decisions, and compliance violations without any visible alert. Detected via continuous monitoring (Arize AI, WhyLabs).

AI Model Theft & Extraction

Adversarial attack (MITRE ATLAS AML.T0024) where an attacker clones or steals a proprietary AI model via query-based extraction/distillation, direct weight exfiltration, insider threats, or side-channel leakage.

Multiprotocol Label Switching

High-performance routing technique that directs data using short labels instead of long network addresses. Used in enterprise WANs — being replaced by SD-WAN in many deployments.

Managed Security Service Provider

Third-party company that provides outsourced monitoring and management of security devices and systems.

Mutual Transport Layer Security

Two-way TLS authentication where both client and server verify each other's certificates — essential for zero trust, microservices communication, and API security.

Mean Time Between Failures

Average time between system failures — a reliability metric used in availability planning and SLA management.

Mean Time to Acknowledge

Average time taken for a security team to acknowledge an alert or incident after it is generated.

Mythos Remediation Framework

Enterprise platform modernization and vulnerability burn-down roadmap that combines runtime reachability telemetry, dynamic EPSS scoring, and AI-assisted batch remediation to eliminate tech debt.

Mean Time to Contain

Average time taken to contain a security incident after detection, limiting its spread and impact.

Mean Time to Detect

Average time taken to detect a security incident or threat from the moment it occurs.

Mean Time to Respond / Remediate

Average time taken to respond to or remediate a security incident or vulnerability.

Network Access Control

Security technology that controls network access by dynamically discovering and authenticating devices and verifying their security posture compliance.

Network Access Control List

Optional layer of security that acts as a firewall for controlling traffic in and out of subnets.

Network Detection and Response

Analyzes network traffic in real-time to detect and respond to threats and anomalous activity.

Next-Generation Firewall

Advanced firewall beyond traditional packet filtering — includes deep packet inspection (DPI), application awareness, IPS, TLS decryption, and threat intelligence integration. Leaders: Palo Alto, Fortinet, Check Point.

Non-Human Identity

Digital identities for machines, services, API keys, service accounts, and AI agents — as opposed to human user identities. NHIs now outnumber human identities 45:1 in enterprises and are a top identity attack vector.

Non-Human Traffic

Automated bot traffic on networks and websites — includes scrapers, crawlers, and malicious bots that can skew data or attack systems.

Network Intrusion Detection System

Monitors network traffic for suspicious patterns using signature-based and anomaly-based detection.

National Institute of Standards and Technology

US federal agency that develops cybersecurity frameworks, guidelines, and standards.

NIST Artificial Intelligence Risk Management Framework

NIST AI 100-1 voluntary framework for managing risks and ensuring trustworthiness (valid, reliable, safe, secure, explainable, privacy-preserving, fair) across enterprise AI and MLOps lifecycles.

Network Operations Center

Centralized team that monitors and manages network health, uptime, and performance 24/7.

Non-Public Personal Information

Any personally identifiable financial information that a financial institution collects about an individual in connection with providing a financial product or service (GLBA Safeguards Rule).

National Vulnerability Database

NIST-maintained repository that enriches CVEs with CVSS scores, CWE mapping, and affected product data (CPE).

Open Authorization

Authorization framework that enables third-party applications to obtain limited access to user accounts.

Optical Character Recognition

Technology that extracts text from images, scanned documents, and PDFs. Used in DLP for detecting sensitive data in image-based files and in document analysis AI agents.

OpenID Connect

Identity layer on top of OAuth 2.0 for verifying user identity and obtaining basic profile information.

Open Neural Network Exchange

Open, framework-neutral model format (protobuf graph plus weights). There is no code execution by design, but custom operator domains and external_data path traversal should be checked by model scanners.

Out-of-Band Authentication

Secondary verification mechanism that operates through a completely separate communication channel (e.g. mobile push notification with biometric confirmation) to authorize high-risk transactions.

Open Policy Agent

General-purpose policy engine for unified policy enforcement across the cloud-native stack.

Operational Technology

Hardware and software that monitors and controls physical processes in industrial environments (SCADA, ICS, PLCs).

OpenTelemetry

Vendor-neutral standard for traces, metrics and logs; in AI systems it records prompts, retrieval hits, tool calls and token usage per request for audit and evaluation.

Open Web Application Security Project

Nonprofit foundation producing tools, documentation, and standards for application security.

Policy-as-Code

Practice of defining, managing, and automating security, architectural, and compliance policies using machine-readable code (e.g. OPA/Rego, Kyverno) evaluated directly in CI/CD pipelines.

Privileged Access Management

Securing, controlling, and monitoring privileged accounts and access to critical systems.

Process for Attack Simulation and Threat Analysis

A 7-stage risk-centric threat modeling methodology that aligns technical application vulnerabilities with business objectives, asset impact, and real-world attacker simulation.

