The unique payment card number that identifies the issuer and the cardholder account.
Reference
Glossary
1,087 terms across information security, AI governance, privacy and the six focus areas, each defined in plain English with practical remarks.
Definitions are original MajorCyber™ explanations, researched and drafted with AI assistance and checked against official sources. They are not quotations from any standard or law; where wording matters, read the official text linked from the framework guides.
1,087 terms
No terms match your search. Try a shorter word or an abbreviation.
Search results
0–9
- 3-2-1 backup rule
-
Keep three copies of data, on two different types of media, with one copy off-site. Many teams now add one offline or immutable copy and zero restore errors (3-2-1-1-0).
- 802.1X
-
An IEEE standard for port-based network access control, which authenticates devices before they can use a wired or wireless network.
A
- AAA Authentication, authorisation and accounting
-
A framework for controlling access: verifying identity, granting permissions and recording what was done.
- Abuse case
-
A description of how a system feature could be misused by an attacker. Writing abuse cases alongside use cases surfaces security requirements early.
- Acceptable use policy AUP
-
Rules on how staff and other users may use an organisation's systems, data, devices and internet access.
- Access control
-
Mechanisms and policies that permit or deny access to resources based on identity, role, attributes or rules.
- Access review
-
Periodic checks, usually by managers or owners, that each user's access is still appropriate, with removals recorded. Also called access recertification.
Remarks Auditors look for complete user lists, evidence of real review and timely removals.
- Access token
-
A credential an application presents to an API to prove it has been authorised to access resources. It is usually short-lived.
- Account lockout
-
Temporarily disabling an account after a set number of failed login attempts, to slow down guessing.
Remarks It can be abused for denial of service; throttling and MFA are often better.
- Account takeover ATO
-
An attacker gaining control of a legitimate user's account, through stolen credentials, session theft or social engineering.
- Accountability
-
The principle that every action on a system can be traced to an identified person or process who is answerable for it.
Remarks Depends on unique identities, authentication and reliable logging. In privacy law the same word means the controller must be able to demonstrate compliance.
- Accountability principle
-
The principle that a controller is responsible for compliance and must be able to demonstrate it, for example through records, policies, assessments and audits.
- Accreditation
-
Formal recognition by an accreditation body, such as UKAS, ANAB or NABCB, that a certification body is competent and impartial.
Remarks Check that a certificate comes from an accredited body; unaccredited certificates carry little weight.
- Accuracy principle
-
The principle that personal data must be accurate and, where necessary, kept up to date, with inaccurate data corrected or erased without delay.
- ACME Automatic Certificate Management Environment
-
A protocol (RFC 8555) for automatically issuing and renewing certificates, popularised by Let's Encrypt.
- Active Directory AD
-
Microsoft's directory service for Windows networks that manages users, computers, groups and policies, and authenticates with Kerberos and NTLM.
Remarks A prime target in ransomware intrusions; tiered administration and monitoring are essential.
- Adequacy decision
-
A decision by the European Commission that a non-EU country provides an essentially equivalent level of data protection, allowing transfers without further safeguards.
- Administrative control
-
A management or procedural control, such as policies, training, background checks and risk assessments. Also called managerial control.
- Advanced persistent threat APT
-
A well-resourced, usually state-linked, threat actor that conducts long-term targeted intrusions for espionage, sabotage or financial gain.
Remarks Vendors name the same groups differently, for example APT29 is also known as Cozy Bear or Midnight Blizzard, so mapping names matters.
- Adversarial example
-
An input deliberately altered, often imperceptibly, to make a model produce a wrong output.
- Adversarial machine learning
-
The study of attacks on machine learning systems, including evasion, poisoning, privacy and model-extraction attacks, and of defences against them.
Remarks NIST AI 100-2 gives a common taxonomy and terminology.
- Adversary emulation
-
Reproducing the tactics, techniques and procedures of a specific, known threat actor to test defences against that actor.
- Adversary-in-the-middle phishing AitM phishing
-
Phishing that proxies the real login page in real time, capturing both the password and the session cookie, so it can bypass most MFA.
Remarks Phishing-resistant authentication such as FIDO2 or passkeys stops it, because the credential is bound to the real domain.
- AES Advanced Encryption Standard
-
The symmetric block cipher standardised by NIST in FIPS 197, with 128-, 192- or 256-bit keys. It is the default choice for encrypting data.
- Agentic AI
-
AI systems designed to act autonomously over multiple steps, often coordinating several agents and tools.
- AI agent
-
An AI system that can plan and take actions towards a goal with some autonomy, for example by calling tools, browsing, writing code or sending messages.
Remarks Agents widen the attack surface: secure their credentials, limit their tools and log their actions.
- AI bill of materials AIBOM
-
An inventory of the components of an AI system: models, data sets, libraries and their versions and origins. It extends the software bill of materials idea.
- AI disclosure
-
Telling people that they are interacting with an AI system, or that content was AI-generated or AI-assisted.
- AI governance
-
The policies, roles, processes and controls that direct how an organisation develops and uses AI responsibly, lawfully and in line with its risk appetite.
- AI impact assessment
-
An assessment of the potential consequences of an AI system for individuals, groups and society, such as its effects on rights, safety and fairness.
Remarks Required by ISO/IEC 42001 (guidance in ISO/IEC 42005). Related to, but broader than, a DPIA.
- AI incident
-
An event in which an AI system's development or use directly or indirectly causes, or nearly causes, harm to people, property, the environment or rights.
Remarks The OECD AI Incidents Monitor and the AI Incident Database track public cases.
- AI inventory
-
A register of the AI systems and models an organisation develops, buys or uses, with owners, purposes, risk classification and status.
Remarks The first step in AI governance, much as an asset inventory is for security.
- AI literacy
-
The skills, knowledge and understanding that let people use AI systems knowingly and judge their opportunities, risks and possible harms.
Remarks Under EU AI Act Article 4, providers and deployers must take measures to ensure sufficient AI literacy among their staff. This has applied since 2 February 2025.
- AI model
-
The trained mathematical component, with its parameters, that turns inputs into outputs. A model is one part of an AI system, alongside data pipelines, interfaces and controls.
- AI Office
-
The European Commission body that supervises general-purpose AI models and supports consistent application of the AI Act.
- AI regulatory sandbox
-
A controlled framework set up by an authority in which organisations can develop and test innovative AI under regulatory supervision for a limited time.
- AI risk management
-
Identifying, assessing and treating risks that AI systems pose to the organisation, individuals and society across the AI lifecycle.
Remarks ISO/IEC 23894 gives guidance; the NIST AI RMF organises it into Govern, Map, Measure and Manage.
- AI safety
-
The field concerned with preventing AI systems from causing accidental or deliberate harm, including through misuse, failures and loss of control.
- AI security
-
Protecting AI systems, their data, models and supply chain from attack, and preventing AI from being used to cause security harm.
Remarks Key references include the OWASP Top 10 for LLM Applications, MITRE ATLAS and NIST's adversarial machine learning taxonomy (AI 100-2).
- AI supply chain
-
The third-party models, data sets, libraries, plug-ins and services an AI system depends on, each of which can introduce risk.
Remarks Malicious model files and poisoned public data sets are real threats. Verify sources and scan artefacts.
- AI system
-
A machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions, with varying levels of autonomy.
Remarks This paraphrases the OECD and EU AI Act approach. Simple rule-based software usually falls outside it.
- AIMS AI management system
-
A management system for the responsible development, provision or use of AI, specified by ISO/IEC 42001.
Remarks ISO/IEC 42001 follows the same harmonised structure as ISO/IEC 27001, so the two integrate well.
- Air gap
-
Physical isolation of a system or network from any untrusted network, including the internet.
Remarks Used for highly sensitive and industrial systems. Removable media and maintenance connections are the usual ways air gaps are bridged.
- Alert fatigue
-
Desensitisation that occurs when analysts face too many alerts, especially false positives, leading to slow or missed responses.
- Alert triage
-
Quickly assessing incoming alerts to decide whether each is a false positive, benign activity, or a true threat needing investigation and escalation.
- Algorithmic discrimination
-
Unlawful or unjustified differential treatment of people caused by an automated system, for example in hiring, lending or housing decisions.
- Algorithmic impact assessment
-
An assessment of an automated decision system's risks and effects on people, often required for public sector use in some jurisdictions.
- Alignment
-
Making AI systems pursue the goals and values their designers and users intend, and avoid harmful behaviour.
- Allow-listing
-
Permitting only explicitly approved items, such as applications, IP addresses or domains, and blocking everything else.
Remarks Stronger than block-listing, but it needs maintenance. Application allow-listing is one of the ASD Essential Eight.
- Angler phishing
-
Using fake customer-support accounts on social media to intercept complaints and steal victims' details.
- Annex A
-
The annex of ISO/IEC 27001 that lists reference information security controls. The 2022 edition has 93 controls in four themes: organisational, people, physical and technological.
Remarks Controls are chosen based on risk; Annex A is a checklist against which choices are compared, not a mandatory list. ISO/IEC 27002 gives implementation guidance.
- Annualised loss expectancy ALE
-
The expected yearly cost of a risk, calculated as single loss expectancy multiplied by the annualised rate of occurrence.
Remarks SLE = asset value x exposure factor; ALE = SLE x ARO. Useful for comparing a risk with the yearly cost of a control.
- Annualised rate of occurrence ARO
-
The estimated number of times a risk event will happen in a year; 0.1 means once every ten years.
- Anomaly detection
-
Using statistics or machine learning to spot data points or behaviour that deviate from an expected baseline, such as unusual logins or traffic spikes.
- Anonymisation
-
Processing personal data so that individuals can no longer be identified by any means reasonably likely to be used. Truly anonymous data falls outside most data protection laws.
Remarks Hard to achieve. Combining data sets often re-identifies people, so test against realistic attacks.
- Antivirus
-
Software that detects and removes known malware, traditionally with signatures. It has largely evolved into broader endpoint protection.
- API security
-
Protecting application programming interfaces through authentication, authorisation on every object, input validation, rate limiting, inventory and monitoring.
- API security testing
-
Testing application programming interfaces for flaws such as broken object-level authorisation, excessive data exposure and missing rate limits.
- APPI Act on the Protection of Personal Information
-
Japan's data protection law, overseen by the Personal Information Protection Commission and substantially amended in recent years.
- Application control
-
Restricting which programs may run on a system, usually through allow-listing by publisher, path or hash.
- Application security AppSec
-
Practices and tools that find, fix and prevent security weaknesses in software throughout its design, development, deployment and operation.
- Application Security Verification Standard ASVS
-
OWASP's detailed list of security requirements and verification levels for designing, building and testing web applications and services.
Search Google for “Application Security Verification Standard” ↗
- Approved Scanning Vendor ASV
-
A company qualified by the PCI Security Standards Council to perform the external vulnerability scans that PCI DSS requires.
- ARP spoofing
-
Sending forged ARP messages on a local network to link the attacker's MAC address with another host's IP address, so that traffic is intercepted.
- Artificial intelligence AI
-
Technology that enables machines to perform tasks normally associated with human intelligence, such as recognising patterns, understanding language, making predictions and generating content.
Remarks Legal definitions differ. The EU AI Act and the OECD define an "AI system" by its ability to infer from inputs how to generate outputs that can influence environments.
- Asset
-
Anything of value to an organisation that needs protection: information, systems, software, hardware, services, people and reputation.
Remarks An asset inventory with named owners is the starting point for risk assessment and most control frameworks.
- Asset inventory
-
A maintained list of an organisation's assets, such as hardware, software, data, cloud resources and services, with owners and key attributes.
Remarks You cannot protect what you do not know you have. Automated discovery keeps it accurate.
- Asset owner
-
The person accountable for an asset's protection, classification and access decisions.
Remarks Ownership is accountability, not legal ownership. Technical custodians may operate the asset day to day.
- Assumed breach
-
A testing approach that starts from a foothold already in the network, such as a compromised laptop, to focus on detection and lateral movement.
- Assurance
-
Grounds for confidence that controls, systems or claims meet stated requirements, provided by testing, audit, certification or attestation.
- Asymmetric encryption
-
Encryption using a key pair: a public key that anyone may use and a private key that only its owner holds. Also called public-key cryptography.
- Attack path
-
The chain of weaknesses and steps an attacker could combine to get from an entry point to a valuable target.
- Attack surface
-
The total set of points where an attacker could try to enter, extract data from or affect a system: exposed services, interfaces, accounts, code and people.
Remarks Reducing it, by removing unused services, accounts and features, is one of the cheapest security improvements.
- Attack tree
-
A diagram that breaks an attacker's goal into the alternative and combined steps needed to achieve it.
- Attack vector
-
The path or method an attacker uses to reach a target, such as phishing email, an exposed remote desktop service or a compromised supplier.
- Attestation
-
A report in which an independent practitioner expresses an opinion on management's assertions or on a subject matter, such as a SOC 2 report issued by a CPA firm.
Remarks Attestation reports an opinion; it is not a pass or fail certificate.
- Attribute-based access control ABAC
-
Granting access by evaluating policies against attributes of the user, the resource, the action and the context, such as department, data classification or time.
- Attribution
-
Identifying who is responsible for a cyber operation, based on technical evidence, intelligence and context.
Remarks Hard and often uncertain. Analysts state confidence levels instead of certainty.
- Audit
-
A systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine whether criteria are met.
- Audit criteria
-
The requirements against which audit evidence is compared, such as a standard's clauses, a law or internal policies.
- Audit evidence
-
Records, statements and observations that are relevant to the audit criteria and can be verified, such as logs, tickets, configurations and interviews.
Remarks Strong evidence is system-generated, dated and complete for the period. Screenshots alone are weaker than exports with metadata.
- Audit finding
-
The result of comparing audit evidence with criteria: a conformity, a nonconformity or an observation or opportunity for improvement.
- Audit trail
-
A chronological record of activities that lets someone reconstruct who did what, when and to which resource.
Remarks Must be protected from tampering and kept for the period that laws and policies require.
- Authenticated encryption
-
Encryption that provides both confidentiality and integrity, so that tampering is detected, for example AES-GCM or ChaCha20-Poly1305.
- Authentication
-
Verifying that a claimed identity is genuine, using something you know, have or are.
- Authentication assurance level AAL
-
NIST's three levels of confidence in an authentication process. AAL3 requires a phishing-resistant, hardware-based authenticator.
- Authentication factor
-
A category of evidence used to authenticate: knowledge (password, PIN), possession (phone, security key, smart card) or inherence (fingerprint, face).
- Authenticity
-
Confidence that a person, system, message or piece of data is genuine and comes from the source it claims.
- Authorisation
-
Deciding what an authenticated identity is allowed to do or access.
- Authorisation letter
-
Written permission from the system owner allowing named testers to test specific targets at specific times. Sometimes called a "get out of jail free" letter.
Remarks Testing without authorisation may be a crime under computer misuse laws.
- Authority to operate ATO
-
A formal decision by an authorising official that a system's security risk is acceptable and the system may operate.
- Automated decision-making
-
Making decisions about people by technological means without meaningful human involvement.
Remarks GDPR Article 22 restricts solely automated decisions with legal or similarly significant effects. California's CPPA regulations add rules on automated decision-making technology (ADMT).
- Automation bias
-
The tendency of people to over-trust automated outputs and to miss or dismiss contradicting evidence.
- Availability
-
Making sure authorised users can reach systems and data when they need them, with acceptable performance.
Remarks Threatened by outages, ransomware and denial-of-service attacks. Protected by redundancy, backups, capacity planning and continuity arrangements.
- Awareness programme metrics
-
Measures of awareness programme effectiveness, such as reporting rate, simulation click rate, repeat clickers, incident trends, training completion and culture survey results.
B
- Backdoor (AI)
-
Hidden behaviour planted in a model through poisoning or tampering that activates only on a specific trigger input.
- Backup
-
A copy of data or systems kept so they can be restored after loss, corruption or attack.
Remarks Backups only count if restores are tested regularly. Keep at least one copy offline or immutable as protection against ransomware.
- Baiting
-
Luring victims with something enticing, such as a free download or an infected USB stick left where it will be found.
- Bastion host
-
A hardened server that is the only allowed entry point for administrative access into a protected network. Also called a jump box.
- Beaconing
-
Regular, often timed, call-backs from malware or an implant to its command-and-control server.
- Behaviour change
-
The goal of mature awareness programmes: shifting what people actually do, using methods such as nudges, habit design, feedback and making secure actions easy.
- Behavioural detection
-
Detecting threats by what they do, such as unusual process chains or credential access, rather than by what they look like.
- BGP hijacking
-
Announcing IP address ranges an attacker does not own through the Border Gateway Protocol, so internet traffic is redirected.
Remarks RPKI route origin validation reduces the risk.
- Bias (AI)
-
Systematic errors in an AI system's outputs that unfairly advantage or disadvantage certain people or groups. It is often inherited from data, design or deployment context.
Remarks NIST SP 1270 describes systemic, human and statistical sources of bias.
- BIMI Brand Indicators for Message Identification
-
A standard that displays a verified brand logo next to authenticated email in supporting inboxes. It requires an enforcing DMARC policy.
- Binding corporate rules BCRs
-
Internal data protection policies, approved by supervisory authorities, that allow a multinational group to transfer personal data between its companies worldwide.
- Biometric authentication
-
Authentication using physical or behavioural characteristics, such as fingerprint, face, iris or voice.
Remarks Biometrics cannot be changed if leaked, and they are sensitive data under many privacy laws. Match locally on the device where possible.
- Biometric data
-
Personal data from technical processing of physical, physiological or behavioural characteristics, such as fingerprints, face geometry or voice, that allows or confirms unique identification.
- Black-box testing
-
Testing with no prior knowledge of the target's internals, as an external attacker would see it.
- Blameless post-mortem
-
A post-incident review focused on system and process causes rather than individual blame, to encourage honest reporting.
- Block cipher
-
A cipher that encrypts fixed-size blocks of data, such as AES with 128-bit blocks, used with a mode of operation.
- Block-listing
-
Blocking items known to be bad and allowing everything else.
- Blue team
-
The defenders who protect, detect and respond to attacks, typically the SOC and incident response teams.
- Board oversight
-
The responsibility of an organisation's board of directors to understand, challenge and supervise how material risks, including cyber risk, are managed.
- Botnet
-
A network of compromised devices controlled by an attacker to send spam, launch denial-of-service attacks or spread malware.
- Breach and attack simulation BAS
-
Tools that continuously and automatically run safe attack scenarios against an environment to check whether controls prevent and detect them.
- Breach notification
-
The legal or contractual duty to tell regulators, affected individuals or customers about a breach within a set time.
Remarks Timelines vary widely: GDPR 72 hours to the authority; HIPAA up to 60 days to individuals; and sector rules can be as short as a few hours. Prepare templates and decision trees in advance.
- Break-glass account
-
A highly protected emergency account used only when normal administrative access fails, with strict monitoring and post-use review.
- Bridge letter
-
A letter from a service organisation covering the gap between the end of its last SOC report period and today, stating whether controls have materially changed.
- Bring your own key BYOK
-
Customers generating their own keys and importing them into a cloud provider's key service, for more control over encryption.
- Broken access control
-
Failures that let users act outside their intended permissions, such as viewing others' records by changing an ID in a URL.
Remarks Ranked first in the OWASP Top 10 (2021).
- Broken object level authorisation BOLA
-
The API form of IDOR, in which an API endpoint does not check that the caller may access the specific object requested. It is first in the OWASP API Security Top 10.
- Brute-force attack
-
Trying many possible passwords or keys until the right one is found.
- Buffer overflow
-
Writing more data to a memory buffer than it can hold, overwriting adjacent memory. It can cause crashes or code execution.
Remarks Largely prevented by memory-safe languages. Several governments encourage memory-safety roadmaps.
- Bug bounty
-
A programme that pays external researchers for responsibly reporting valid vulnerabilities, under published scope and rules.
- Business associate
-
Under HIPAA, a person or organisation that performs functions or services for a covered entity involving access to PHI, such as a cloud host or billing company.
Remarks A business associate agreement (BAA) is required, and business associates are directly liable for Security Rule compliance.
- Business associate agreement BAA
-
The contract HIPAA requires between a covered entity and a business associate, setting out how PHI may be used and protected.
- Business continuity
-
An organisation's capability to keep delivering products and services at acceptable levels during and after a disruption.
Remarks ISO 22301 specifies requirements for a business continuity management system.
- Business continuity management BCM
-
The ongoing process of identifying threats to continuity, analysing their impact and building plans and capabilities to respond and recover.
- Business continuity management system BCMS
-
The management system, specified by ISO 22301, that establishes, operates and continually improves business continuity.
- Business continuity plan BCP
-
Documented procedures that guide an organisation in responding to a disruption and maintaining or resuming critical activities.
- Business email compromise BEC
-
Fraud in which attackers compromise or impersonate business email accounts to trick staff into making payments, changing bank details or sending sensitive data.
Remarks Often involves no malware at all. Out-of-band verification of payment changes is the key control.
- Business impact analysis BIA
-
Analysing how a disruption would affect activities over time, to identify critical processes, their dependencies and recovery priorities and targets.
Remarks The BIA sets RTO, RPO and MTPD; without it, recovery plans are guesses.
- Business logic flaw
-
A vulnerability in how an application implements business rules, such as skipping a payment step or applying a discount twice, that scanners rarely find.
C
- C3PAO CMMC Third-Party Assessment Organization
-
An organisation authorised by the CMMC accreditation body (the Cyber AB) to carry out CMMC Level 2 certification assessments.
- CAIQ Consensus Assessments Initiative Questionnaire
-
The CSA's questionnaire, aligned to the Cloud Controls Matrix, that cloud providers complete to document their security controls.
- Callback verification
-
Phoning the requester on a number already on file, never one given in the request, before acting on a sensitive request.
- Capability maturity model
-
A staged scale, typically from initial or ad hoc up to optimised, for rating how well-defined and repeatable a process is.
- Capture the flag CTF
-
A security competition in which participants solve challenges, such as exploiting, decoding or investigating, to find hidden "flags".
Remarks Widely used for skills development and recruitment.
- Cardholder data environment CDE
-
The people, processes and technology that store, process or transmit cardholder or sensitive authentication data, plus connected systems. It defines PCI DSS scope.
- CCPA California Consumer Privacy Act
-
California's consumer privacy law, substantially amended by the CPRA. It gives residents rights to know, delete, correct and opt out of the sale or sharing of their personal information.
Remarks The California Privacy Protection Agency (CPPA) enforces it and has adopted regulations on automated decision-making technology, risk assessments and cybersecurity audits.
- CE marking
-
The mark a manufacturer or provider affixes to show a product conforms with applicable EU legislation, including the AI Act for high-risk AI systems and the Cyber Resilience Act.
- CEO fraud
-
A form of BEC in which the attacker impersonates a senior executive to pressure staff into urgent, confidential payments.
- CERT Computer emergency response team
-
A team that coordinates responses to cybersecurity incidents for a nation, sector or organisation and publishes advisories, for example CERT-In in India.
Remarks Also called a CSIRT (computer security incident response team).
- CERT-In Indian Computer Emergency Response Team
-
India's national agency for cyber incident response under MeitY. Its 2022 directions require specified incidents to be reported within six hours.
- Certificate authority CA
-
A trusted entity that issues and signs digital certificates after verifying the requester's identity.
- Certificate chain
-
The sequence of certificates from an end-entity certificate through intermediates to a trusted root.
- Certificate lifecycle management
-
Discovering, issuing, renewing and revoking certificates across an organisation, ideally automatically, to avoid outages from expired certificates.
Remarks Publicly trusted TLS certificate lifetimes are being cut in stages, which makes automation essential.
- Certificate revocation
-
Invalidating a certificate before it expires, for example after key compromise, published through CRLs or OCSP.
- Certification
-
Formal confirmation by an accredited independent body that an organisation, product or person meets a specified standard.
Remarks ISO/IEC 27001 certificates are issued by accredited certification bodies, not by ISO itself.
- Certification body
-
An independent organisation that audits and certifies management systems, products or people against standards.
- Chain of custody
-
A documented record of who collected, handled and stored evidence, and when, proving it was not altered.
- Change management
-
The process for requesting, assessing, approving, testing, implementing and reviewing changes to systems in a controlled way.
Remarks Auditors test that changes were approved and tested before release, and that emergency changes were reviewed afterwards.
- CHECK scheme
-
The UK National Cyber Security Centre scheme that approves companies and individuals to perform penetration tests on UK public sector and critical systems.
- Children's data
-
Personal data about children, which most laws protect more strictly. Examples are parental consent requirements and limits on profiling and targeted advertising.
Remarks The age threshold differs by law: for example, under 18 in India's DPDP Act, and 13 to 16 for online consent under the GDPR depending on the member state.
- CI/CD pipeline security
-
Protecting build and deployment pipelines (continuous integration and continuous delivery) and their secrets, runners and artefacts from tampering.
Remarks Compromised pipelines are a major software supply chain risk. Apply least privilege, signed artefacts and protected branches.
- CIA triad
-
The three core goals of information security: confidentiality, integrity and availability. Most controls exist to protect one or more of them.
Remarks Often extended with authenticity, accountability and non-repudiation. Risk assessments usually rate impact separately for each of the three.
- Cipher
-
An algorithm for encrypting and decrypting data.
- Ciphertext
-
Encrypted data that cannot be read without the decryption key.
- CIS Benchmarks
-
Consensus-based secure configuration guides from the Center for Internet Security for operating systems, cloud platforms, databases and applications.
- CIS Controls
-
The Center for Internet Security's prioritised set of 18 safeguard groups (version 8.1), organised into implementation groups IG1 to IG3 according to organisation size and risk.
Remarks IG1 is often described as essential cyber hygiene for small organisations.
- CISA Cybersecurity and Infrastructure Security Agency
-
The US federal agency that leads national efforts to defend critical infrastructure. It publishes the KEV catalogue and joint advisories.
Remarks Not to be confused with ISACA's CISA certification (Certified Information Systems Auditor).
- CISO Chief information security officer
-
The senior executive accountable for an organisation's information security programme, strategy and risk reporting to leadership.
Remarks Reporting lines vary: to the CIO, CEO, chief risk officer or board. Some regulators expect a named, adequately resourced security lead.
- CJIS Security Policy
-
The FBI's security requirements for organisations that access criminal justice information, including police agencies and their vendors.
- Clean desk policy
-
A rule that staff clear sensitive papers and devices away and lock screens when away from their desk.
- Click rate
-
The share of recipients who click a link in a phishing simulation. Also called failure rate.
Remarks Strongly affected by how hard the lure is, so compare like with like over time.
- Clone phishing
-
Copying a legitimate email the target has already received and resending it with malicious links or attachments swapped in.
- Cloud access security broker CASB
-
A control point between users and cloud services that gives visibility of cloud app use and enforces policies on data, access and threats.
- Cloud computing
-
On-demand network access to a shared pool of configurable computing resources that can be provisioned quickly with minimal management effort, as NIST SP 800-145 describes.
- Cloud Controls Matrix CCM
-
The Cloud Security Alliance's framework of cloud security controls, mapped to major standards and used with the STAR assurance programme.
- Cloud exit strategy
-
A documented plan for moving services and data away from a cloud provider if needed. Regulators such as DORA expect one for critical services.
- Cloud infrastructure entitlement management CIEM
-
Tools that analyse and right-size identities and permissions across cloud environments to enforce least privilege.
Search Google for “Cloud infrastructure entitlement management” ↗
- Cloud penetration test
-
Testing cloud configurations, identities and workloads within the provider's published testing rules.
Remarks Each provider sets its own policy on what may be tested without notice; some activities, such as stress testing, are restricted.
- Cloud security posture management CSPM
-
Tools that continuously check cloud configurations against best practice and compliance rules and flag misconfigurations.
- Cloud storage bucket
-
An object storage container, such as Amazon S3, Azure Blob or Google Cloud Storage, used to store files and data.
Remarks Publicly exposed buckets have caused many large data leaks. Block public access by default.
- Cloud workload protection platform CWPP
-
Security for cloud workloads such as VMs, containers and serverless functions, covering vulnerability scanning, hardening and runtime threat detection.
- Cloud-native
-
Applications designed to run in the cloud, using containers, microservices, managed services and automation.
- CMMC Cybersecurity Maturity Model Certification
-
The US Department of Defense programme that verifies whether defence contractors protect FCI and CUI. It has three levels and uses self-assessments or third-party assessments by C3PAOs.
- CNAPP Cloud-native application protection platform
-
An integrated platform that combines CSPM, CWPP, CIEM and code-to-cloud scanning to secure cloud-native applications across their lifecycle.
- COBIT
-
ISACA's framework for the governance and management of enterprise information and technology (COBIT 2019).
- Code of practice (GPAI)
-
A voluntary code, facilitated by the EU AI Office, that GPAI model providers can follow to show they comply with their AI Act obligations on transparency, copyright, safety and security.
- Code review
-
Examining source code, by peers or security specialists, to find defects and vulnerabilities before release.
- Code signing
-
Digitally signing software so users and systems can verify its publisher and that it has not been tampered with.
- Collision
-
Two different inputs that produce the same hash. Finding collisions practically breaks a hash function.
- Command and control C2
-
The infrastructure and channels an attacker or red team uses to send commands to and receive data from compromised systems.
Remarks Defenders hunt for beaconing patterns, unusual domains and encrypted traffic anomalies.
- Command injection
-
Injecting operating system commands through an application that passes user input to a shell.
- Common controls
-
Controls implemented once and inherited by many systems or used to satisfy several frameworks at the same time.
- Compensating control
-
An alternative control used when a required control cannot be implemented as specified, providing equivalent or sufficient risk reduction.
Remarks PCI DSS formalises this with a documented compensating control worksheet. Auditors expect evidence that the alternative genuinely covers the original intent.
- Complementary user entity controls CUECs
-
Controls that a SOC report assumes the customer will operate itself, such as managing its own users. The service organisation's controls rely on them.
- Complete mediation
-
The principle that every access to every resource is checked for authorisation, every time, rather than relying on an earlier check.
- Compliance
-
Meeting the requirements that apply to an organisation: laws, regulations, contracts, standards it has adopted and its own policies.
Remarks Compliance is necessary but not the same as security. A compliant organisation can still be breached, and a secure one can still miss a legal duty.
- Compliance automation
-
Using tools to collect evidence, monitor controls and track remediation automatically across frameworks.
Remarks Speeds audits, but tools only collect what they are connected to. Judgement and process evidence still need people.
- Concentration risk
-
Risk that arises when many critical services depend on a small number of providers, so one failure has wide impact.
Remarks A major focus of DORA for ICT third-party providers to financial entities.
- Concept drift
-
A change in the relationship between inputs and the correct output, so that patterns the model learned no longer hold.
- Conditional access
-
Policies that allow, block or require extra verification for access based on signals such as user, device health, location, application and risk.
- Confidence level (intelligence)
-
An analyst's stated degree of certainty in an assessment, such as low, moderate or high, based on the quality of sources and reasoning.
- Confidential computing
-
Protecting data in use by processing it inside hardware-based trusted execution environments that isolate it from the operating system, hypervisor and cloud operator.
- Confidentiality
-
Making sure information is seen only by people, systems or processes that are authorised to see it, whether it is stored, in transit or being processed.
Remarks Typical controls are access control, encryption and data classification. A data breach is usually a loss of confidentiality.
- Configuration management
-
Establishing and maintaining the consistency of systems' settings and components over their life, against approved baselines.
- Configuration management database CMDB
-
A repository of configuration items, such as servers, applications and services, and the relationships between them, used for IT service and change management.
- Conformity assessment
-
The process of showing that a product, such as a high-risk AI system, meets legal requirements before it is placed on the market, by internal control or with a notified body.
- Consent
-
A freely given, specific, informed and unambiguous indication of a person's agreement to processing, by a statement or clear affirmative action.
Remarks Must be as easy to withdraw as to give. Pre-ticked boxes and bundled consent are not valid under the GDPR or the DPDP Act.
- Consent Manager
-
Under India's DPDP Act, a registered entity that gives Data Principals a single, interoperable, transparent platform to give, manage, review and withdraw consent.
- Consent phishing
-
Tricking users into granting a malicious application OAuth permissions to their mailbox, files or data. No password theft is needed.
- Container
-
A lightweight, portable package of an application and its dependencies that runs isolated on a shared operating system kernel.
- Container image
-
An immutable template from which containers are created, built in layers and stored in a registry.
Remarks Scan images for vulnerabilities and secrets, use minimal base images, and sign images you trust.
- Container security
-
Protecting containers through their lifecycle: secure images, registry controls, least-privilege runtime settings, isolation and monitoring.
- Containment
-
Limiting the spread and impact of an incident, for example by isolating hosts, disabling accounts or blocking traffic, while preserving evidence.
- Content delivery network CDN
-
A distributed network of servers that caches and serves content close to users, and often adds DDoS protection and a web application firewall.
- Content provenance
-
Verifiable information about where digital content came from and how it was changed, for example Content Credentials based on the C2PA standard.
- Content Security Policy CSP
-
An HTTP response header that tells browsers which sources of scripts, styles and other content a page may load. It greatly reduces the impact of XSS.
- Context window
-
The maximum amount of input and output, measured in tokens, a language model can consider at once.
- Continual improvement
-
Ongoing activity to enhance the suitability, adequacy and effectiveness of a management system.
- Continuous control monitoring
-
Automated, ongoing checks that controls are in place and working, such as configuration scans, instead of only periodic manual reviews.
- Control activity
-
The specific action, policy or procedure that carries out a control, such as a quarterly access review performed by system owners.
- Control design effectiveness
-
Whether a control, if performed as described, would meet its objective.
- Control framework
-
A structured set of control objectives and controls used to design, implement and assess a security or compliance programme.
Remarks Examples include ISO/IEC 27001 Annex A, NIST SP 800-53, CIS Controls and COBIT.
- Control inheritance
-
Relying on controls provided by another system or provider, such as a cloud platform's physical security, rather than implementing them yourself.
Remarks Common in FedRAMP and cloud audits. The customer must still evidence its own share of responsibility.
- Control mapping
-
Linking the controls of one framework to equivalent requirements in others, so one control can provide evidence for several obligations.
Remarks Also called crosswalking. Mappings are aids, not proof: the details of each requirement still need checking.
- Control objective
-
A statement of what a control or group of controls is meant to achieve, such as "access to production data is restricted to authorised staff".
- Control owner
-
The person responsible for making sure a control is designed, operated and evidenced as intended.
- Control testing
-
Checking whether controls are designed and operating effectively, using inquiry, observation, inspection of evidence and re-performance.
- Controlled Unclassified Information CUI
-
US government information that needs safeguarding or dissemination controls under law, regulation or policy, but is not classified.
- Controller
-
The person or organisation that decides why and how personal data is processed, alone or with others (GDPR term).
Remarks Controllers carry primary accountability. Joint controllers share decisions and must arrange their respective responsibilities.
- Cookie consent
-
Permission obtained before storing or reading non-essential cookies or similar technologies on a user's device, as required by ePrivacy rules in the EU and UK.
Remarks Rejecting must be as easy as accepting. Strictly necessary cookies are exempt.
- Coordinated vulnerability disclosure CVD
-
A process in which a finder reports a vulnerability privately to the vendor, and details are published only after a fix is available or an agreed deadline passes.
- COPPA Children's Online Privacy Protection Act
-
US law requiring verifiable parental consent before online services collect personal information from children under 13.
- Corrective action
-
Action to remove the root cause of a nonconformity or incident and prevent it from happening again.
Remarks Different from a correction, which only fixes the immediate problem.
- Corrective control
-
A control that limits damage and restores normal operation after an incident, such as patching, restoring from backup or isolating a host.
- Correlation rule
-
Logic in a SIEM that links related events across sources and time to raise a meaningful alert.
- Covered entity
-
Under HIPAA, a health plan, a healthcare clearinghouse or a healthcare provider that conducts certain transactions electronically.
- CPRA California Privacy Rights Act
-
A 2020 ballot measure that amended the CCPA, adding sensitive personal information rights, correction rights and the California Privacy Protection Agency.
- Credential dumping
-
Extracting stored credentials, such as hashes, tickets or passwords, from a compromised system's memory, registry or files.
- Credential harvesting
-
Collecting usernames and passwords, usually through fake login pages, for later use or sale.
- Credential stuffing
-
Automatically trying username and password pairs leaked from one breach on other sites, exploiting password reuse.
- CREST
-
An international not-for-profit accreditation and certification body for technical security services and professionals, including penetration testing and incident response.
- Crisis communication
-
Planned, accurate and timely communication with staff, customers, regulators, media and partners during an incident.
- Crisis management
-
Leadership's coordinated response to a severe event that threatens the organisation. It covers decisions, stakeholder communication and continuity of critical operations.
- Critical ICT third-party provider CTPP
-
Under DORA, an ICT service provider designated as critical to the EU financial sector and directly overseen by the European Supervisory Authorities.
- Cross-site request forgery CSRF
-
Tricking a logged-in user's browser into sending an unwanted request to a site where they are authenticated.
Remarks Prevented with anti-CSRF tokens and SameSite cookies.
- Cross-site scripting XSS
-
Injecting malicious scripts into web pages viewed by other users, which can steal sessions or act as the user. It comes in reflected, stored and DOM-based forms.
Remarks Prevented by context-aware output encoding, safe frameworks and a strict Content Security Policy.
- Crossover error rate CER
-
The point at which the false acceptance and false rejection rates are equal; lower is better. Also called the equal error rate.
- Crypto-agility
-
The ability to swap cryptographic algorithms, keys and protocols quickly without redesigning systems.
- Crypto-shredding
-
Making encrypted data unrecoverable by securely destroying the keys that protect it.
Remarks Useful where physical media cannot be wiped, for example in cloud storage.
- Cryptographic inventory
-
A list of where and how cryptography is used across systems: algorithms, key lengths, certificates, libraries and protocols. Sometimes kept as a cryptographic bill of materials (CBOM).
- Cryptography
-
The science of protecting information with mathematical techniques, providing confidentiality, integrity, authentication and non-repudiation.
- CSA STAR Security, Trust, Assurance and Risk
-
The Cloud Security Alliance's public registry and assurance programme, in which cloud providers publish self-assessments or third-party certifications against the CCM.
- CSF functions
-
The six top-level outcomes of NIST CSF 2.0: Govern (strategy, policy, oversight), Identify (assets and risks), Protect (safeguards), Detect (finding events), Respond (acting on incidents) and Recover (restoring operations).
- CSIRT Computer security incident response team
-
A team responsible for receiving, analysing and responding to security incidents. NIS2 requires each EU member state to designate national CSIRTs.
- CVE Common Vulnerabilities and Exposures
-
A public catalogue that gives each disclosed vulnerability a unique identifier, such as CVE-2021-44228, run by the CVE Program with MITRE as its secretariat.
- CVSS Common Vulnerability Scoring System
-
An open framework, maintained by FIRST, for rating the technical severity of vulnerabilities on a 0 to 10 scale. Version 4.0 is current.
Remarks CVSS measures severity, not risk. Combine it with exploitability (such as EPSS or KEV) and business context to prioritise.
- Cyber Essentials
-
A UK government-backed certification scheme, run by the NCSC, covering five basic technical controls. Cyber Essentials Plus adds independent technical verification.