Privileged Access Workstation

Dedicated, hardened physical workstation used exclusively for sensitive administrative tasks (Tier 0 / Cloud Admin) with internet access and email disabled to stop credential theft.

Payment Card Industry Data Security Standard

Security standard for organizations handling credit card data to prevent fraud and breaches.

Policy Decision Point

Logical Zero Trust entity (NIST SP 800-207) comprising the Policy Engine and Policy Administrator that evaluates identity, device posture, and context signals to grant or deny access.

Parameter-Efficient Fine-Tuning

Family of techniques (LoRA, QLoRA, prefix tuning, prompt tuning) for adapting LLMs to specific tasks without updating all model parameters — drastically reduces compute cost and prevents catastrophic forgetting.

Policy Enforcement Point

Logical Zero Trust component (gateway, reverse proxy, ZTNA connector, or service mesh sidecar) that intercepts, gates, and terminates connections between users and protected enterprise resources based on PDP decisions.

Personally Identifiable Information

Any data that could identify a specific individual, such as SSN, email, or biometric data.

Proof Key for Code Exchange

OAuth extension (RFC 7636, pronounced "pixy") that binds the authorization request to the token request with a code_verifier/code_challenge pair to prevent authorization code interception. Mandatory in OAuth 2.1.

Public Key Infrastructure

Framework for managing digital certificates and public-key encryption to enable secure communication.

Payment Services Directive 2

European banking regulation that mandated Open Banking, Strong Customer Authentication (SCA), and Dynamic Linking for electronic payment transactions.

Potentially Unwanted Program

Software that may be installed without clear user consent — includes adware, toolbars, and bundled software that can pose security risks.

Qualys Detection Score

Qualys TruRisk vulnerability rating (scored 1 to 100) combining CVSS, real-time threat indicators (RTI: exploit public, malware active, zero-day), and machine learning exploit prediction algorithms to measure the objective exploitability of a specific QID.

Qualys Query Language

Search syntax utilized across Qualys VMDR, CSAM, and TruRisk APIs to filter assets and vulnerabilities (e.g., vulnerabilities.vulnerability.severity:5 and vulnerabilities.status:[ACTIVE, RE-OPENED]) for targeted BI payload extraction.

Quantum Computing

Next-generation computing using quantum bits — poses a future threat to current encryption algorithms (RSA, ECC) and drives post-quantum cryptography research.

Quantized Low-Rank Adaptation

Extension of LoRA that adds 4-bit quantization — enables fine-tuning large LLMs (65B+ parameters) on a single GPU by reducing memory requirements while maintaining quality.

Row-Level Security

Data security mechanism in Microsoft Power BI and Tableau that restricts data access at the row level based on user identity (e.g., DAX USERPRINCIPALNAME() or Tableau USERNAME()), ensuring asset owners only see their assigned vulnerabilities while CISOs view global risk.

Reinforcement Learning from Human Feedback

Training step where humans rank model outputs and the model is tuned to prefer the higher-ranked ones; how LLMs (Large Language Models) learn helpfulness and refusal behavior.

Recurrent Neural Network

Neural network that processes sequences step by step while keeping a memory of earlier steps; largely replaced by transformers for language tasks.

RAG Assessment

Open-source evaluation framework for RAG (Retrieval-Augmented Generation) pipelines measuring context precision, context recall, faithfulness and answer relevance.

Reciprocal Rank Fusion

Simple rank-merging method that combines result lists from multiple retrievers (e.g. BM25 keyword and vector search) by summing 1/(k + rank) per document.

Ransomware as a Service

Cybercrime business model where ransomware operators lease their malware to affiliates.

Responsible, Accountable, Consulted, Informed

Responsibility assignment matrix ensuring every activity has exactly one Accountable owner; used to define ownership in security and AI governance operating models.

Retrieval-Augmented Generation

AI architecture that enhances LLM responses by retrieving relevant data from external knowledge bases.

Remote Administration Tool

Software that allows remote control of a computer — legitimate for IT support but often used maliciously as a backdoor.

Role-Based Access Control

Access control model that assigns permissions based on organizational roles rather than individual users.

Regulation E (Electronic Fund Transfer Act)

Federal regulation (12 CFR Part 1005) governing consumer rights and financial institution liabilities for unauthorized electronic fund transfers, imposing a strict $50 customer liability limit if reported promptly.

Resource Control Policy

AWS Organizations policy type that establishes an organization-wide data perimeter by restricting the permissions that resource-based policies can grant, preventing data exfiltration.

Recovery Point Objective

Maximum acceptable amount of data loss measured in time — how far back you can restore.

Robotic Process Automation

Software technology that automates repetitive, rule-based business tasks. An example of Level 5 (Autonomous) AI agents — executes decisions independently with minimal human oversight.