- Cyber hygiene
-
The routine basic practices that keep systems and users secure, such as patching, backups, MFA, strong passwords and caution with links.
- Cyber insurance
-
Insurance that covers losses from cyber incidents, such as response costs, business interruption, extortion and liability, subject to policy terms and exclusions.
Remarks Insurers increasingly require baseline controls, such as MFA and backups, before they offer cover.
- Cyber kill chain
-
Lockheed Martin's seven-stage model of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives.
Remarks Useful for thinking about where to break an attack; ATT&CK gives more granular detail.
- Cyber range
-
A controlled, virtual environment that simulates real networks and attacks, used for hands-on training and exercises.
- Cyber resilience
-
The ability to anticipate, withstand, recover from and adapt to cyber attacks and adverse conditions.
Remarks NIST SP 800-160 Vol. 2 gives engineering guidance.
- Cyber Resilience Act CRA, Regulation (EU) 2024/2847
-
The EU regulation setting cybersecurity requirements for products with digital elements across their lifecycle, including secure design, vulnerability handling and security updates.
Remarks Reporting of actively exploited vulnerabilities applies from 11 September 2026; most other obligations apply from 11 December 2027.
- Cybercrime-as-a-service
-
The criminal economy in which tools, infrastructure, access and expertise are sold or rented, lowering the barrier to attack.
- Cybercriminal
-
A threat actor motivated mainly by money, for example through ransomware, fraud, data theft or selling access.
D
- Dark patterns
-
Interface designs that steer, trick or pressure users into choices they would not otherwise make, such as hidden reject buttons.
Remarks Regulators treat them as invalidating consent. CPRA, the EU Digital Services Act and DPDP rules address them.
- Dark web
-
Parts of the internet reachable only with special software such as Tor, used for privacy but also for criminal markets and forums.
- Dark web monitoring
-
Watching criminal forums, markets and leak sites for an organisation's stolen credentials, data or mentions.
- Data breach
-
An incident in which information, often personal or confidential data, is accessed, disclosed, altered or lost without authorisation.
- Data classification
-
Assigning information to categories, such as public, internal, confidential and restricted, based on its sensitivity and the harm its loss would cause, so the right handling rules apply.
Remarks Classification is only useful when each level maps to clear handling, storage, sharing and disposal rules that people can follow.
- Data custodian
-
The person or team who looks after data day to day under the owner's direction: storing, backing up and applying the controls the owner requires.
- Data disposal
-
Securely destroying data or media at the end of its life so it cannot be recovered, for example by cryptographic erasure, overwriting or physical destruction.
Remarks NIST SP 800-88 is the common reference for media sanitisation.
- Data drift
-
A change in the statistical properties of input data compared with the training data.
- Data exfiltration
-
The unauthorised transfer of data out of an organisation by an attacker or insider.
- Data Fiduciary
-
Under India's DPDP Act, the person who alone or with others determines the purpose and means of processing personal data; broadly equivalent to a GDPR controller.
- Data governance
-
The policies, roles, standards and processes that make sure data is managed as an asset: accurate, secure, usable and compliant.
- Data inventory
-
A catalogue of the data an organisation holds, with its location, owner, classification and sensitivity.
- Data labelling
-
Marking information with its classification so people and tools can apply the right handling rules.
- Data leak site
-
A website run by ransomware groups to name victims and publish stolen data to pressure payment.
- Data localisation
-
A legal requirement that certain data be stored or processed within a country's borders.
Remarks Examples include payment data rules in India and data rules in China. Localisation is different from transfer restrictions, though both limit where data goes.
- Data loss prevention DLP
-
Tools and policies that detect and prevent sensitive data from leaving the organisation inappropriately, through email, web, cloud, endpoints or removable media.
- Data mapping
-
Discovering and documenting what personal data an organisation holds, where it flows, who accesses it and where it is stored.
- Data minimisation
-
The principle that personal data must be adequate, relevant and limited to what is necessary for the purpose.
Remarks Collecting less is the most effective privacy and security control: data you do not hold cannot leak.
- Data poisoning
-
Tampering with training or fine-tuning data so that a model learns wrong, biased or malicious behaviour, such as a hidden backdoor.
- Data Principal
-
Under India's DPDP Act, the individual to whom personal data relates. For a child or a person with a disability, it includes the parent or lawful guardian.
- Data processing agreement DPA
-
A contract between a controller and a processor setting out the subject matter, duration, nature and purpose of processing, the processor's obligations and security measures (GDPR Article 28).
Remarks Not to be confused with a data protection authority, which shares the abbreviation.
- Data Processor
-
Under India's DPDP Act, a person who processes personal data on behalf of a Data Fiduciary.
- Data protection
-
The laws, principles and practices that govern the fair and lawful handling of personal data and protect individuals' rights.
- Data Protection Board of India
-
The adjudicating body under the DPDP Act that inquires into breaches, directs remedies and imposes penalties.
- Data protection impact assessment DPIA
-
An assessment of a planned processing operation that is likely to be high-risk to individuals. It describes the processing, assesses necessity and risks, and sets out measures to address them.
Remarks Mandatory under GDPR Article 35 for high-risk processing. If high residual risk remains, the supervisory authority must be consulted first.
- Data protection officer DPO
-
An independent expert role that advises on and monitors data protection compliance and is the contact point for regulators and individuals.
Remarks Mandatory under the GDPR for public authorities and for certain large-scale monitoring or sensitive processing; Significant Data Fiduciaries in India must appoint one based in India.
- Data protection principles
-
The core rules that govern processing of personal data. Under the GDPR these are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
- Data provenance
-
The documented origin and history of data: where it came from, how it was collected and how it has been transformed.
- Data residency
-
The physical or geographic location where data is stored and processed, often chosen to meet legal or contractual requirements.
- Data retention
-
How long data is kept, and the rules for keeping and then deleting or anonymising it.
Remarks A retention schedule balances legal minimum periods against storage limitation.
- Data sharing agreement
-
A contract between organisations that share personal data as separate controllers, setting purposes, responsibilities, security and rights handling.
- Data sovereignty
-
The idea that data is subject to the laws of the country where it is located or whose citizens it concerns.
- Data states
-
The three conditions in which data is protected: at rest (stored), in transit (moving across a network) and in use (being processed in memory).
Remarks Each state needs different controls, for example disk encryption, TLS and confidential computing.
- Data steward
-
A person responsible for the quality, definitions and proper use of a data domain on behalf of the business.
- Data subject
-
The identified or identifiable living person to whom personal data relates (GDPR term).
Remarks India's DPDP Act calls this person the "Data Principal"; CCPA says "consumer".
- Data subject access request DSAR
-
A request from an individual to obtain confirmation of whether their personal data is processed, a copy of it and information about the processing.
- Data subject rights
-
The rights individuals have over their personal data, such as access, rectification, erasure, restriction, portability and objection, and rights relating to automated decisions.
Remarks Organisations need a reliable process to verify identity and respond within legal deadlines; under the GDPR the deadline is normally one month.
- Datasheet for datasets
-
Documentation describing how a data set was collected, what it contains, its intended uses, its limitations and its maintenance.
- De-identification
-
Removing or transforming identifiers in a data set to reduce the chance of identifying individuals.
Remarks HIPAA defines two methods: Safe Harbor (removing 18 identifier types) and Expert Determination.
- Deception technology
-
Decoys, lures and fake assets spread across an environment to detect and mislead attackers early, with very few false positives.
- Deep learning
-
Machine learning using neural networks with many layers, which can learn complex patterns from large amounts of data such as images, audio and text.
- Deepfake
-
Synthetic audio, image or video that realistically imitates a real person saying or doing something they did not.
Remarks Used in fraud, such as fake executive video calls authorising payments. The EU AI Act requires deepfakes to be disclosed as artificially generated.
- Default credentials
-
Factory-set usernames and passwords on devices or software that attackers can easily look up.
Remarks Several laws now ban universal default passwords on consumer connected products.
- Default deny
-
A rule-set principle that blocks all traffic or access unless it is explicitly allowed.
- Defence in depth
-
Using several independent layers of control so that if one fails, others still protect the asset.
Remarks Layers span people, process and technology: for example training, email filtering, endpoint protection, segmentation, backups and monitoring together.
- Demilitarised zone DMZ
-
A network segment between the internet and the internal network that hosts public-facing services with limited access in either direction.
- Denial of service DoS
-
An attack that makes a service unavailable by overwhelming it or exploiting a flaw.
- Dependency confusion
-
An attack that publishes a malicious public package with the same name as a company's internal package, so build tools fetch the attacker's version.
- Deployer
-
Under the EU AI Act, a person or organisation using an AI system under its authority, except for personal non-professional use.
Remarks Deployers of high-risk systems must use them according to instructions, ensure human oversight, monitor operation, keep logs and, in some cases, carry out a FRIA.
- Deprovisioning
-
Disabling or removing accounts and access when they are no longer needed.
- Detection engineering
-
The discipline of designing, testing, deploying and maintaining detection logic as code, measured against threat coverage and false-positive rates.
- Detection rule
-
A query or logic that identifies suspicious activity in telemetry and generates an alert.
- Detective control
-
A control that identifies and records an incident while it happens or after it has happened, such as logging, alerting and intrusion detection.
- Deterrent control
-
A control that discourages an attacker or insider from attempting an action, such as warning banners, visible cameras or disciplinary policies.
- DevSecOps
-
Integrating security into DevOps practices and pipelines, so that security checks are automated and shared by development, operations and security teams.
- DFARS Defense Federal Acquisition Regulation Supplement
-
The DoD's supplement to US federal acquisition rules. Clauses such as 252.204-7012 set cybersecurity and incident reporting duties for defence contractors.
- DFIR Digital forensics and incident response
-
The combined discipline of investigating incidents forensically and responding to them.
- Diamond Model
-
An intrusion analysis model that links four features of every event: adversary, capability, infrastructure and victim.
- Differential privacy
-
A mathematical technique that adds calibrated noise to query results or models so the output reveals almost nothing about any single individual in the data.
- Diffie-Hellman
-
A key exchange method that lets two parties derive a shared secret over a public channel without sending the secret itself.
- Digital certificate
-
An electronic document, usually in X.509 format, that binds a public key to an identity and is signed by a certificate authority.
- Digital forensics
-
Collecting, preserving, analysing and presenting digital evidence in a way that stands up to legal and technical scrutiny.
- Digital identity
-
The set of attributes and credentials that represents a person or entity in online transactions.
Remarks NIST SP 800-63 sets assurance levels for identity proofing (IAL), authentication (AAL) and federation (FAL).
- Digital operational resilience
-
Under DORA, a financial entity's ability to build, assure and review its operational integrity and reliability, by ensuring the ICT capabilities it needs to operate securely.
- Digital risk protection DRP
-
Services that monitor the internet for brand impersonation, leaked data, lookalike domains, fake apps and exposed assets.
- Digital signature
-
A cryptographic value created with a private key that proves who signed data and that it has not been altered. Anyone can verify it with the public key.
- Direct prompt injection
-
Prompt injection typed directly by the user into the model's input.
- Directory service
-
A system that stores and organises information about users, devices and resources and answers queries about them, such as through LDAP.
- Disaster recovery DR
-
Restoring IT systems, data and infrastructure after a major disruption. It is the technical part of business continuity.
- Disaster recovery plan DRP
-
Documented, tested procedures for restoring specific IT services to meet their RTO and RPO.
- Discretionary access control DAC
-
Access control in which a resource's owner decides who may access it, as with typical file permissions.
- Distributed denial of service DDoS
-
A denial-of-service attack launched from many sources at once, often a botnet, against bandwidth, protocols or applications.
Remarks Mitigated by upstream scrubbing, CDNs, rate limiting and capacity planning.
- DKIM DomainKeys Identified Mail
-
An email authentication method that adds a cryptographic signature to messages so receivers can check they came from the domain and were not altered.
- DMARC Domain-based Message Authentication, Reporting and Conformance
-
A DNS policy that tells receivers what to do with mail failing SPF or DKIM alignment (none, quarantine or reject) and sends reports back to the domain owner.
Remarks Major mailbox providers now require DMARC from bulk senders. Aim for p=reject once reporting shows legitimate mail passes.
- DNS Domain Name System
-
The internet's naming system, which translates domain names into IP addresses and other records.
Remarks A frequent attack target and channel, through hijacking, tunnelling and spoofing. It is also a rich detection data source.
- DNS filtering
-
Blocking resolution of known malicious or unwanted domains at the DNS layer. It is a cheap and effective early control.
- DNS tunnelling
-
Hiding data or command-and-control traffic inside DNS queries and responses to bypass network controls.
- DNSSEC DNS Security Extensions
-
Extensions that digitally sign DNS records so resolvers can verify they are authentic and unaltered.
- Domain hijacking
-
Taking control of a domain name, for example through compromised registrar accounts or DNS changes, to redirect traffic or email.
Remarks Protect registrar accounts with MFA and registry lock.
- Domain spoofing
-
Forging the sender domain of an email so it appears to come from a trusted organisation.
Remarks SPF, DKIM and DMARC with an enforcing policy prevent exact-domain spoofing; lookalike domains need separate monitoring.
- DORA Digital Operational Resilience Act, Regulation (EU) 2022/2554
-
The EU regulation on ICT risk for the financial sector, applying since 17 January 2025. It covers ICT risk management, incident reporting, resilience testing including TLPT, and ICT third-party risk.
- Double extortion
-
A ransomware tactic of both encrypting data and threatening to leak stolen copies unless a ransom is paid.
- DPDP Act Digital Personal Data Protection Act, 2023 (India)
-
India's data protection law governing the processing of digital personal data, built around consent, notice, Data Fiduciary duties and Data Principal rights. It is implemented through the DPDP Rules in phases.
Remarks Penalties can reach ₹250 crore for some failures, such as not taking reasonable security safeguards.
- Drive-by download
-
Malware installed just by visiting a compromised or malicious web page, often through browser or plug-in vulnerabilities.
- Dual control
-
A requirement that two authorised people act together to complete a sensitive operation, such as opening a vault or using a master key.
- Due care
-
Taking the actions a reasonable and prudent organisation would take to protect its assets and the people affected by its activities.
Remarks Often paired with due diligence: diligence is finding out what is needed; care is doing it.
- Due diligence
-
The investigation and ongoing effort to understand risks and obligations, for example assessing a supplier or an acquisition before committing.
- Dumpster diving
-
Searching discarded rubbish for documents, devices or information useful in an attack.
- Dwell time
-
How long an attacker remains undetected in an environment, from initial compromise to detection.
- Dynamic application security testing DAST
-
Testing a running application from the outside by sending crafted requests to find vulnerabilities.
E
- Economy of mechanism
-
The design principle of keeping security mechanisms as simple and small as possible, so they are easier to verify and harder to get wrong.
- eDiscovery
-
Identifying, preserving, collecting and producing electronically stored information for legal proceedings.
- Elliptic curve cryptography ECC
-
Public-key cryptography based on elliptic curves, giving strong security with smaller keys than RSA, for example ECDSA and ECDH.
- Embedding
-
A numerical vector that represents the meaning of text, an image or other data, so that similar items sit close together.
- Emerging risk
-
A new or changing risk that is not yet well understood or quantified, such as risks from new AI capabilities or quantum computing.
- Emotion recognition system
-
An AI system that identifies or infers people's emotions or intentions from biometric data.
Remarks Banned in workplaces and education under the EU AI Act, except for medical or safety reasons, and subject to transparency duties elsewhere.
- Encryption
-
Transforming readable data (plaintext) into unreadable data (ciphertext) with an algorithm and a key, so that only holders of the right key can reverse it.
- Encryption at rest
-
Encrypting stored data, such as disks, databases, backups and object storage, so stolen media or snapshots cannot be read.
Remarks Protects against physical theft and some cloud exposures, but not against a compromised application with legitimate access.
- Encryption in transit
-
Encrypting data while it moves across networks, typically with TLS, SSH or IPsec.
- End-to-end encryption E2EE
-
Encryption in which only the communicating users hold the keys, so intermediaries, including the service provider, cannot read the content.
- Endpoint detection and response EDR
-
Software on laptops, servers and other endpoints that records activity, detects malicious behaviour and lets responders investigate and contain hosts remotely.
- Endpoint protection platform EPP
-
Software that prevents threats on endpoints, through anti-malware, exploit prevention and device control. It is often combined with EDR.
- ENISA European Union Agency for Cybersecurity
-
The EU agency that supports member states and institutions on cybersecurity policy, certification, threat analysis and NIS2 implementation.
- Enterprise risk management ERM
-
Managing all of an organisation's significant risks, including strategic, financial, operational and cyber, in one consistent framework that leadership oversees.
Remarks COSO ERM and ISO 31000 are common references. Cyber risk should roll up into ERM, not sit apart from it.
- Enterprise security architecture
-
A business-driven approach that aligns security design with organisational goals, from strategy down to technical components.
Remarks SABSA is a well-known method; TOGAF is often used alongside it for enterprise architecture.
- Entitlement
-
A specific permission or access right granted to an identity.
- Enumeration
-
Systematically extracting detailed information from a target, such as users, shares, services, versions and directories, to find attack paths.
- Envelope encryption
-
Encrypting data with a data key, then encrypting that data key with a master key held in a KMS or HSM.
- ePrivacy Directive
-
The EU directive on privacy in electronic communications, which sets rules on confidentiality of communications, cookies and electronic direct marketing.
Remarks Applies alongside the GDPR; national laws implement it. Often called the "cookie law".
- EPSS Exploit Prediction Scoring System
-
A FIRST model that estimates the probability that a vulnerability will be exploited in the next 30 days.
- Eradication
-
Removing the cause of an incident, such as malware, attacker accounts or persistence mechanisms, and closing the vulnerability that was exploited.
- Escalation
-
Passing an alert or incident to a more senior analyst, a specialist team or management according to severity and defined criteria.
- Essential Eight
-
The Australian Signals Directorate's eight prioritised mitigation strategies: application control, patching applications, Office macro settings, user application hardening, restricting admin privileges, patching operating systems, MFA and regular backups. It comes with a maturity model.
- Essential entity
-
Under NIS2, a larger organisation in a highly critical sector, such as energy, transport, banking, health or digital infrastructure. It faces proactive supervision and higher maximum fines.
- Estimative language
-
Standardised words, such as "likely" or "almost certainly", that convey probability consistently in intelligence reports.
- Ethical hacking
-
Using attacker techniques with permission to find and fix weaknesses before criminals exploit them.
- EU AI Act Regulation (EU) 2024/1689
-
The EU's risk-based law on artificial intelligence, in force since 1 August 2024 with phased application. It covers prohibited practices, high-risk systems, transparency duties and general-purpose AI models.
Remarks Application dates for some high-risk obligations have been adjusted by later EU decisions; check the current timetable before planning.
- EU Cybersecurity Act Regulation (EU) 2019/881
-
The EU regulation that gave ENISA a permanent mandate and created the EU cybersecurity certification framework for ICT products, services and processes.
- EU Data Act Regulation (EU) 2023/2854
-
The EU regulation on fair access to and use of data from connected products and related services, which also makes it easier to switch cloud provider. It applies from 12 September 2025.
- EU-US Data Privacy Framework
-
A framework, with a European Commission adequacy decision adopted in July 2023, that allows personal data transfers to US organisations that self-certify to it.
Remarks Successor to the invalidated Privacy Shield. Check an organisation's current certification status on the official list.
- European Data Protection Board EDPB
-
The EU body of national supervisory authorities and the EDPS that issues guidelines and binding decisions to make sure the GDPR is applied consistently.
Remarks EDPB guidelines are a primary source for interpreting the GDPR.
- Evasion attack
-
An attack at inference time that crafts inputs to avoid detection or cause misclassification, such as malware tuned to slip past an ML detector.
- Evil twin
-
A rogue Wi-Fi access point that imitates a legitimate network to intercept users' traffic and credentials.
- Excessive agency
-
Giving an AI application more permissions, tools or autonomy than it needs, so a manipulated or faulty model can cause real damage.
Remarks Apply least privilege to agents and require human approval for high-impact actions.
- Exercise (continuity)
-
A planned activity to rehearse, test and improve continuity and incident plans, from walkthroughs and tabletop exercises to full failover tests.
- Explainability
-
The ability to describe in human terms why an AI system produced a particular output or decision.
- Exploit
-
Code, a technique or a sequence of actions that takes advantage of a vulnerability to cause unintended behaviour, such as running code or gaining access.
- Exploitation framework
-
A toolkit for developing and running exploits and post-exploitation actions, such as Metasploit.
- Exposure management
-
A continuous programme to find, validate and prioritise all exposures, such as vulnerabilities, misconfigurations and identity weaknesses, based on how attackers could actually use them.
Remarks Often described as continuous threat exposure management (CTEM).
- External attack surface management EASM
-
Continuously discovering and monitoring an organisation's internet-facing assets, including unknown ones, for exposures.
- External audit
-
An audit carried out by an independent party outside the organisation, such as a certification body, a CPA firm or a regulator.
- External email banner
-
A visible tag added to emails from outside the organisation to prompt caution with links, attachments and requests.
Remarks Banner fatigue reduces the effect over time; keep it short and consistent.
- External penetration test
-
Testing internet-facing systems and services from outside the organisation's network.
F
- Fail safe
-
A design where a failure defaults to the state that protects people or keeps service running, even at some security cost.
- Fail secure
-
A design where a failure leaves the system in a state that protects assets, for example denying access when an authentication service is unavailable.
Remarks Contrast with fail safe or fail open, which prioritise availability or human safety; physical doors on fire escapes usually fail open.
- Failover
-
Automatically or manually switching to a standby system or site when the primary fails.
- FAIR Factor Analysis of Information Risk
-
A model for quantifying information and operational risk in financial terms, by breaking risk into loss event frequency and loss magnitude.
Remarks Maintained by the FAIR Institute and published as an Open Group standard.
- Fairness (AI)
-
The goal that AI outcomes do not unjustly discriminate between individuals or groups. It is measured with several, sometimes conflicting, statistical definitions.
- False acceptance rate FAR
-
In biometrics, the rate at which an impostor is wrongly accepted.
- False negative
-
A failure to alert on activity that really is malicious.
- False positive
-
An alert that flags benign activity as malicious.
Remarks Too many false positives cause alert fatigue, and real attacks get missed.
- False rejection rate FRR
-
In biometrics, the rate at which a legitimate user is wrongly rejected.
- Federal Contract Information FCI
-
Information not intended for public release that is provided by or generated for the US government under a contract. It is protected by basic safeguarding requirements (CMMC Level 1).
- Federated learning
-
Training a shared model across many devices or organisations that keep their data locally, sharing only model updates.
- Federation
-
A trust relationship that lets identities from one organisation or provider access resources in another without separate accounts.
- FedRAMP Federal Risk and Authorization Management Program
-
The US government programme that standardises security assessment and authorisation of cloud services used by federal agencies. It is moving from Rev5 baselines towards the FedRAMP 20x model.
- FIDO2
-
Open standards from the FIDO Alliance and W3C (WebAuthn and CTAP) for passwordless, phishing-resistant authentication with public-key cryptography.
- Fileless malware
-
Malicious activity that runs in memory or through legitimate tools without writing traditional files to disk, making it harder to detect.
- Fine-tuning
-
Further training a pre-trained model on a smaller, task-specific data set to adapt its behaviour.
- FIPS 140-3
-
The US and Canadian standard for validating cryptographic modules, tested under the Cryptographic Module Validation Program (CMVP).
Remarks US federal systems, including FedRAMP and CMMC environments, require FIPS-validated cryptography.
- Firewall
-
A device or software that controls traffic between networks or hosts according to rules, allowing or blocking connections.
- FISMA Federal Information Security Modernization Act
-
US law requiring federal agencies to run information security programmes based on NIST standards and to report on them.
- Forensic image
-
An exact bit-for-bit copy of storage media, verified with hashes, used for analysis so the original is preserved.
- Foundation model
-
A large model trained on broad data at scale that can be adapted to many tasks, such as a large language model or a multimodal model.
- Fourth-party risk
-
Risk that comes from your suppliers' own suppliers, such as a SaaS vendor's cloud host.
- Full-disk encryption FDE
-
Encrypting an entire storage device so that all data on it is protected when the device is off or locked, for example with BitLocker or FileVault.
- Fundamental rights impact assessment FRIA
-
Under the EU AI Act, an assessment that certain deployers of high-risk AI systems, such as public bodies, must carry out before use, covering affected groups, risks of harm and oversight measures.
- Fuzzing
-
Automatically feeding large volumes of malformed or random input to software to find crashes and security bugs.
G
- Gamification
-
Using game elements, such as points, levels, badges, challenges and leaderboards, to increase engagement with security learning.
- Gap analysis
-
Comparing current practices with the requirements of a standard or law to identify what is missing and plan remediation.
Remarks Usually the first step in any compliance programme; it is not an audit and gives no assurance.
- GDPR General Data Protection Regulation
-
Regulation (EU) 2016/679, the EU's comprehensive data protection law, applying since 25 May 2018 to processing of personal data in the EU and to many organisations outside it that target or monitor people in the EU.
Remarks Fines reach up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements.
- General-purpose AI model GPAI model
-
Under the EU AI Act, a model trained on large amounts of data that displays significant generality and can competently perform a wide range of distinct tasks, and can be integrated into many downstream systems.
Remarks Providers must keep technical documentation, give information to downstream providers, have a copyright policy and publish a training content summary. These duties have applied since 2 August 2025.
- Generative AI GenAI
-
AI that creates new content, such as text, images, audio, video or code, based on patterns learned from training data.
- GLBA Gramm-Leach-Bliley Act
-
US law requiring financial institutions to explain their information-sharing practices and protect customer data. The FTC Safeguards Rule sets security programme requirements.
- Global Privacy Control GPC
-
A browser or extension signal that tells websites the user does not want their personal information sold or shared. California and several other US states require businesses to honour it.
- Golden ticket
-
A forged Kerberos ticket-granting ticket, created with the stolen KRBTGT account hash, that gives an attacker access to any resource in an Active Directory domain.
Remarks Recovery requires resetting the KRBTGT password twice.
- GRC Governance, risk and compliance
-
The combined discipline of directing an organisation (governance), managing uncertainty that affects its objectives (risk) and meeting legal, regulatory and contractual obligations (compliance).
Remarks In security, GRC teams own policies, risk registers, control frameworks, audits and regulatory reporting. GRC platforms are tools that support this work, not the work itself.
- Grey-box testing
-
Testing with partial knowledge, such as user-level credentials or documentation. It is often the most efficient balance.
- Grounding
-
Tying a model's output to specific, verifiable sources or data so it is accurate and traceable.
- Guardrails
-
Controls placed around a model, such as input and output filters, policy checks, allow-lists and monitoring, to keep its behaviour within safe and permitted limits.
- Guardrails (cloud)
-
Preventive or detective policies applied across cloud accounts, such as service control policies, to keep teams within security boundaries.
- Guideline
-
Recommended, non-mandatory advice on how to meet policy goals, allowing some discretion.
H
- Hacktivist
-
A threat actor motivated by political or social causes, often using defacement, leaks or denial-of-service.
- Hallucination
-
When a generative model produces content that sounds plausible but is false, made up or unsupported by its sources.
Remarks A major risk in legal, medical and compliance uses. Mitigate with grounding, citations and human review.
- Hard-coded credentials
-
Passwords, keys or tokens written directly into source code, configuration or images.
- Hardening
-
Reducing a system's attack surface by removing unnecessary software, services and accounts, applying secure settings and patching.
Remarks Usually guided by baselines such as CIS Benchmarks or vendor guides, then checked automatically for drift.
- Hardware security module HSM
-
A tamper-resistant hardware device that generates, stores and uses cryptographic keys so they never leave it in plaintext.
Remarks Often validated to FIPS 140-3. Used by payment systems, certificate authorities and cloud key services.
- Harmonised structure
-
The common clause structure, core text and terms shared by ISO management system standards, formerly called Annex SL.
- Harvest now, decrypt later
-
The threat that adversaries collect encrypted data today in order to decrypt it once quantum computers can break current public-key cryptography.
- Hash function
-
A function that maps data of any size to a fixed-size digest. It must be one-way and collision-resistant, so that any change to the input changes the output.
Remarks SHA-256 and SHA-3 are current choices; MD5 and SHA-1 are broken for security uses.
- Health data
-
Personal data about a person's physical or mental health, including healthcare services provided, that reveals information about their health status.
- Help desk social engineering
-
Persuading IT support staff to reset passwords, enrol new MFA devices or grant access by impersonating an employee.
Remarks A common route in major intrusions. Strong identity checks for resets, such as video verification or manager approval, are essential.
- High availability HA
-
Designing systems with redundancy and automatic failover so they keep running despite component failures.
- High-risk AI system
-
Under the EU AI Act, an AI system that is a safety component of a regulated product, or is used in listed areas such as employment, education, credit scoring, essential services, law enforcement, migration and justice.
Remarks Subject to strict requirements before market placement. Check current application dates, as the EU has adjusted the timetable.
- HIPAA Health Insurance Portability and Accountability Act of 1996
-
US federal law whose Privacy, Security and Breach Notification Rules govern protected health information held by covered entities and business associates.
Remarks HHS Office for Civil Rights enforces it. The Security Rule requires administrative, physical and technical safeguards based on risk analysis.
- HITECH Act
-
The 2009 US law that strengthened HIPAA enforcement and penalties, extended duties to business associates and created federal breach notification for health data.
- HITRUST CSF
-
A certifiable framework that combines requirements from HIPAA, ISO, NIST and others. It is widely used in US healthcare, with e1, i1 and r2 assessment levels.
- Hold your own key HYOK
-
Keeping encryption keys entirely outside the cloud provider, so the provider can never decrypt the data.
- Homograph attack
-
Using visually identical characters from other alphabets in a domain name, for example a Cyrillic "а" for a Latin "a", to imitate a real site.
- Homomorphic encryption
-
Encryption that allows calculations on encrypted data without decrypting it, so results decrypt to the same answer as working on the plaintext.
- Honeypot
-
A decoy system designed to attract attackers, so that defenders can detect them and study their methods.
- Honeytoken
-
Fake data or credentials planted in systems; any use of them signals an intrusion. Also called a canary token.
- Horizon scanning
-
Systematically watching for emerging risks, technologies and regulatory developments that could affect an organisation.
- Host isolation
-
Cutting an endpoint off from the network, except for the security tooling, so responders can investigate without the attacker spreading further.
- HSTS HTTP Strict Transport Security
-
A header that tells browsers to connect to a site only over HTTPS for a set period, preventing downgrade attacks.
- HTTPS
-
HTTP carried over TLS, which encrypts web traffic and authenticates the website.
- Human oversight
-
Measures that let people monitor an AI system, understand its outputs, and intervene or override it to prevent or limit harm.
Remarks A legal requirement for high-risk AI systems under the EU AI Act.
- Human risk management HRM
-
An approach that measures and reduces security risk from human behaviour using data on actions, targeted interventions and adaptive training, rather than training everyone the same way.
- Human-in-the-loop HITL
-
A design in which a human reviews or approves an AI system's output before it takes effect.
Remarks "On the loop" means a human monitors and can intervene; "out of the loop" means fully automated. Beware rubber-stamping, where review becomes a formality.
- Hybrid cloud
-
A combination of private and public cloud, or on-premises systems, that works together.
- Hypervisor
-
Software that creates and runs virtual machines and isolates them from each other.
Remarks A VM escape, breaking out to the hypervisor, is a critical class of vulnerability.
I
- IaaS Infrastructure as a service
-
A cloud model in which the provider supplies compute, storage and networking, and the customer manages the operating systems, applications and data.
- Identification
-
Claiming an identity, for example by entering a username, before it is verified.
- Identity and access management IAM
-
The policies, processes and technology that make sure the right identities, human and non-human, get the right access to the right resources at the right time.
- Identity governance and administration IGA
-
Managing the identity lifecycle and access entitlements, including provisioning, role management, access requests, certifications and segregation-of-duties checks.
Search Google for “Identity governance and administration” ↗
- Identity proofing
-
Verifying that a person is who they claim to be before issuing credentials, for example by checking documents and liveness.
- Identity provider IdP
-
A service that authenticates users and issues identity assertions or tokens to applications, such as Microsoft Entra ID, Okta or Google.
- Identity threat detection and response ITDR
-
Tools and practices that detect and respond to attacks on identity systems, such as credential misuse, privilege escalation and attacks on directories and identity providers.
Search Google for “Identity threat detection and response” ↗
- Immutable backup
-
A backup that cannot be changed or deleted during its retention period, even by administrators. This protects it against ransomware and insiders.
- Impact
-
The consequence of a risk event for an organisation or individuals: financial, operational, legal, reputational or harm to people.
- Impact tolerance
-
The maximum tolerable level of disruption to an important business service, set as a measurable limit such as time, under UK operational resilience rules.
- Impersonation
-
Pretending to be a trusted person, brand or authority to deceive a target.
- Important entity
-
Under NIS2, an organisation in a covered sector that is not essential. It has the same core duties but lighter, mostly reactive supervision.
- Impossible travel
-
A detection that flags logins from locations too far apart to reach in the time between them.
- Improper output handling
-
Passing model output to other systems, such as browsers, shells or databases, without validation, which can enable injection attacks such as XSS or SQL injection.
- Incident classification
-
Categorising an incident by type, such as malware, unauthorised access or data loss, and by severity, to decide handling and reporting.
- Incident commander
-
The person with overall authority and coordination responsibility during a significant incident.
- Incident reporting
-
Notifying regulators, authorities, customers or partners about incidents as laws and contracts require.
Remarks Examples: NIS2 needs an early warning within 24 hours and a notification within 72 hours; DORA sets tight timelines for major ICT incidents; CERT-In requires reports within six hours.
- Incident response IR
-
The organised approach to preparing for, detecting, containing, eradicating and recovering from security incidents, and learning from them.
Remarks NIST SP 800-61 Rev. 3 (2025) aligns incident response with the CSF 2.0 functions. ISO/IEC 27035 is the ISO series.
- Incident response plan IRP
-
The documented plan that defines incident roles, communication, severity levels, decision authority, legal and regulatory reporting, and response procedures.
- Indicator of attack IoA
-
Evidence of attacker behaviour in progress, such as a process injecting into another process, regardless of the specific tool used.
- Indicator of compromise IoC
-
An observable artefact that suggests a system may be compromised, such as a malicious IP address, domain, file hash, registry key or URL.
Remarks IoCs go stale quickly; use them to hunt and block, with expiry dates.
- Indirect prompt injection
-
Prompt injection hidden in content the model processes, such as a web page, email or document, which can hijack an assistant acting for a different user.
Remarks Especially dangerous for agents that browse, read email or call tools.
- Industrial control system ICS
-
A system that controls industrial processes, including SCADA, distributed control systems and programmable logic controllers.
- Inference
-
Using a trained model to produce outputs from new inputs: the "running" phase, as opposed to training.
- Information Commissioner's Office ICO
-
The UK's independent regulator for data protection and freedom of information.
- Information security governance
-
The system by which an organisation's leadership sets direction for information security, assigns accountability, approves risk decisions and oversees performance.
Remarks ISO/IEC 27014 gives guidance. Board-level oversight of cyber risk is now an explicit expectation in many laws, such as NIS2 and DORA.
- Information security policy
-
A top-level document, approved by leadership, that sets the organisation's direction, principles and commitments for information security.
Remarks ISO/IEC 27001 requires one. It should be short and supported by topic-specific policies, standards and procedures.
- Information sharing and analysis center ISAC
-
A sector-based organisation, such as FS-ISAC or Health-ISAC, where members share threat information and best practices.
Search Google for “Information sharing and analysis center” ↗
- Infostealer
-
Malware that harvests credentials, browser cookies, crypto wallets and other data from infected devices and sends them to attackers.
Remarks Stolen session cookies let attackers bypass MFA, which is why infostealer logs fuel many breaches.
- Infrastructure as code IaC
-
Defining and provisioning infrastructure with machine-readable files, such as Terraform or CloudFormation, instead of manual configuration.
Remarks Lets security scan configurations before deployment, which shifts security left.
- Inherent risk
-
The level of risk before any controls are applied, or assuming existing controls fail.
- Initial access
-
The first foothold an attacker gains in a target environment, for example through phishing, exploiting a public-facing application or stolen credentials.
- Initial access broker IAB
-
A criminal who breaks into networks and sells that access to other criminals, such as ransomware affiliates.
- Injection
-
Flaws in which untrusted input is sent to an interpreter as part of a command or query, letting attackers change its meaning. Examples are SQL, OS command and LDAP injection.
- Input validation
-
Checking that input matches expected type, length, format and range before processing it, preferably with allow-lists.
Remarks Validation alone does not stop injection; combine it with parameterisation and output encoding.
- Insecure deserialisation
-
Processing untrusted serialised data in a way that lets attackers manipulate objects or execute code.
- Insecure direct object reference IDOR
-
An access control flaw in which an application exposes a reference to an object, such as an ID, and fails to check that the user may access it.
- Insider threat
-
Risk posed by people with legitimate access, such as employees, contractors or partners, who misuse it deliberately or by accident.
Remarks Controls include least privilege, monitoring, separation of duties, a positive security culture and good offboarding.
- Integrity
-
Assurance that information and systems are accurate and complete, and are changed only by authorised parties in authorised ways.
Remarks Covers both preventing unauthorised change and detecting it, for example with hashes, digital signatures, change control and audit logs.
- Integrity and confidentiality principle
-
The data protection principle that personal data must be processed securely, with appropriate technical and organisational measures against unauthorised processing, loss or damage.
Remarks This is where security controls meet privacy law. GDPR Article 32 develops it.
Search Google for “Integrity and confidentiality principle” ↗
- Intelligence lifecycle
-
The repeating cycle of producing intelligence: direction (requirements), collection, processing, analysis, dissemination and feedback.
- Intelligence requirements
-
The questions stakeholders need intelligence to answer, such as "which groups target our sector and how?". They guide what to collect.
Remarks Priority intelligence requirements (PIRs) keep a CTI team focused on decisions that matter.
- Interactive application security testing IAST
-
Testing that uses instrumentation inside a running application to observe how inputs flow through code, combining aspects of SAST and DAST.
Search Google for “Interactive application security testing” ↗
- Internal audit
-
An audit carried out by or for the organisation itself, by people independent of the area audited, to check that controls and management systems work.
Remarks Required by ISO management system standards. The third line in the three lines model.
- Internal penetration test
-
Testing from inside the network, simulating an attacker who has already gained a foothold or a malicious insider.
- International data transfer
-
Moving personal data, or making it accessible, across national borders. Many laws restrict this unless safeguards are in place.
- Internet of Things IoT
-
Everyday and industrial devices that connect to networks and the internet, such as cameras, sensors, wearables and smart appliances.
Remarks Common weaknesses are default passwords, missing updates and weak data protection. Several countries now set baseline security requirements for consumer IoT products.
- Interpretability
-
How far humans can understand the internal mechanics of a model and how inputs relate to outputs.
- Intrusion detection system IDS
-
A system that monitors network traffic (NIDS) or host activity (HIDS) for malicious activity or policy violations and raises alerts.