Ransomware Readiness Program

Organizational preparedness framework for ransomware attacks — includes backup validation, incident response playbooks, communication plans, and recovery procedures.

Recovery Time Objective

Maximum acceptable downtime — how quickly systems must be restored after a disaster.

Small Language Model

Compact language model (typically under ~10B parameters, e.g. Phi, Gemma, Mistral 7B) that can run on-device or on a single GPU; lower cost and latency, often used as a guardrail or router model.

Support Vector Machine

Classical machine learning classifier that finds the boundary with the widest margin between classes; still used for spam and malware detection.

Hugging Face SafeTensors Storage Format

A safe, fast file format for storing and loading raw tensor byte-arrays without executing arbitrary Python bytecode, preventing pickle-based Remote Code Execution (RCE).

Security Assertion Markup Language

XML-based standard for exchanging authentication and authorization data between identity providers and SPs.

Secure Access Service Edge

Cloud-delivered architecture combining SD-WAN with security functions (SWG, CASB, ZTNA, FWaaS) into a single service. Gartner-coined term — leaders: Zscaler, Palo Alto Prisma, Netskope.

Static Analysis Results Interchange Format

OASIS JSON standard for scanner output. Lets SAST/SCA/IaC results from different tools be uploaded, deduplicated, and shown in one place (GitHub code scanning, ASPM platforms).

Static Application Security Testing

Analyzing source code for vulnerabilities without executing the program. Shift-left security.

Software Bill of Materials

Inventory of all components in software — critical for identifying affected systems when new CVEs drop.

Software Composition Analysis

Identifying open-source components and their known vulnerabilities in a codebase.

Security Content Automation Protocol

NIST standard suite of specifications (including OVAL, XCCDF, and CPE) for automating vulnerability management, measurement, and policy compliance evaluation across IT systems.

System Defined Control

Pre-built, curated configuration check maintained by Qualys Research that assesses systems against official security baselines (CIS Benchmarks, DISA STIG).

Software Package Data Exchange

Linux Foundation open standard (ISO/IEC 5962) for SBOMs — describes components, licenses, and copyrights. Exported by SCA tools like Black Duck and Mend alongside CycloneDX.

Software Security Center (Fortify)

OpenText Fortify central management console that aggregates SAST/DAST results, supports collaborative triage and audit, and enforces AppSec policy across portfolios.

Server-Side Request Forgery

Flaw (CWE-918) where a server fetches an attacker-controlled URL, reaching internal services or cloud metadata (169.254.169.254). Fixed with host allow-lists, resolved-IP checks, no redirects, and egress controls.

Sender Policy Framework

Email authentication protocol that specifies authorized mail servers for a domain via DNS TXT records. Prevents email spoofing when combined with DKIM and DMARC.

System for Cross-domain Identity Management

Standard for automating user provisioning and deprovisioning across multiple systems.

Service Control Policy

AWS Organizations policy that sets permission guardrails across all accounts in an organization.

Software-Defined Wide Area Network

Virtualized WAN architecture that uses software to manage connectivity and traffic — replaces traditional MPLS with centralized control, multi-path routing, and application-aware policies.

Software Development Lifecycle

Process for planning, creating, testing, and deploying software systems.

Security Information and Event Management

Platform that aggregates and analyzes security log data from across the enterprise for threat detection.

Supply-chain Levels for Software Artifacts

Framework for ensuring the integrity of software artifacts throughout the supply chain.

Security Orchestration, Automation & Response

Platform that automates security operations through playbooks, reducing response time.

Security Operations Center

Centralized team that monitors, detects, analyzes, and responds to security incidents 24/7.

Service Organization Control 2

Audit framework for evaluating service providers' controls for security, availability, and privacy.

Segregation of Duties

Principle that no single individual should control all aspects of a critical transaction.

Sarbanes-Oxley Act

US federal law requiring financial reporting transparency and internal control audits.

Secure Production Identity Framework for Everyone

Standard for establishing trust between workloads in dynamic, heterogeneous environments.

Structured Query Language Injection

Injection attack that inserts malicious SQL code into application queries to access or manipulate database data.

Security Service Edge

Cloud-delivered security stack — the security half of SASE without SD-WAN. Includes SWG, CASB, ZTNA, and DLP. Key for securing remote users accessing cloud apps.

Service Set Identifier

The name of a wireless network — attackers can create rogue SSIDs (evil twin attacks) to intercept traffic.

Secure Sockets Layer

Predecessor to TLS — cryptographic protocol for encrypting data in transit. Now deprecated in favor of TLS.

Secure Software Development Framework

NIST SP 800-218 set of secure development practices (Prepare, Protect, Produce, Respond) referenced by US federal software attestation requirements.

Single Sign-On

Authentication scheme allowing users to log in once and access multiple systems without re-authenticating.