- Intrusion prevention system IPS
-
An inline system that detects and automatically blocks malicious traffic.
- Invoice fraud
-
Tricking an organisation into paying fake invoices or sending payments to an attacker's account, often by impersonating a real supplier.
- IPsec
-
A suite of protocols that authenticates and encrypts IP packets, widely used for site-to-site VPNs.
- IPv6
-
The current version of the Internet Protocol, with 128-bit addresses.
Remarks Often enabled by default but left unmonitored, creating blind spots for firewalls and detection.
- IRDAI cyber security guidelines
-
The Insurance Regulatory and Development Authority of India's Information and Cyber Security Guidelines for insurers and intermediaries.
- ISMS Information security management system
-
The policies, processes, roles, risk decisions and controls an organisation uses to manage information security systematically and keep improving it.
Remarks ISO/IEC 27001 specifies the requirements for an ISMS; certification shows the system exists and works, not that the organisation cannot be breached.
- ISO 9001
-
The international standard that specifies requirements for a quality management system.
- ISO 22301
-
The international standard that specifies requirements for a business continuity management system. It is certifiable.
- ISO 31000
-
The international guideline on risk management principles, framework and process. It is not certifiable.
- ISO/IEC 20000-1
-
The international standard that specifies requirements for an IT service management system.
- ISO/IEC 23894
-
Guidance on managing risk for organisations that develop, deploy or use AI, based on ISO 31000.
- ISO/IEC 27001
-
The international standard that specifies requirements for an information security management system (ISMS). It is certifiable by accredited bodies. The current edition is 2022, amended in 2024.
- ISO/IEC 27002
-
The code of practice giving implementation guidance for information security controls. The 2022 edition matches the 93 controls of ISO/IEC 27001 Annex A.
- ISO/IEC 27005
-
Guidance on information security risk management that supports the risk requirements of ISO/IEC 27001.
- ISO/IEC 27017
-
Guidance on information security controls for cloud services, for both providers and customers.
- ISO/IEC 27018
-
A code of practice for protecting personal data in public clouds acting as PII processors.
- ISO/IEC 27035
-
The ISO/IEC series on information security incident management: principles, planning, preparation and response.
- ISO/IEC 27701
-
The international standard for privacy information management systems (PIMS), covering PII controllers and processors. It was originally an extension of ISO/IEC 27001.
- ISO/IEC 42001
-
The international standard (2023) that specifies requirements for an artificial intelligence management system (AIMS). It is certifiable.
- Isolation
-
Keeping processes, systems or networks separate so a compromise or failure in one cannot spread to others.
- IT Act 2000 Information Technology Act, 2000 (India)
-
India's primary law on electronic commerce and cybercrime. It also underpins CERT-In's powers and rules on reasonable security practices.
- IT general controls ITGCs
-
Baseline controls over IT that support reliable systems and data, typically access management, change management, operations and backup. They are tested in financial audits.
- ITAR International Traffic in Arms Regulations
-
US export control rules for defence articles and technical data. They affect where such data may be stored and who may access it.
J
- Jailbreak
-
A prompt or technique designed to bypass a model's safety rules so it produces content it was trained to refuse.
- Joiner-mover-leaver JML
-
The identity lifecycle processes for granting access when people join, adjusting it when they change roles, and removing it promptly when they leave.
Remarks Slow leaver processes and access never removed after moves are among the most common audit findings.
- Joint controllers
-
Two or more controllers that jointly decide the purposes and means of processing, and must set out their responsibilities transparently between them.
- JSON Web Token JWT
-
A compact, signed (and optionally encrypted) token format that carries claims between parties.
Remarks Validate the signature, algorithm, issuer, audience and expiry; never accept "alg: none".
- Just culture
-
A culture that treats honest mistakes as chances to learn, while still holding people accountable for reckless or malicious acts.
Remarks Blaming people who click on phishing emails discourages reporting, and reporting is the most valuable behaviour.
- Just-in-time access JIT
-
Granting elevated access only when needed, for a limited time, with approval and logging, instead of standing privileges.
- Just-in-time training
-
Brief training delivered at the moment it is relevant, for example right after someone clicks a simulated phishing link.
K
- Kenya Data Protection Act
-
Kenya's Data Protection Act, 2019, enforced by the Office of the Data Protection Commissioner (ODPC).
- Kerberoasting
-
Requesting Kerberos service tickets for service accounts and cracking them offline to recover weak service account passwords.
Remarks Mitigated by long random service account passwords, managed service accounts and monitoring of unusual ticket requests.
- Kerberos
-
A network authentication protocol using tickets issued by a trusted Key Distribution Centre. It is the default in Windows Active Directory domains.
- Kerckhoffs's principle
-
The principle that a cryptographic system should remain secure even if everything about it except the key is public.
- Key derivation function KDF
-
A function that derives one or more cryptographic keys from a secret such as a password, often deliberately slow, for example PBKDF2, scrypt or Argon2.
- Key exchange
-
A method for two parties to agree a shared secret key over an untrusted channel, such as Diffie-Hellman or ECDH.
- Key management
-
The secure generation, distribution, storage, use, rotation, backup and destruction of cryptographic keys.
Remarks Most real-world cryptographic failures are key-management failures. NIST SP 800-57 is the key reference.
- Key management service KMS
-
A managed cloud service for creating and controlling encryption keys, usually backed by HSMs and integrated with other cloud services.
- Key performance indicator KPI
-
A metric showing how well a process or control is performing against its objective, such as mean time to patch.
- Key risk indicator KRI
-
A metric that signals a change in exposure to a risk early, such as unpatched critical systems or phishing click rates, compared against thresholds.
- Key rotation
-
Replacing cryptographic keys at defined intervals or after events, limiting how much data any one key protects.
- Know your customer KYC
-
Regulatory processes, mainly in finance, to verify customers' identities and assess risk before and during a business relationship.
- Known Exploited Vulnerabilities catalog KEV
-
CISA's authoritative list of vulnerabilities known to be exploited in the wild. US federal agencies must remediate listed vulnerabilities by set deadlines.
Remarks A practical prioritisation input for any organisation.
Search Google for “Known Exploited Vulnerabilities catalog” ↗
- Kubernetes K8s
-
An open-source platform for automating the deployment, scaling and management of containerised applications.
Remarks Key risks include exposed API servers, over-privileged service accounts, missing network policies and unscanned images. CIS publishes a Kubernetes benchmark.
L
- Landing zone
-
A pre-configured, secure, multi-account cloud environment with baseline identity, networking, logging and guardrails, ready for workloads.
- Large language model LLM
-
A very large neural network, usually a transformer, trained on vast amounts of text to predict and generate language. It can answer questions, summarise, translate and write code.
- Lateral movement
-
Moving from one compromised system to others in a network to reach valuable targets.
Remarks Segmentation, tiered administration and detection of unusual authentication slow it down.
- Lawful basis
-
A legal ground that permits processing personal data. The GDPR's six bases are consent, contract, legal obligation, vital interests, public task and legitimate interests.
Remarks India's DPDP Act relies mainly on consent plus specified "legitimate uses".
- Lawfulness, fairness and transparency
-
The principle that personal data must be processed on a valid legal basis, in ways people would reasonably expect, with clear information about what happens to it.
- Layered security
-
Another name for defence in depth: combining multiple security controls so no single failure exposes an asset.
- LDAP Lightweight Directory Access Protocol
-
A protocol for accessing and maintaining directory information services.
Remarks Use LDAPS or StartTLS so credentials are not sent in clear text.
- Lead supervisory authority
-
Under the GDPR one-stop-shop, the supervisory authority of the controller's or processor's main EU establishment, which leads cross-border cases.
- Least privilege
-
Giving each user, process or system only the access it needs to do its job, and no more, for only as long as it needs it.
Remarks Limits the damage from mistakes and compromised accounts. Privilege creep over time is the usual failure, so access reviews matter.
- Legal hold
-
An instruction to preserve information relevant to litigation or an investigation, which suspends normal deletion.
- Legitimate interests
-
A GDPR lawful basis for processing that is necessary for the legitimate interests of the controller or a third party, unless overridden by the person's rights and interests.
Remarks Requires a documented legitimate interests assessment balancing purpose, necessity and impact.
- Legitimate interests assessment LIA
-
A documented three-part test (purpose, necessity and balancing) showing that relying on legitimate interests is appropriate.
- Legitimate uses
-
Under India's DPDP Act, specified situations where personal data may be processed without consent, such as for employment purposes, legal obligations or medical emergencies.
- LGPD Lei Geral de Proteção de Dados
-
Brazil's general data protection law (Law 13,709/2018), modelled closely on the GDPR and enforced by the national authority ANPD.
- Likelihood
-
How probable it is that a risk event will happen within a given period. It can be expressed qualitatively, such as low to high, or as a probability or frequency.
- LINDDUN
-
A privacy threat modelling method covering linking, identifying, non-repudiation, detecting, data disclosure, unawareness and non-compliance.
- Living off the land LOTL
-
Attacking with legitimate tools already present on a system, such as PowerShell, WMI or admin utilities, to blend in and avoid detection.
- Log management
-
Collecting, storing, protecting, retaining and making searchable the logs generated by systems and applications.
Remarks Several laws and standards set log retention periods. Logs that nobody reviews give little protection.
- Log retention
-
How long logs are kept, set by legal, regulatory, contractual and investigative needs.
Remarks For example, PCI DSS requires 12 months of audit logs, with three months immediately available, and CERT-In's directions require 180 days of ICT logs kept in India.
- Lookalike domain
-
A domain registered to resemble a legitimate one, such as with swapped letters or a different top-level domain, and used in phishing. Also called typosquatting.
- Lure
-
The theme or hook of a phishing message, such as a parcel delivery, invoice, password expiry or shared document, designed to prompt action.
M
- Machine learning ML
-
A branch of AI in which systems learn patterns from data, rather than following only hand-written rules, and improve with experience.
- Major nonconformity
-
An audit finding that a requirement is not met in a way that puts the management system's ability to achieve its intended results in doubt, such as a missing core process.
- Malvertising
-
Malicious online advertising that leads users to malware or phishing, sometimes through legitimate ad networks and search ads.
- Malware
-
Malicious software designed to damage, disrupt, spy on or gain unauthorised access to systems. It includes viruses, worms, trojans, ransomware, spyware and rootkits.
- Malware analysis
-
Examining malicious software to understand its behaviour, capabilities, indicators and origin, through static analysis, dynamic analysis in a sandbox, or reverse engineering.
- Man-in-the-middle attack MitM
-
An attack in which an adversary secretly intercepts and possibly alters communications between two parties. Also called adversary-in-the-middle.
- Managed detection and response MDR
-
An outsourced service that provides threat detection, investigation and response, usually 24x7, using the provider's analysts and tools.
- Managed identity
-
A cloud-provided workload identity whose credentials the platform creates and rotates automatically.
- Managed security service provider MSSP
-
A company that provides outsourced monitoring and management of security devices and systems.
- Management review
-
Regular review by top management of a management system's performance, risks and improvement needs, with recorded decisions.
- Management system
-
A set of interrelated policies, processes and responsibilities an organisation uses to achieve its objectives in a defined area, such as quality, security or AI.
Remarks ISO management system standards share a common structure (the harmonised structure), so ISO 9001, 27001, 22301 and 42001 can be integrated.
- Mandatory access control MAC
-
Access control enforced by the system based on security labels, such as classification levels, that users cannot override.
- Mantrap
-
A small physical space with two interlocking doors, where the second door opens only after the first has closed and the person is authenticated. It prevents tailgating. Also called an access control vestibule.
- Market surveillance authority
-
A national authority that checks products on the EU market comply with the law and can require corrective action or withdrawal; under the AI Act it supervises AI systems.
- Maximum tolerable period of disruption MTPD
-
The longest time a disruption to an activity can last before its impact becomes unacceptable. Also called the maximum tolerable downtime (MTD).
Remarks The RTO must be shorter than the MTPD.
Search Google for “Maximum tolerable period of disruption” ↗
- Mean time to detect MTTD
-
The average time between an incident starting and the organisation detecting it.
- Mean time to respond MTTR
-
The average time from detecting an incident to containing or resolving it.
Remarks The abbreviation MTTR is also used for mean time to repair or recover in IT operations; define it in reports.
- Media sanitisation
-
Making data on storage media unrecoverable: clearing, purging or destroying the media according to the data's sensitivity.
- Membership inference
-
An attack that determines whether a particular record was part of a model's training data. It can reveal sensitive facts about individuals.
- Memory forensics
-
Analysing a capture of a system's RAM to find running processes, network connections, injected code and encryption keys that may never touch disk.
- Memory safety
-
Protection against bugs such as buffer overflows and use-after-free errors, provided by languages such as Rust, Go, Java and C#, or by careful engineering.
- Message authentication code MAC
-
A short value computed from a message and a secret key, such as HMAC, that verifies both the message's integrity and that it came from someone holding the key.
- Metadata service
-
A cloud endpoint that gives instances information about themselves, including temporary credentials.
Remarks A frequent target of server-side request forgery. Require session-oriented versions such as AWS IMDSv2.
- MFA fatigue
-
An attack that floods a user with multi-factor push prompts until they approve one by mistake or just to stop the prompts. Also called push bombing.
Remarks Number matching and phishing-resistant MFA defeat it.
- Microlearning
-
Short, focused learning units, often a few minutes long, delivered frequently and in context.
- Microsegmentation
-
Fine-grained segmentation that applies policies down to individual workloads or applications, often using software-defined controls.
- Minimum business continuity objective MBCO
-
The minimum level of service or output acceptable to the organisation during a disruption.
- Minor nonconformity
-
An isolated or limited failure to meet a requirement that does not undermine the system as a whole.
- Misconfiguration
-
An insecure setting, such as an open storage bucket, default credentials or excessive permissions, that creates a vulnerability.
Remarks One of the most common causes of cloud breaches.
- MISP
-
A widely used open-source threat intelligence sharing platform for storing, correlating and sharing indicators and events.
- MITRE ATLAS Adversarial Threat Landscape for Artificial-Intelligence Systems
-
A knowledge base of adversary tactics and techniques against AI systems, modelled on MITRE ATT&CK and drawn from real attacks and research.
- MITRE ATT&CK
-
A free, globally used knowledge base of adversary tactics and techniques based on real-world observations, covering enterprise, mobile and ICS environments.
Remarks Used to map detections, plan red teams, assess coverage and share intelligence in a common language.
- MITRE D3FEND
-
A MITRE knowledge graph of defensive cybersecurity techniques that maps countermeasures to the offensive techniques they address.
- MLOps
-
Practices and tooling for reliably building, deploying, monitoring and maintaining machine learning models in production.
- Mobile application penetration test
-
Testing mobile apps and their back ends for insecure storage, weak transport security, reverse engineering exposure and API flaws, often using OWASP MASVS.
- Mode of operation
-
The way a block cipher is applied to data longer than one block, such as GCM, CBC or CTR.
Remarks Prefer authenticated modes such as GCM. ECB is insecure for most uses because it leaks patterns.
- Model card
-
A short document describing a model's intended use, performance, evaluation data, limitations and ethical considerations.
- Model Context Protocol MCP
-
An open protocol that standardises how AI applications connect to external tools and data sources.
Remarks Treat each connected server as a third party: review its permissions and the data it can reach.
- Model drift
-
Decline in a model's performance over time because the real-world data or relationships it faces have changed. This includes data drift and concept drift.
- Model evaluation
-
Testing a model against defined metrics and scenarios, such as accuracy, robustness, bias and safety, before and after deployment.
- Model extraction
-
Reproducing a model's functionality by querying it many times and training a substitute on the answers.
- Model inversion
-
An attack that reconstructs sensitive training data, or features of it, by querying a model and analysing its outputs.
- Model registry
-
A controlled repository of model versions with their metadata, approvals and lineage.
- Model theft
-
Stealing a model's weights, or copying its behaviour by systematically querying it (model extraction).
- Model weights
-
The learned numerical parameters that define a trained model's behaviour.
Remarks Openly released ("open-weight") models give anyone the weights; closed models keep them on the provider's servers. Protecting weights is part of AI security.
- Multi-cloud
-
Using services from more than one public cloud provider.
Remarks Adds resilience and choice, but also complexity in identity, logging and configuration management.
- Multi-factor authentication MFA
-
Authentication that requires two or more factors from different categories, so a stolen password alone is not enough.
Remarks SMS and push codes can be phished or fatigued. Prefer phishing-resistant MFA for administrators and high-risk access.
- Multi-tenancy
-
Many customers (tenants) sharing the same infrastructure or application while being logically isolated from each other.
Remarks Tenant isolation failures are among the most serious cloud vulnerabilities.
- Multimodal model
-
A model that can process and produce more than one type of data, such as text, images and audio.
- Mutual TLS mTLS
-
TLS in which both client and server present certificates and authenticate each other. It is common between services.
N
- Nation-state actor
-
A threat actor working for, or sponsored by, a government, typically pursuing espionage, influence or disruption.
- National Vulnerability Database NVD
-
The US NIST database that enriches CVE records with severity scores, affected products and references.
- NCA ECC Essential Cybersecurity Controls (Saudi Arabia)
-
The National Cybersecurity Authority's baseline cybersecurity controls for Saudi government bodies, critical infrastructure operators and their suppliers.
- NDPA Nigeria Data Protection Act, 2023
-
Nigeria's data protection law, which created the Nigeria Data Protection Commission (NDPC).
- Need to know
-
Restricting access to specific information to people whose duties require it, even if they hold a high enough clearance or role.
- Negligence
-
Failing to take the care that a reasonable person or organisation would have taken, causing harm. It is a key concept in liability after security incidents.
- NetFlow
-
Metadata records of network conversations: who talked to whom, when, on which ports and how much data was sent. It is used for monitoring and detection.
- Network access control NAC
-
Controls that check devices and users before admitting them to a network, often with 802.1X, and quarantine non-compliant devices.
- Network address translation NAT
-
Rewriting IP addresses as packets pass through a router, typically so many private hosts can share a public address.
Remarks NAT hides internal addressing but is not a security control in itself.
- Network detection and response NDR
-
Tools that analyse network traffic to detect threats, such as lateral movement, beaconing and exfiltration, and support response.
- Network security monitoring NSM
-
Collecting and analysing network data, such as flows, logs and packets, to detect and respond to intrusions.
- Network segmentation
-
Dividing a network into separate zones with controlled traffic between them, to limit the spread of attacks and reduce compliance scope.
Remarks Segmenting the cardholder data environment can greatly reduce PCI DSS scope; the segmentation must be tested.
- Neural network
-
A model made of layers of connected units whose weighted connections are adjusted during training to transform inputs into useful outputs.
- Next-generation firewall NGFW
-
A firewall that adds application awareness, user identity, intrusion prevention and threat intelligence to traditional port and address filtering.
- NIS2 Directive (EU) 2022/2555
-
The EU directive on a high common level of cybersecurity. It requires essential and important entities in many sectors to manage cyber risk, hold management accountable and report significant incidents.
Remarks Member states had to transpose it by 17 October 2024; obligations come from national laws, so details vary by country.
- NIST National Institute of Standards and Technology
-
The US federal agency that publishes widely used security, privacy and AI standards and guidance, such as the Cybersecurity Framework, SP 800-53 and the AI RMF.
- NIST AI RMF functions
-
The four core functions of the NIST AI Risk Management Framework: Govern (culture and accountability), Map (context and risks), Measure (analysis and tracking) and Manage (prioritising and acting on risks).
- NIST CSF NIST Cybersecurity Framework
-
A voluntary framework for managing cybersecurity risk. Version 2.0, released in February 2024, is organised into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Remarks Profiles describe current and target states; tiers describe how rigorous risk governance is.
- NIST Phish Scale
-
A NIST method for rating how difficult a phishing email is for a target audience to detect, based on its cues and how well it fits the audience's context.
- NIST SP 800-53
-
NIST's catalogue of security and privacy controls for information systems and organisations (Rev. 5). It underpins FISMA and FedRAMP baselines.
- NIST SP 800-171
-
NIST's requirements for protecting Controlled Unclassified Information in non-federal systems (Rev. 3 published May 2024). It forms the basis of CMMC Level 2.
- Non-human identity NHI
-
Identities used by machines, workloads, APIs, bots and AI agents, such as service accounts, API keys, tokens and certificates.
Remarks They often far outnumber human identities and are poorly governed.
- Non-repudiation
-
Evidence strong enough that a party cannot credibly deny having performed an action, such as sending a message or approving a transaction.
Remarks Usually achieved with digital signatures tied to a private key only the signer controls, plus trustworthy timestamps and logs. Shared accounts undermine it.
- Nonce
-
A number used once in a cryptographic operation, which prevents replay attacks or keystream reuse.
Remarks Reusing a nonce with the same key in AES-GCM can break its security completely.
- Nonconformity
-
A failure to meet a requirement, whether of a standard, a law or the organisation's own policy.
Remarks Certification audits classify findings as major or minor nonconformities; a major one can block certification until it is fixed.
- Notified body
-
An independent organisation designated by an EU member state to carry out third-party conformity assessments under EU product legislation.
- Nudge
-
A small design change that makes the secure choice easier or more likely without restricting options, such as a banner on external emails.
- Number matching
-
An MFA push feature where the user must type a number shown on the login screen into the app, defeating blind approval of fatigue prompts.
- NYDFS Part 500
-
The New York State Department of Financial Services cybersecurity regulation (23 NYCRR 500) for regulated financial firms, amended in 2023 with stronger governance, MFA and reporting duties.
O
- OAuth 2.0
-
An authorisation framework that lets an application obtain limited access to a user's resources on another service, using access tokens, without receiving the user's password.
Remarks OAuth is for authorisation; OpenID Connect adds authentication on top. Overly broad OAuth consent grants are a common attack route.
- Onboarding security training
-
Security training given to new joiners before or soon after they get system access, covering policies, threats and how to report.
- One-stop-shop
-
The GDPR mechanism that lets an organisation operating in several EU states deal mainly with one lead supervisory authority for cross-border processing.
- One-time password OTP
-
A code valid for a single login or a short time, generated by an app (TOTP), a hardware token or sent by SMS or email.
Remarks Better than a password alone, but codes can be phished in real time.
- Open design
-
The principle that a system's security should not depend on keeping its design secret, only on protecting keys or credentials.
Remarks The cryptographic version is Kerckhoffs's principle. "Security through obscurity" alone is considered weak.
- OpenID Connect OIDC
-
An identity layer on top of OAuth 2.0 that lets applications verify who a user is, using ID tokens (JWTs).
- Operating effectiveness
-
Whether a control actually operated as designed, consistently, over a defined period.
Remarks SOC 2 Type 2 reports test operating effectiveness across a review period; Type 1 looks only at design at a point in time.
- Operational resilience
-
An organisation's ability to prevent, adapt to, respond to, recover from and learn from operational disruption while continuing to deliver important business services.
Remarks A regulatory focus for financial services, for example DORA in the EU and the UK supervisors' impact tolerance rules.
- Operational technology OT
-
Hardware and software that monitors and controls physical processes, such as industrial control systems in plants, utilities and transport.
Remarks Abbreviated OT. Availability and safety usually come before confidentiality, and systems may run for decades, so patching is harder than in IT.
- Operational threat intelligence
-
Intelligence on specific campaigns, actors and their likely next moves, used to plan defence and response.
- Order of volatility
-
The principle of collecting the most short-lived evidence first, such as CPU registers and memory, then network state, then disks, then backups.
- Orphaned account
-
An account with no current, valid owner, often left behind after someone leaves.
- OSCP Offensive Security Certified Professional
-
A hands-on penetration testing certification from OffSec, earned by compromising machines in a timed practical exam.
- OSINT Open-source intelligence
-
Intelligence gathered from publicly available sources, such as websites, social media, public records, code repositories and DNS.
Remarks Attackers use it to craft targeted lures; defenders use it to see their own exposure.
- Out-of-band verification
-
Confirming a request through a separate, trusted channel, such as calling a known number, rather than replying to the message that made the request.
Remarks The most effective defence against BEC, deepfake requests and help-desk scams.
- Output encoding
-
Converting data so it is treated as text, not code, in the context where it is used, such as HTML, JavaScript, URLs or SQL.
- Overfitting
-
When a model learns its training data too closely, including noise, and performs poorly on new data.
- OWASP Open Worldwide Application Security Project
-
A non-profit foundation that produces free, community-led application security resources, such as the Top 10, ASVS, WSTG, SAMM and Cheat Sheets.
- OWASP Top 10
-
OWASP's awareness document listing the ten most critical web application security risk categories, such as broken access control and injection.
Remarks A baseline for awareness, not a complete testing standard; use ASVS for verification requirements.
- OWASP Top 10 for LLM Applications
-
A community list of the most critical security risks for applications built on large language models, such as prompt injection, sensitive information disclosure and excessive agency.
P
- PaaS Platform as a service
-
A cloud model in which the provider manages the infrastructure and runtime platform, and the customer deploys and manages its applications and data.
- Packet capture PCAP
-
Recording full network packets, often in PCAP format, for detailed forensic or troubleshooting analysis.
- Packet sniffing
-
Capturing network packets for analysis, legitimately for troubleshooting and detection, or maliciously to steal data.
- Pandemic planning
-
Continuity planning for widespread illness or prolonged staff absence, covering remote work, critical roles and supply disruption.
- Parameterised query
-
A database query in which user input is passed separately as parameters, so it can never be interpreted as SQL code. Also called a prepared statement.
- Parameters
-
The internal values, or weights, of a model learned during training. Model size is often quoted as a parameter count.
Remarks Model weights are a valuable asset; their theft or leak is a security incident.
- Pass-the-hash
-
An attack that authenticates using a stolen password hash instead of the plaintext password, common in Windows environments.
- Passkey
-
A FIDO credential that replaces a password. A private key, held on a device or synced through a password manager, is unlocked with biometrics or a PIN and is phishing-resistant.
- Password cracking
-
Recovering passwords from their hashes by guessing, with dictionaries, rules or brute force, using tools such as Hashcat or John the Ripper.
- Password hashing
-
Storing passwords as slow, salted hashes using algorithms designed for the purpose, such as Argon2, scrypt, bcrypt or PBKDF2, so that stolen hashes are expensive to crack.
- Password hygiene
-
Good practice for passwords: long passphrases, a unique password for every account, a password manager, no sharing, and MFA wherever possible.
Remarks Current NIST guidance (SP 800-63B) favours length and checking against breached lists over forced periodic changes and complexity rules.
- Password manager
-
Software that generates, stores and fills strong, unique passwords and passkeys, protected by a master secret.
- Password spraying
-
Trying a few common passwords against many accounts, to avoid lockouts that hammering a single account would trigger.
- Passwordless authentication
-
Signing in without a password, using passkeys, security keys, biometrics or other factors.
- PASTA Process for Attack Simulation and Threat Analysis
-
A seven-stage, risk-centric threat modelling method that aligns technical threats with business impact.
- Patch management
-
Acquiring, testing and deploying software updates in a controlled, timely way to fix vulnerabilities and bugs.
- Path traversal
-
Manipulating file paths, for example with ../, to access files and directories outside the intended folder.
- PCI DSS Payment Card Industry Data Security Standard
-
The global security standard for any entity that stores, processes or transmits payment card account data, or can affect its security. It is maintained by the PCI Security Standards Council.
Remarks Version 4.0.1 is current; its future-dated requirements became effective on 31 March 2025.
- PCI Secure Software Framework PCI SSF
-
PCI standards for the secure design and development of payment software and its lifecycle management.
- PDPA (Singapore) Personal Data Protection Act 2012
-
Singapore's main data protection law, administered by the Personal Data Protection Commission (PDPC), including mandatory breach notification.
- Penetration test
-
An authorised, simulated attack on systems, applications, networks or people to find and safely exploit vulnerabilities, showing real-world risk and how to fix it.
Remarks Required or expected by PCI DSS, FedRAMP, DORA (through TLPT for some firms) and many customer contracts. Results are only as good as the scope and the tester's skill.
- Penetration test report
-
The deliverable of a test: an executive summary, scope and method, findings with evidence and risk ratings, reproduction steps and remediation advice.
- Perfect forward secrecy PFS
-
A property of key exchange in which each session uses fresh ephemeral keys, so that a later compromise of a long-term key cannot decrypt past sessions.
Remarks Mandatory in TLS 1.3.
- Persistence
-
Techniques an attacker uses to keep access through reboots, password changes and clean-up attempts, such as scheduled tasks or new accounts.
- Personal data
-
Any information relating to an identified or identifiable living person, directly or indirectly, for example a name, ID number, location data, online identifier or factors specific to that person.
Remarks The GDPR term. India's DPDP Act uses "personal data" for digital data about an identifiable individual; US laws often say "personal information" with their own definitions.
- Personal data breach
-
A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Remarks Under the GDPR, notify the supervisory authority within 72 hours of becoming aware unless the breach is unlikely to result in risk, and notify individuals if risk is high. Other laws set their own clocks.
- Personal information
-
A term used by many laws, including CCPA, PIPEDA, PIPL and Australia's Privacy Act, for information about an identifiable individual. Its scope varies by law.
- Personally identifiable information PII
-
Information that can be used to distinguish or trace an individual's identity, alone or combined with other information. The term is common in US law and standards.
Remarks Usually narrower than GDPR "personal data" in practice; check the definition in the specific law or contract.
- Phish difficulty rating
-
A way of grading simulation emails by how hard their cues are to spot, so results can be compared fairly. An example is the NIST Phish Scale.
- Phish reporting button
-
A button in the email client that lets users report suspicious messages to the security team in one click, often with automated triage.
Remarks Reporting rate is one of the best measures of awareness programme success.
- Phishing
-
A social engineering attack, usually by email, that impersonates a trusted party to trick people into clicking malicious links, opening attachments, entering credentials or sending money.
- Phishing campaign (simulated)
-
A planned series of phishing simulations with defined targets, lures, schedule, difficulty and success measures.
- Phishing kit
-
A ready-made package of fake login pages and scripts used to run phishing campaigns, often sold as a service.
- Phishing simulation
-
Sending realistic but harmless phishing messages to staff, with authorisation, to measure susceptibility, deliver training and build reporting habits.
Remarks Agree rules of engagement with HR, legal and leadership. Avoid cruel lures, such as fake bonuses or health scares, that damage trust, and focus on reporting, not shaming.
- Phishing-as-a-service PhaaS
-
Criminal services that rent out phishing kits, hosting and support, so low-skilled attackers can run sophisticated campaigns.
- Phishing-resistant MFA
-
MFA that cannot be tricked into authenticating to a fake site, because the credential is bound to the real domain or device, for example FIDO2 security keys, passkeys or PKI smart cards.
- Physical control
-
A control that protects facilities and equipment, such as locks, guards, badges, CCTV and environmental protection.
- Physical penetration test
-
An authorised attempt to gain physical access to buildings, rooms or equipment to test locks, guards, badges and staff vigilance.
- Physical social engineering
-
Using deception in person, for example posing as a contractor or courier, to gain physical access to premises or equipment.
- Pig butchering
-
Long-running investment fraud in which scammers build trust, often through romance or friendship, before persuading victims to "invest" in fake crypto platforms.
- PIPA (South Korea) Personal Information Protection Act
-
South Korea's comprehensive data protection law, overseen by the Personal Information Protection Commission (PIPC).
- PIPEDA Personal Information Protection and Electronic Documents Act
-
Canada's federal private-sector privacy law, overseen by the Office of the Privacy Commissioner.
- PIPL Personal Information Protection Law
-
China's comprehensive personal information law, in force since 1 November 2021, with strict rules on consent, sensitive information and cross-border transfers.
Remarks Read it with China's Cybersecurity Law and Data Security Law.
- Pivoting
-
Using a compromised host as a stepping stone to reach networks that are not directly accessible.
- Plaintext
-
Data in readable form before encryption or after decryption.
- Plan of action and milestones POA&M
-
A document used in US federal programmes, such as FedRAMP and CMMC, to track weaknesses with planned fixes, resources and milestone dates.
- Plan-Do-Check-Act PDCA
-
A four-step cycle for continual improvement: plan changes, carry them out, check the results and act on what was learned.
- Playbook
-
Pre-defined steps for handling a specific type of incident or alert, such as ransomware or BEC. It can be manual or automated.
- Policy
-
A high-level statement of management intent and rules that must be followed, such as an acceptable use or access control policy.
- Policy as code
-
Expressing security and compliance rules as code, for example with Open Policy Agent, so they can be versioned, tested and enforced automatically.
- Policy decision point PDP
-
The component that evaluates access requests against policy and signals, then tells the enforcement point what to do.
- Policy enforcement point PEP
-
In zero trust architecture, the component that allows, monitors or ends connections between a subject and a resource, based on decisions from the policy decision point.
- POPIA Protection of Personal Information Act
-
South Africa's data protection law, enforced by the Information Regulator.
- Port scanning
-
Probing a host's network ports to find which services are listening, and often which versions are running, using tools such as Nmap.
- Post-incident review
-
A structured review after an incident to understand what happened, what went well and what to improve, with tracked actions. Also called lessons learned.
- Post-market monitoring
-
A provider's ongoing collection and review of data on how an AI system performs after release, to spot risks and take corrective action.
- Post-quantum cryptography PQC
-
Cryptographic algorithms believed to resist attacks by large quantum computers. NIST published its first standards in August 2024: ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205).
Remarks Organisations are inventorying their cryptography and planning migration, because of "harvest now, decrypt later" risk.
- Pretexting
-
Creating a believable invented scenario, the pretext, to persuade a target to share information or take an action.
- Preventive control
-
A control designed to stop an incident from happening, such as access control, encryption or input validation.
- Primary account number PAN
- Prior consultation
-
The GDPR requirement to consult the supervisory authority before processing when a DPIA shows high risk that cannot be sufficiently mitigated.
- Privacy
-
The right of individuals to control how information about them is collected, used and shared, and to be free from unwarranted intrusion.
Remarks Data protection is the legal and operational framework that puts information privacy into practice; security is one of its tools.
- Privacy Act 1988 (Australia)
-
Australia's federal privacy law, built around the Australian Privacy Principles and the Notifiable Data Breaches scheme, overseen by the OAIC.
- Privacy Act 2020 (New Zealand)
-
New Zealand's privacy law, with information privacy principles and mandatory notification of serious privacy breaches, overseen by the Privacy Commissioner.
- Privacy by default
-
Making sure that, by default, only the personal data necessary for each purpose is processed, without the user having to change settings.
- Privacy by design
-
Building privacy protections into systems, products and processes from the start and throughout their life, rather than adding them afterwards.
Remarks A legal duty under GDPR Article 25 ("data protection by design and by default"). ISO 31700 gives consumer-product guidance.
- Privacy engineering
-
Applying engineering methods to build privacy requirements into systems, such as data flow analysis, privacy threat modelling (for example LINDDUN) and PETs.
- Privacy impact assessment PIA
-
A process to identify and reduce privacy risks of a project or system. It is a broader, often non-statutory, cousin of the DPIA.
Remarks ISO/IEC 29134 gives guidance.
- Privacy information management system PIMS
-
A management system for privacy, specified by ISO/IEC 27701, that extends or works alongside an ISMS to cover PII controllers and processors.
- Privacy notice
-
Information given to individuals about who processes their data, why, on what basis, with whom it is shared, for how long, and how to exercise their rights.
Remarks Also called a privacy policy or privacy statement. It must be concise, clear and easy to find.
- Privacy professional
-
A practitioner who manages privacy compliance and programmes, for example as a privacy officer, privacy analyst, privacy engineer or DPO.
Remarks Common certifications include IAPP's CIPP, CIPM and CIPT.
- Privacy screen
-
A filter fitted to a display that limits viewing angles, so people nearby cannot read the screen.
- Privacy-enhancing technologies PETs
-
Technologies that let organisations use data while reducing privacy risk, such as differential privacy, homomorphic encryption, secure multi-party computation and federated learning.
- Private cloud
-
Cloud infrastructure operated for a single organisation, on premises or hosted.
- Private key
-
The secret half of an asymmetric key pair, used to decrypt data or create digital signatures. It must never be shared.
- Privilege escalation
-
Gaining higher permissions than originally granted, either vertically (user to admin) or horizontally (one user to another user's data).
- Privileged access management PAM
-
Controls and tools that secure, monitor and limit administrative and other high-risk accounts, for example credential vaulting, session recording and just-in-time elevation.
- Privileged account
-
An account with elevated permissions, such as domain admin, root, a cloud owner or a database administrator, whose misuse could cause major harm.
- Procedure
-
Step-by-step instructions for carrying out a task in line with policies and standards.
- Processing
-
Any operation on personal data, automated or not: collecting, recording, organising, storing, adapting, retrieving, using, disclosing, combining, restricting, erasing or destroying it.
Remarks The definition is deliberately broad. Merely storing data counts as processing.
- Processor
-
An organisation that processes personal data on behalf of a controller and only on its documented instructions (GDPR term).
Remarks Cloud and SaaS providers are often processors. Using a sub-processor needs the controller's authorisation.
- Profiling
-
Automated processing of personal data to evaluate or predict aspects of a person, such as their performance, finances, health, preferences, behaviour or location.
- Programmable logic controller PLC
-
A rugged industrial computer that directly controls machinery or processes based on inputs from sensors.
- Prohibited AI practices
-
AI uses banned by EU AI Act Article 5 since 2 February 2025. Examples are manipulative or exploitative techniques causing significant harm, social scoring, untargeted scraping of facial images, emotion recognition at work and in schools (with exceptions), and certain real-time remote biometric identification by police.
- Prompt
-
The input given to a generative model to direct its output, including instructions, examples and data.
- Prompt engineering
-
Designing and refining prompts to get reliable, useful outputs from a generative model.
- Prompt injection
-
An attack in which crafted input makes a language model ignore its instructions or perform actions the developer did not intend.
Remarks Ranked first in the OWASP Top 10 for LLM Applications. There is no complete fix, so limit what the model can access and do, and treat its output as untrusted.
- Proof of concept PoC
-
Code or steps that demonstrate a vulnerability can be exploited, without necessarily being weaponised.
- Protected health information PHI
-
Under HIPAA, individually identifiable health information held or transmitted by a covered entity or business associate, in any form.
Remarks ePHI is PHI in electronic form, which the HIPAA Security Rule specifically protects.
- Provider (AI Act)
-
Under the EU AI Act, the person or organisation that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name.
Remarks Providers carry most obligations for high-risk systems: risk management, data governance, documentation, conformity assessment and post-market monitoring.
- Provisioning
-
Creating accounts and granting access according to approved requests or roles.
- Proxy server
-
An intermediary that forwards requests between clients and servers, used for filtering, caching, anonymity or inspection.
- Pseudonymisation
-
Processing personal data so it can no longer be attributed to a person without additional information that is kept separately and protected.
Remarks Pseudonymised data is still personal data under the GDPR, but pseudonymisation is a recognised safeguard.
- Public cloud
-
Cloud services offered over the internet to many customers on shared infrastructure owned by a provider.
- Public key
-
The shareable half of an asymmetric key pair, used to encrypt data for the owner or verify their signatures.
- Public key infrastructure PKI
-
The roles, policies, hardware, software and procedures for creating, managing, distributing, using and revoking digital certificates.