Stakeholder-Specific Vulnerability Categorization

CISA and Carnegie Mellon decision tree methodology for vulnerability prioritization, categorizing actions into Track, Track*, Attend, and Act based on exploitation status, exposure, and mission impact.

SaaS Security Posture Management

Monitors and remediates misconfigurations in SaaS applications (M365, Salesforce, Slack) — enforces security policies across SaaS sprawl.

Security Technical Implementation Guide

Department of Defense (DISA) cybersecurity configuration standard for hardening computing hardware and software infrastructure.

STRIDE Threat Modeling

Microsoft-developed threat modeling framework categorizing threats into: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Secure Web Gateway

Inspects and filters web traffic to enforce acceptable use policies, block malware downloads, and provide SSL inspection. Key component of SASE architecture alongside CASB and ZTNA.

Qualys TruRisk Scoring Algorithm

Risk quantification methodology in Qualys VMDR that evaluates vulnerabilities by multiplying Asset Criticality Score (ACS 1-5) by Qualys Detection Score (QDS 1-100) and Real-Time Threat Indicators (RTIs), generating a normalized 1-1000 risk score for BI reporting.

Threat Intelligence

Evidence-based knowledge about existing or emerging threats, used to inform security decisions and prioritize defenses.

Traffic Light Protocol

Standard for labeling sensitivity of shared threat intelligence (White, Green, Amber, Red).

Transport Layer Security

Cryptographic protocol providing end-to-end encryption for data in transit over networks.

Time-based One-Time Password

Algorithm that generates temporary passcodes based on a shared secret and current time.

Tactics, Techniques & Procedures

The behavior patterns and methods used by threat actors, as categorized by MITRE ATT&CK.

User Defined Control

Custom configuration check created in Qualys Policy Compliance (PC) to assess proprietary files, registry keys, WMI queries, or command outputs not covered by standard CIS benchmarks.

User Datagram Protocol

Connectionless transport protocol — fast, no handshake, no guaranteed delivery. Used for DNS, VoIP, video streaming, and gaming. DTLS adds security for UDP traffic.

User and Entity Behavior Analytics

Analyzes user and device behavior patterns to detect insider threats and compromised accounts.

Unified Threat Management

All-in-one security appliance combining firewall, IDS/IPS, antivirus, content filtering, VPN, and anti-spam in a single device. Suited for SMBs — enterprises prefer NGFW + best-of-breed.

Variational Autoencoder

Generative neural network that compresses data into a compact representation and reconstructs it; high reconstruction error is a common anomaly-detection signal.

Vision-Language Model

Multimodal model that reads images and text together (e.g. GPT-4o, Gemini, ColPali), used to embed or interpret PDF (Portable Document Format) pages and slides in multimodal RAG.

Virtual Local Area Network

Logical network segmentation at Layer 2 — isolates broadcast domains without physical separation. Critical for microsegmentation and reducing lateral movement in network security.

Virtual Private Cloud

Logically isolated section of a cloud provider's network where you can launch resources securely.

Vulnerabilities Per Device

Metric tracking the average number of vulnerabilities per device — used to measure security posture and remediation progress.

Virtual Private Network

Encrypted tunnel between a device and a network, providing secure remote access.

Web Data Connector

Tableau data connection framework allowing developers to pull data from REST APIs (e.g. Qualys VMDR API, Tenable.io API) into Tableau using JavaScript / HTML before migrating to enterprise warehouse pipelines.

Web Application Firewall

Layer 7 firewall that filters HTTP/HTTPS traffic to protect web applications from attacks.

Explainable Artificial Intelligence

Set of techniques that make AI model decisions interpretable and transparent — critical for regulated industries (healthcare, finance) where AI decisions must be auditable and justifiable.

Extended Detection and Response

Unified security platform that collects and correlates data across endpoints, networks, and cloud.

Cross-Site Scripting

Injection attack where malicious scripts are injected into trusted websites to execute in users' browsers.

YAML Ain't Markup Language

Human-readable data serialization format widely used in DevSecOps for configuration files (Kubernetes, Ansible, CI/CD pipelines).

Yet Another Recursive Acronym

Pattern-matching tool used by malware researchers and SOC analysts to identify and classify malware samples based on rules.

Zero Data Retention

LLM (Large Language Model) provider agreement under which prompts and completions are not stored or used for training after the request completes.

Zscaler Private Access

Zscaler's ZTNA solution — provides zero trust access to private applications without exposing the network. Connects users to apps, not the network.

Zero Trust Architecture

Security model based on "never trust, always verify" — no implicit trust for any user or device.

Zero Trust Edge

Gartner concept converging networking and security at the edge — combines ZTNA, SD-WAN, SWG, and CASB into cloud-delivered edge services. Aligns with SASE architecture.

Zero Trust Network Access

Replaces traditional VPN with identity-aware, application-level access based on continuous verification.