- Purple team
-
A collaborative exercise in which red and blue teams work together, running attack techniques and tuning detections in real time.
- Purpose limitation
-
The principle that personal data is collected for specified, explicit and legitimate purposes and not used later in ways incompatible with them.
- Pyramid of Pain
-
A model that ranks indicators by how painful it is for an adversary when defenders detect them: from hash values (trivial to change) up to TTPs (hardest to change).
Q
- Qualified Security Assessor QSA
-
An assessor certified by the PCI Security Standards Council to validate an entity's compliance with PCI DSS.
- Qualitative risk analysis
-
Rating risks on descriptive scales, such as low, medium and high, often shown in a heat map.
Remarks Quick and accessible, but ratings can be subjective. Clear scale definitions improve consistency.
- Quantitative risk analysis
-
Expressing risk in numbers, typically money and probability, for example with annualised loss expectancy or Monte Carlo simulation.
Remarks FAIR is a widely used model for quantifying cyber risk.
- Quid pro quo
-
A social engineering tactic that offers a service or benefit, such as "IT support", in exchange for information or access.
- Quishing QR-code phishing
-
Phishing that uses QR codes to send victims to malicious sites. It often slips past email link scanning and moves the victim to a less protected phone.
R
- RADIUS Remote Authentication Dial-In User Service
-
A protocol for centralised authentication, authorisation and accounting of network access.
- Rainbow table
-
A precomputed table for reversing unsalted hashes. Salting makes it ineffective.
- Random number generator
-
A source of unpredictable values for keys, nonces and salts. Cryptographic use needs a cryptographically secure generator (CSPRNG).
- Ransomware
-
Malware that encrypts or steals data and demands payment to restore access or prevent publication.
Remarks Modern attacks often combine encryption with data theft (double extortion). Offline, tested backups and fast detection are the key defences.
- Ransomware-as-a-service RaaS
-
A model in which ransomware developers lease their malware and infrastructure to affiliates who carry out attacks and share the profits.
- Rate limiting
-
Restricting how many requests a client can make in a period, to prevent abuse, brute force and resource exhaustion.
- RBI cyber security directions
-
Reserve Bank of India requirements on IT governance, risk, controls and cyber resilience for banks and other regulated entities, including the 2023 Master Direction on IT governance, risk, controls and assurance practices.
- Re-identification
-
Identifying individuals in data that was supposed to be anonymised or de-identified, often by linking it with other data sets.
- Readiness assessment
-
A pre-audit review to check whether an organisation is ready for a formal certification or attestation audit.
- Recertification audit
-
A full audit, typically every three years, to renew a management system certificate.
- Reconnaissance
-
The information-gathering phase of an attack or test: discovering targets, people, technologies and weaknesses.
Remarks Passive reconnaissance avoids touching the target, using OSINT for example; active reconnaissance interacts with it, through scanning for example.
- Record of processing activities RoPA
-
A documented record that controllers and processors keep of their processing: purposes, data categories, recipients, transfers, retention and security measures (GDPR Article 30).
Remarks The practical starting point for privacy compliance, much as an asset inventory is for security.
- Recovery (incident)
-
Restoring systems and services to normal operation safely, and monitoring for signs of reinfection.
- Recovery control
-
A control that brings systems and data back after a disruption, such as backups, disaster recovery sites and restoration procedures.
- Recovery point objective RPO
-
The maximum acceptable amount of data loss, measured in time, back to the last recoverable copy.
Remarks An RPO of one hour means backups or replication must capture data at least hourly.
- Recovery site
-
An alternative location for running operations after a disaster. A hot site is ready immediately, a warm site partly equipped, and a cold site has only basic facilities.
- Recovery time objective RTO
-
The target time within which a process, system or service must be restored after a disruption.
- Red flags (phishing)
-
Warning signs of phishing: unexpected requests, urgency, mismatched sender addresses or links, unusual attachments, requests for credentials or payment, and changes to bank details.
- Red team
-
A team that emulates real adversaries across people, process and technology to test an organisation's detection and response against defined objectives, often covertly and over weeks.
Remarks Different from a pentest: the aim is to test defenders and achieve objectives, not to list every vulnerability.
- Red teaming (AI)
-
Structured adversarial testing of an AI system to find harmful outputs, security weaknesses and failure modes before attackers or users do.
Remarks The EU AI Act expects adversarial testing for general-purpose AI models with systemic risk.
- Redundancy
-
Duplicating critical components, such as power, networks, servers and sites, so the failure of one does not stop service.
- Reference monitor
-
An abstract component that mediates every access by subjects to objects, enforcing the security policy. It must be tamper-proof, always invoked and small enough to verify.
- Refresh token
-
A longer-lived credential used to obtain new access tokens without the user signing in again.
Remarks Must be protected and revocable; stolen refresh tokens give lasting access.
- Register of information
-
Under DORA, the register that financial entities must keep of all contractual arrangements with ICT third-party service providers, reported to supervisors.
- Regulator
-
A public authority empowered by law to supervise a sector or activity, issue rules and guidance, investigate and enforce, for example data protection authorities and financial supervisors.
- Regulatory change management
-
Tracking new and changing laws, regulations and guidance, assessing their impact and updating policies and controls in time.
- Regulatory compliance
-
Meeting the obligations set by laws and regulators, as distinct from voluntary standards or contractual promises.
- Reinforcement learning
-
Machine learning in which an agent learns by trial and error, receiving rewards or penalties for its actions.
- Remediation plan
-
A plan of actions, owners and deadlines to close identified gaps, findings or vulnerabilities.
- Remote access trojan RAT
-
Malware that gives an attacker remote control over an infected system.
- Remote biometric identification
-
Identifying people at a distance, without their active involvement, by comparing their biometric data with a reference database, for example live facial recognition in public spaces.
- Remote code execution RCE
-
A vulnerability that lets an attacker run arbitrary code on a target system over a network. It is usually the most severe class of vulnerability.
- Remote desktop protocol RDP
-
Microsoft's protocol for graphical remote access to Windows systems.
Remarks Exposed RDP is a leading ransomware entry point. Place it behind a VPN or ZTNA with MFA.
- Replay attack
-
Capturing a valid transmission, such as a login or transaction, and re-sending it to repeat its effect.
- Report on Compliance ROC
-
The detailed PCI DSS assessment report completed by a QSA (or an internal security assessor), with an Attestation of Compliance (AOC).
- Reporting rate
-
The share of recipients who report a phishing simulation or a real suspicious message.
Remarks More useful than click rate alone. Many reports in the first few minutes shrink the attacker's window.
- Residual risk
-
The risk that remains after controls are applied. It must be within appetite or explicitly accepted.
- Responsible AI
-
An umbrella term for developing and using AI in ways that are ethical, lawful, safe, fair, transparent and accountable.
- Retention schedule
-
A documented list of data or record types with how long each is kept, why, and what happens at the end.
- Retest
-
Re-checking reported findings after remediation to confirm they are fixed.
- Retrieval-augmented generation RAG
-
A technique where relevant documents are retrieved from a knowledge source and added to a model's prompt, so answers are grounded in that content.
Remarks Reduces hallucination but adds risks: indirect prompt injection through retrieved content and leakage of documents the user should not see.
- Reverse engineering
-
Analysing compiled software or hardware to understand how it works without its source code or design documents.
- Reverse proxy
-
A server in front of web applications that receives client requests and forwards them, often adding TLS, load balancing and WAF protection.
- Right of access
-
The right to obtain a copy of one's personal data and details about how it is processed.
- Right to audit
-
A contract clause that lets a customer, or its regulator, audit a supplier's controls or receive equivalent assurance.
- Right to data portability
-
The right to receive personal data one has provided in a structured, commonly used, machine-readable format and to have it sent to another controller.
- Right to erasure
-
The right to have personal data deleted in certain circumstances, for example when it is no longer needed or consent is withdrawn. Also called the right to be forgotten.
Remarks Not absolute: legal retention duties and other exemptions can apply. Erasure must reach backups and processors according to a defined process.
- Right to object
-
The right to object to processing based on legitimate interests or public task, and an absolute right to object to direct marketing.
- Right to rectification
-
The right to have inaccurate personal data corrected and incomplete data completed.
- Right to restriction of processing
-
The right to have processing limited, for example while the accuracy of the data is being checked, so the data is stored but not otherwise used.
- Risk
-
The effect of uncertainty on objectives. In security it is usually expressed as the likelihood of a threat exploiting a vulnerability combined with the impact if it does.
Remarks Risk is about consequences for the business, not just technical flaws. Every risk needs an owner and a treatment decision.
- Risk acceptance
-
A documented, informed decision by an authorised owner to retain a risk without further treatment.
Remarks Acceptance should be time-limited and reviewed. Undocumented "acceptance" is usually just neglect.
- Risk analysis
-
Understanding the nature of a risk and determining its level, usually by estimating likelihood and impact.
- Risk appetite
-
The amount and type of risk an organisation is willing to pursue or accept to achieve its objectives, set by leadership.
Remarks Without a stated appetite, risk acceptance decisions become inconsistent. Appetite is often expressed per risk category.
- Risk assessment
-
The overall process of identifying risks, analysing their likelihood and impact, and evaluating them against criteria to decide which need treatment.
Remarks ISO/IEC 27001 requires a repeatable method that gives consistent, valid and comparable results.
- Risk avoidance
-
Removing a risk by not starting, or by stopping, the activity that creates it.
- Risk evaluation
-
Comparing analysed risk levels with risk criteria and appetite to decide which risks need treatment and in what priority.
- Risk exception
-
A formally approved, usually time-bound deviation from a policy or control requirement, with the resulting risk recorded and accepted.
- Risk identification
-
Finding and describing risks: what could happen, to which assets or objectives, from which threats and through which weaknesses.
- Risk management
-
The coordinated activities to identify, analyse, evaluate, treat, monitor and communicate risk.
Remarks ISO 31000 gives general guidance; ISO/IEC 27005 and NIST SP 800-30 and 800-37 apply it to information security.
- Risk matrix
-
A grid that plots likelihood against impact to rate and compare risks visually; also called a heat map.
- Risk mitigation
-
Reducing a risk's likelihood or impact by applying controls. Also called risk modification or reduction.
- Risk owner
-
The person with the accountability and authority to manage a particular risk, including approving its treatment and accepting what remains.
- Risk register
-
A record of identified risks with their description, owner, ratings, treatment and status.
Remarks Kept current, it is the backbone of risk reporting and audit evidence. Left stale, it becomes a compliance artefact nobody uses.
- Risk score (user)
-
A metric that estimates an individual's or group's likelihood of causing or suffering a security incident, based on behaviour such as simulation results, training completion and policy violations.
Remarks Use carefully and transparently. Scores should drive support, not punishment, and may raise employee privacy issues.
- Risk tolerance
-
The acceptable variation around risk appetite for a specific objective or category, often expressed as measurable thresholds.
- Risk transfer
-
Sharing a risk's financial consequences with another party, typically through insurance or contracts. Also called risk sharing.
Remarks Accountability for protecting data generally cannot be transferred, even when costs can.
- Risk treatment
-
Selecting and implementing options to deal with a risk: modify (mitigate), avoid, share (transfer) or retain (accept) it.
Remarks ISO/IEC 27001 requires a risk treatment plan and an owner's approval of the residual risk.
- Risk treatment plan
-
The documented plan for how each risk will be treated: chosen controls, owners, resources and target dates.
- Risk-based approach (AI)
-
Regulating AI according to the level of risk it poses: unacceptable (prohibited), high-risk (strict duties), limited risk (transparency duties) and minimal risk (largely free use).
- RLHF Reinforcement learning from human feedback
-
A training method in which human ratings of model outputs are used to train a reward signal that steers the model towards preferred behaviour.
- Rogue access point
-
An unauthorised wireless access point connected to a network, installed by an attacker or by an employee for convenience.
- Role-based access control RBAC
-
Granting permissions to roles that reflect job functions, then assigning people to roles.
Remarks Simple to audit, but role explosion is a common problem in large organisations.
- Role-based training
-
Security training tailored to the specific risks and duties of a job, such as for developers, finance staff, executives, administrators or call-centre agents.
- Romance scam
-
Fraud in which criminals build a fake romantic relationship online to extract money or information.
- Root cause analysis RCA
-
Investigating a problem to find the underlying cause, not just the symptom, so that fixes prevent recurrence. Common methods include the five whys and fishbone diagrams.
- Root certificate
-
The self-signed certificate at the top of a chain of trust, preinstalled in operating systems and browsers as a trust anchor.
- Root of trust
-
A component, usually hardware, that is inherently trusted and from which the trustworthiness of other components is established.
- Rootkit
-
Malware that hides its presence and keeps privileged access by modifying the operating system, firmware or boot process.
- RSA
-
A widely used public-key algorithm for encryption and signatures, based on the difficulty of factoring large numbers.
Remarks Use at least 2048-bit keys today. Like other classical public-key schemes, RSA is threatened by future large quantum computers.
- Rules of engagement RoE
-
The agreed document that governs a security test: scope, permitted techniques, timing, contacts, handling of sensitive data, stop conditions and emergency procedures.
Remarks Get it signed by someone with authority over every system in scope, including third-party hosts where required.
- Runbook
-
Detailed, step-by-step technical instructions for a routine or response task, often more granular than a playbook.
- Runtime application self-protection RASP
-
Security built into an application's runtime that detects and blocks attacks from inside the app.
S
- SaaS Software as a service
-
A cloud model in which the provider delivers a complete application, and the customer mainly manages users, configuration and data.
Remarks SaaS security posture management tools check settings across many SaaS apps.
- SaaS security posture management SSPM
-
Tools that monitor the security settings, user permissions and third-party integrations of SaaS applications.
- SABSA
-
Sherwood Applied Business Security Architecture, a business-driven method for developing enterprise security architecture from business requirements down to components.
- Salt
-
A unique random value added to each password before hashing, so identical passwords produce different hashes and precomputed tables are useless.
- SameSite cookie
-
A cookie attribute (Strict, Lax or None) that controls whether cookies are sent with cross-site requests. It helps prevent CSRF.
- SAML Security Assertion Markup Language
-
An XML-based standard for exchanging authentication and authorisation assertions between identity providers and service providers, widely used for enterprise SSO.
- Sampling
-
Testing a subset of items, such as access requests or changes, to draw conclusions about a whole population.
Remarks Auditors choose sample sizes based on how often a control runs and the risk involved.
- Sandboxing
-
Running code in an isolated environment with tightly limited access, so it cannot harm the host or reach data outside the sandbox.
Remarks Used by browsers, email security gateways that detonate attachments, and malware analysts.
- SASE Secure access service edge
-
A cloud-delivered model that combines networking (SD-WAN) and security services, such as ZTNA, secure web gateway, CASB and firewall-as-a-service.
- Saudi PDPL Personal Data Protection Law (Saudi Arabia)
-
Saudi Arabia's data protection law, supervised by the Saudi Data and AI Authority (SDAIA), with rules on consent, rights, breach notification and transfers.
- SCADA Supervisory control and data acquisition
-
Systems that collect data from and control geographically spread industrial equipment, such as pipelines, power grids and water networks.
- SCIM System for Cross-domain Identity Management
-
An open standard for automating user provisioning and deprovisioning between identity systems and applications.
- Scope (testing)
-
The precise systems, addresses, applications, accounts, locations and techniques that a test may cover, and what is explicitly excluded.
- SEBI CSCRF Cybersecurity and Cyber Resilience Framework
-
The Securities and Exchange Board of India's framework, issued in August 2024, setting cybersecurity and resilience requirements for its regulated entities, in proportion to their category.
- SEC cybersecurity disclosure rules
-
Rules adopted by the US Securities and Exchange Commission in 2023. Public companies must disclose material cybersecurity incidents on Form 8-K, generally within four business days of determining materiality, and describe their cyber risk management and governance each year.
- Secrets management
-
Securely storing, distributing, rotating and auditing credentials such as API keys, passwords, tokens and certificates, using a vault instead of hard-coding them.
Remarks Secrets committed to code repositories are found by attackers within minutes; scan for them before they are committed.
- Secure boot
-
A start-up process where each piece of firmware and software is checked against a trusted signature before it runs, so tampered code is refused.
- Secure by default
-
Shipping products with their most secure settings enabled out of the box, so users must take a deliberate step to reduce protection.
- Secure by design pledge
-
A voluntary commitment, led by CISA, in which software manufacturers commit to measurable security improvements such as MFA by default and fewer default passwords.
- Secure coding training
-
Training that teaches developers to avoid common vulnerabilities and use secure design patterns, often with hands-on labs.
- Secure configuration baseline
-
An approved, documented set of security settings that systems of a given type must meet.
Remarks Configuration management tools compare systems against the baseline and flag drift.
- Secure development lifecycle SDLC (secure)
-
A software development process with security activities built into every phase: requirements, design, coding, testing, release and maintenance.
Remarks NIST's Secure Software Development Framework (SP 800-218) and OWASP SAMM are common references.
- Secure email gateway SEG
-
A service that filters inbound and outbound email for spam, phishing, malware and data leaks.
- Secure multi-party computation SMPC
-
Techniques that let several parties jointly compute a result from their combined data without revealing their individual inputs to each other.
- Secure Software Development Framework SSDF
-
NIST SP 800-218, a set of high-level secure software development practices organised into four groups: prepare the organisation, protect the software, produce well-secured software, and respond to vulnerabilities.
Remarks US federal software suppliers attest to SSDF-based practices.
- Secure web gateway SWG
-
A service that filters users' web traffic to block malicious sites, enforce acceptable use and inspect downloads.
- Security architecture
-
The structured design of security controls across an organisation's systems, showing how they work together to meet business and risk requirements.
- Security automation
-
Using scripts, playbooks and tools to perform repetitive security tasks consistently and quickly, freeing analysts for judgement work.
- Security awareness
-
People's knowledge of the security risks they face and of what they should do about them in their everyday work.
Remarks Awareness alone rarely changes behaviour. Programmes now aim for measurable behaviour and culture change.
- Security awareness month
-
An annual campaign, held each October in many countries, to promote cyber safety to staff and the public.
- Security awareness programme
-
The organisation-wide effort to give people the knowledge, skills and habits to protect information, sustained over time and measured.
- Security awareness training SAT
-
Structured education that teaches staff to recognise and respond to security threats and to follow security policies.
Remarks Required or expected by ISO/IEC 27001, PCI DSS, HIPAA, NIS2 and many sector rules. Short, frequent, role-relevant content works better than one annual session.
- Security behaviour
-
The observable actions people take that affect security, such as reporting phishing, locking screens, using MFA and handling data correctly.
- Security by design
-
Building security into systems from the earliest design stage instead of adding it after release.
Remarks Closely related to privacy by design and to secure-by-design commitments from software vendors. Cheaper than retrofitting controls.
- Security champion
-
A staff member outside the security team who promotes good practice in their own team and acts as a link to security.
Remarks Champion programmes scale security knowledge in engineering and business units.
- Security control
-
A safeguard or countermeasure that reduces risk by preventing, detecting, correcting or deterring harm to assets.
Remarks Controls are commonly grouped as administrative, technical and physical, or by function: preventive, detective, corrective, deterrent, recovery and compensating.
- Security culture
-
The shared values, beliefs and habits that shape how people think and act about security in an organisation.
Remarks Signals of a healthy culture include high reporting rates, leaders who model secure behaviour, and people who are comfortable admitting mistakes.
- Security event
-
Any observable occurrence relevant to security, such as a login, a firewall block or a configuration change. Most events are benign.
- Security headers
-
HTTP response headers that enable browser protections, such as Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy.
- Security incident
-
An event that actually or potentially compromises the confidentiality, integrity or availability of information or systems, or violates security policy.
Remarks Not every security event is an incident; not every incident is a reportable breach.
- Security maturity
-
How consistently and effectively an organisation's security practices are defined, performed, measured and improved.
Remarks Maturity models, such as the NIST CSF implementation tiers or capability maturity levels, help plan improvement but are not certifications.
- Security metrics
-
Measurements used to track the effectiveness, efficiency and coverage of security controls and the level of risk over time.
Remarks Good metrics drive decisions. Avoid vanity counts, such as "attacks blocked", that leadership cannot act on.
- Security operations centre SOC
-
The team, processes and technology that monitor an organisation's environment around the clock to detect, analyse and respond to security threats.
Remarks It can be in-house, outsourced to an MSSP or MDR provider, or hybrid. Not to be confused with SOC 2 reports, which are an audit framework.
- Security posture
-
The overall strength of an organisation's security at a point in time: its controls, their effectiveness and its ability to detect and respond.
- Security questionnaire
-
A structured set of questions sent to a supplier about its security controls, such as SIG, CAIQ or a custom list.
Remarks Answers are claims; ask for evidence for the controls that matter most.
- Security requirement
-
A documented need for a security function or property in a system, such as "all API calls must be authenticated", that is defined early and tested.
- Security roadmap
-
A time-sequenced plan of initiatives that carries out the security strategy and closes priority gaps.
- Security strategy
-
A multi-year plan that sets the direction, priorities and investment for security in line with business goals and risk appetite.
- Security through obscurity
-
Relying on the secrecy of a design or implementation as the main protection.
Remarks Obscurity can add a small delay for attackers, but it should never be the only control.
- security.txt
-
A standard text file, published at /.well-known/security.txt, that tells researchers how to report security issues to an organisation (RFC 9116).
- Self-Assessment Questionnaire SAQ
-
A PCI DSS validation tool for eligible merchants and service providers to assess themselves. The SAQ type depends on how cards are accepted.
- Sensitive information disclosure
-
An AI risk where a model or application reveals confidential data, such as personal data, secrets or proprietary content, in its outputs.
- Sensitive personal data
-
Personal data that many laws give extra protection because misuse could cause serious harm, such as health, biometric, financial, children's or precise location data.
Remarks Each law sets its own list; California's CPRA calls it "sensitive personal information".
- SEO poisoning
-
Manipulating search engine rankings so malicious sites appear for popular searches, such as software downloads.
- Separation of duties
-
Splitting a sensitive task between two or more people so no one person can complete it alone, reducing the risk of fraud and error.
Remarks Classic example: the person who raises a payment cannot also approve it. Where staff numbers make it impractical, compensating controls such as independent review are used.
- Serious incident (AI)
-
Under the EU AI Act, an incident or malfunction of an AI system that leads to death or serious harm to health, serious disruption of critical infrastructure, infringement of fundamental rights obligations, or serious harm to property or the environment.
Remarks Providers of high-risk systems must report serious incidents to market surveillance authorities within set deadlines.
- Server-side request forgery SSRF
-
Making a server send requests to unintended destinations, such as internal services or cloud metadata endpoints, by abusing a feature that fetches URLs.
- Serverless
-
A cloud model in which code runs in provider-managed functions triggered by events, with no servers for the customer to manage.
Remarks Function permissions and event-input validation become the main security concerns.
- Service account
-
A non-human account used by an application or service to run processes or access resources.
Remarks Often over-privileged, with passwords that never change. Use managed identities and rotate secrets.
- Service level agreement SLA
-
A contractual commitment on measurable service levels, such as availability, response times and support hours, often with remedies if missed.
- Service provider (identity)
-
In federated identity, the application that relies on an identity provider to authenticate users. Also called a relying party.
- Session hijacking
-
Taking over a user's authenticated session by stealing or predicting the session token or cookie.
Remarks Stolen cookies bypass MFA. Defences include short sessions, token binding, device checks and detecting impossible travel.
- Session management
-
How an application creates, protects, expires and ends user sessions after login.
- Severity level
-
A rating of an incident's seriousness, such as P1 to P4 or critical to low, that drives response speed, escalation and communication.
- SHA-2
-
A family of NIST hash functions (SHA-224, SHA-256, SHA-384, SHA-512) in wide use for integrity checks and signatures.
- Shadow AI
-
Employees' use of AI tools that the organisation has not approved or does not know about, often with company data pasted in.
Remarks Better handled with an approved toolset and clear guidance than with outright bans.
- Shadow IT
-
Technology, such as cloud apps or devices, used within an organisation without the knowledge or approval of IT or security teams.
Remarks Creates unmanaged data stores and accounts. Discovery tools and a fast approval process work better than outright bans.
- Shift left
-
Moving security activities earlier in development, to design and coding, where problems are cheaper to fix.
- Shoulder surfing
-
Watching someone's screen or keyboard to steal information such as passwords or PINs.
- SIEM Security information and event management
-
A platform that collects and normalises logs and events from across the environment, correlates them against detection rules, raises alerts and supports investigations and compliance reporting.
Remarks A SIEM is only as good as its log coverage and its tuned detections; noisy rules cause alert fatigue.
- Sigma rule
-
A generic, open signature format for describing log-based detections that can be converted into many SIEM query languages.
- Signature-based detection
-
Detecting threats by matching known patterns, such as file hashes, byte sequences or traffic signatures.
Remarks Fast and precise for known threats, but blind to new or modified ones.
- Significant Data Fiduciary
-
A Data Fiduciary designated by the Indian government based on factors such as the volume and sensitivity of data and risk to rights. It carries extra duties, such as a Data Protection Officer in India, independent audits and impact assessments.
- Significant incident
-
Under NIS2, an incident that has caused or could cause severe operational disruption or financial loss, or considerable damage to others, and so must be reported.
- Single loss expectancy SLE
-
The expected cost of one occurrence of a risk event: the asset value multiplied by the exposure factor (the proportion of value lost).
- Single point of failure SPOF
-
A component whose failure would stop an entire system or service, because there is no backup for it.
- Single sign-on SSO
-
Letting users authenticate once with an identity provider and then access many applications without signing in again.
Remarks Improves usability and central control, but makes the identity provider a high-value target that needs strong MFA and monitoring.
- SLSA Supply-chain Levels for Software Artifacts
-
An OpenSSF framework of increasing levels of build integrity and provenance requirements for software artefacts.
- Smishing SMS phishing
-
Phishing by text message or messaging app, often posing as parcel deliveries, banks or tax authorities.
- SOAR Security orchestration, automation and response
-
Tools that automate and coordinate security workflows, such as enrichment, triage, containment and ticketing, through playbooks that connect many systems.
- SOC 1
-
An AICPA report on a service organisation's controls relevant to its customers' internal control over financial reporting.
- SOC 2
-
An AICPA attestation report, issued by a licensed CPA firm, on a service organisation's controls relevant to the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
Remarks Security (the common criteria) is always in scope; the other categories are optional.
- SOC 2 Type 1
-
A SOC 2 report on the design of controls at a specific point in time.
- SOC 2 Type 2
-
A SOC 2 report on the design and operating effectiveness of controls over a review period, often 3 to 12 months.
Remarks Usually what enterprise customers ask for. Read the exceptions and the complementary user entity controls.
- SOC 3
-
A general-use summary report based on a SOC 2 examination, suitable for public distribution, without detailed test results.
- SOC analyst
-
A practitioner who monitors alerts, triages and investigates suspicious activity and escalates or responds to incidents. The role is often tiered from L1 triage to L3 advanced analysis.
- Social engineering assessment
-
An authorised test of how staff respond to manipulation, such as phishing, vishing or on-site pretexting.
- Software assurance maturity model SAMM
-
OWASP's maturity model for assessing and improving a software security programme across governance, design, implementation, verification and operations.
- Software bill of materials SBOM
-
A formal, machine-readable inventory of the components and dependencies in a piece of software, in formats such as SPDX or CycloneDX.
Remarks Helps customers find out quickly whether they are affected by a newly disclosed vulnerability. The EU Cyber Resilience Act requires manufacturers to draw up an SBOM.
- Software composition analysis SCA
-
Identifying open-source and third-party components in software and checking them for known vulnerabilities and licence issues.
- Software supply chain attack
-
Compromising software before it reaches users, through dependencies, build systems, update servers or developer accounts, to infect many downstream victims.
- Software-defined perimeter SDP
-
An architecture that hides services from unauthorised users and creates individual, authenticated connections only after identity and device are verified.
- Sovereign cloud
-
Cloud services designed so data, operations and control stay within a jurisdiction and are subject only to its laws.
- SOX Sarbanes-Oxley Act of 2002
-
US law requiring public companies to maintain internal controls over financial reporting. Its IT general controls cover access, change management and operations.
- Spear phishing
-
Phishing targeted at a specific person or group, using researched details to make the message convincing.
- Special category data
-
Under the GDPR, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, plus genetic data, biometric data used to identify someone, health data, and data on sex life or sexual orientation.
Remarks Processing is prohibited unless one of the specific conditions in Article 9 applies. Criminal offence data has its own rules.
- SPF Sender Policy Framework
-
A DNS record that lists which mail servers are allowed to send email for a domain.
- Split knowledge
-
Dividing a secret, such as a cryptographic key, so that no single person knows all of it.
- SQL injection SQLi
-
Injecting SQL through input fields or parameters to read, change or delete database data, or to bypass authentication.
Remarks Prevented with parameterised queries or prepared statements, not with input filtering alone.
- SSH Secure Shell
-
A cryptographic protocol for secure remote login, command execution and file transfer.
Remarks Use key-based authentication, disable root login, and manage keys centrally.
- Stage 1 audit
-
The first part of an initial certification audit, reviewing documentation and readiness before the main assessment.
- Stage 2 audit
-
The main part of an initial certification audit, assessing whether the management system is implemented and effective in practice.
- Standard (document)
-
An internal document that sets mandatory, specific requirements supporting a policy, such as minimum password length or approved encryption algorithms.
Remarks Not to be confused with external standards such as ISO/IEC 27001.
- Standard contractual clauses SCCs
-
Model contract terms approved by the European Commission that controllers and processors can sign to provide safeguards for transfers outside the EEA.
Remarks Usually need a transfer impact assessment. The UK has its own International Data Transfer Agreement and Addendum.
- Stateful inspection
-
Firewall filtering that tracks the state of connections and allows return traffic only for sessions that were legitimately opened.
- Statement of Applicability SoA
-
The ISO/IEC 27001 document that lists every Annex A control, states whether each applies and is implemented, and justifies each inclusion or exclusion.
Remarks Auditors read it closely; it should agree with the risk treatment plan.
- Static application security testing SAST
-
Analysing source code or binaries for security flaws without running the application.
- Steganography
-
Hiding data inside other data, such as an image or audio file, so its existence is concealed.
- STIX Structured Threat Information Expression
-
An OASIS standard language and format for describing threat intelligence: indicators, actors, campaigns, malware and their relationships.
- Storage limitation
-
The principle that personal data is kept in identifiable form for no longer than necessary for the purpose.
- Strategic threat intelligence
-
High-level intelligence on threat trends, motivations and risks for leadership and risk decisions.
- Stream cipher
-
A cipher that encrypts data one bit or byte at a time by combining it with a keystream, such as ChaCha20.
- STRIDE
-
A threat modelling mnemonic from Microsoft: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
- Sub-processor
-
A processor engaged by another processor to carry out part of the processing for a controller.
- Subdomain takeover
-
Claiming an organisation's subdomain that still points, through DNS, to a deleted cloud resource or service, so an attacker can host content on it.
- Subservice organisation
-
A vendor used by a service organisation, such as a cloud host, whose controls may be included in a SOC report (inclusive method) or excluded from it (carve-out method).
- Succession planning
-
Identifying and preparing deputies for critical roles, so key decisions and skills are available during a crisis.
- Supervised learning
-
Machine learning from labelled examples, where the model learns to map inputs to known correct outputs.
- Supervisory authority
-
An independent public authority in an EU or EEA member state responsible for monitoring and enforcing the GDPR, such as Ireland's DPC or France's CNIL.
Remarks Outside the EU the usual term is data protection authority (DPA). The UK equivalent is the ICO.
- Supply chain attack
-
An attack that compromises a trusted supplier, product or update channel to reach that supplier's customers.
- Supply chain risk
-
Risk to an organisation from weaknesses in the suppliers, products, software and services it relies on.
- Surveillance audit
-
A periodic audit, usually yearly, between full recertification audits to confirm a certified system is still maintained.
- SWIFT Customer Security Programme SWIFT CSP
-
SWIFT's programme requiring users to attest each year to the mandatory controls in its Customer Security Controls Framework (CSCF).
- Symmetric encryption
-
Encryption in which the same secret key is used to encrypt and decrypt. It is fast and used for bulk data.
Remarks The challenge is distributing and protecting the shared key.
- Synthetic data
-
Artificially generated data that mimics the statistical properties of real data. It is used for testing or training with less privacy risk.
Remarks Synthetic data can still leak information about the real records it was generated from; assess it before treating it as anonymous.
- Synthetic media
-
Content wholly or partly generated or manipulated by AI.
- System prompt
-
Instructions set by a developer that frame how a model behaves in an application. Users usually cannot see them.
Remarks Never rely on a system prompt to keep secrets or enforce security; it can often be extracted or overridden.
- Systemic risk (GPAI)
-
Under the EU AI Act, the risk from general-purpose AI models with high-impact capabilities that could significantly affect the EU market or public health, safety, security or fundamental rights.
Remarks Presumed when training compute exceeds 10^25 floating-point operations. Such models need evaluations, adversarial testing, incident reporting and cybersecurity protection.
T
- Tabletop exercise TTX
-
A discussion-based exercise in which a team walks through a realistic incident scenario to test plans, roles and decisions without touching live systems.
Remarks Include executives, legal, communications and key suppliers, not only IT.
- Tactical threat intelligence
-
Detailed technical intelligence, such as TTPs and indicators, used directly by SOC, detection and incident response teams.
- Tactics, techniques and procedures TTPs
-
How an adversary operates. Tactics are its goals, such as initial access; techniques are how it achieves them, such as phishing; and procedures are its specific implementations.
Remarks TTPs change far less often than indicators, so detecting them is more durable. This is the top of the Pyramid of Pain.
- Tailgating
-
Following an authorised person through a secured door without using one's own credentials. When the authorised person knowingly lets them in, it is called piggybacking.
- TAXII Trusted Automated Exchange of Intelligence Information
-
An OASIS protocol for exchanging STIX threat intelligence over HTTPS.
- Teachable moment
-
The point right after a risky action, real or simulated, when a person is most receptive to learning why it was risky.
- Tech support scam
-
Fraud in which criminals pose as technical support, through pop-ups or calls, to gain remote access or payment.
- Technical and organisational measures TOMs
-
The security and governance safeguards an organisation applies to protect personal data, such as encryption, access control, training and policies.
Remarks Usually listed in an annex to a data processing agreement.
- Technical control
-
A control implemented in hardware or software, such as firewalls, encryption, authentication and logging. Also called logical control.
- Telemetry
-
Data automatically collected from systems, such as process events, network flows and authentication records, that is used for detection and analysis.
- Temperature
-
A setting that controls how random a generative model's output is. Low values give more predictable text; high values give more varied text.
- Test data
-
Data never used in training or tuning, used to give an independent estimate of how a model performs.
- Third-party assessment organization 3PAO
-
An accredited independent assessor that evaluates cloud services for FedRAMP.
- Third-party risk management TPRM
-
Identifying, assessing and controlling the risks that suppliers, service providers and partners bring to an organisation, before and throughout the relationship.
Remarks Regulations such as DORA and NIS2 make supply-chain risk management explicit. Tier suppliers by criticality so effort goes where the risk is.
- Threat
-
Anything with the potential to cause harm to an asset: a person, group, event or circumstance, deliberate or accidental.
Remarks A threat only becomes a risk when it can exploit a vulnerability to affect something of value.
- Threat actor
-
An individual or group that carries out or intends to carry out malicious cyber activity, such as a nation-state group, cybercriminal gang, hacktivist or insider.
- Threat feed
-
A stream of threat data, usually indicators, from a vendor, community or government source, for ingestion into security tools.
Remarks More feeds is not better. Judge feeds on relevance, accuracy, timeliness and false-positive rates.
- Threat hunting
-
Proactively searching for attackers who have evaded existing detections, guided by hypotheses, intelligence and anomalies.
Remarks Each successful hunt should become a new automated detection.
- Threat intelligence CTI (cyber threat intelligence)
-
Evidence-based knowledge about adversaries, their capabilities, intentions and methods, and the indicators of their activity. It is analysed so defenders can make better decisions.
Remarks Data is not intelligence until it is analysed and relevant to a decision. ISO/IEC 27001:2022 added threat intelligence as an Annex A control.
- Threat intelligence analyst
-
A professional who collects and analyses information on threats and turns it into intelligence for defenders and decision makers.
Remarks Certifications include EC-Council's CTIA and GIAC's GCTI.
- Threat intelligence platform TIP
-
Software that collects, deduplicates, enriches, scores and shares threat intelligence and pushes it to security tools.
- Threat landscape
-
The overall picture of threats relevant to a sector, region or organisation at a point in time.
Remarks ENISA publishes an annual Threat Landscape report for the EU.
- Threat modelling
-
A structured way to identify what could go wrong in a system, how attackers might attack it and which mitigations to apply, ideally during design.
Remarks Common methods include STRIDE, PASTA, attack trees and LINDDUN for privacy.
- Threat-led penetration testing TLPT
-
Intelligence-driven red teaming of live production systems at critical financial institutions, based on frameworks such as TIBER-EU. It is required for certain entities under DORA.
- Three lines model
-
A governance model from the Institute of Internal Auditors. The first line manages risk in operations; the second line provides expertise, oversight and challenge; and internal audit, the third line, gives independent assurance.
Remarks Updated in 2020 from the earlier "three lines of defence".
- TIBER-EU
-
The European framework for Threat Intelligence-Based Ethical Red Teaming, used by financial authorities to test the cyber resilience of critical entities.
- Tiered administration
-
Separating administrative accounts and workstations by the sensitivity of the systems they manage, so a compromised workstation cannot expose domain-level credentials.
- Time to report
-
How quickly the first users report a suspicious message after it arrives. It is a key measure of how fast an organisation can contain a phishing campaign.
- TLS Transport Layer Security
-
The standard protocol for encrypting and authenticating network connections, such as HTTPS. TLS 1.3 is current; TLS 1.0 and 1.1 are deprecated.
- TLS inspection
-
Decrypting, inspecting and re-encrypting TLS traffic at a security gateway to find threats hidden in encrypted traffic.
Remarks It raises privacy, legal and certificate-trust issues; exclude sensitive categories such as banking and health.
- TOGAF
-
The Open Group Architecture Framework, a widely used method for enterprise architecture, often paired with SABSA for security.
- Token
-
A unit of text, such as a word, part of a word or a character, that a language model reads and generates. Limits and pricing are usually counted in tokens.
- Tokenisation
-
Replacing sensitive data, such as card numbers, with non-sensitive surrogate values (tokens). The real data is mapped and kept in a secure vault.
Remarks Widely used to reduce PCI DSS scope.
- Tool use
-
A model's ability to call external functions or services, such as search, code execution or APIs, to complete a task.
- TOTP Time-based one-time password
-
A one-time password generated from a shared secret and the current time, usually changing every 30 seconds (RFC 6238).
- Traffic Light Protocol TLP
-
A labelling scheme (TLP:RED, AMBER, AMBER+STRICT, GREEN and CLEAR) that tells recipients how widely they may share information. Version 2.0 is maintained by FIRST.
- Training data
-
The data set used to fit a model's parameters.
Remarks Its quality, provenance, representativeness and lawful basis largely decide the model's behaviour and compliance risk.
- Transfer impact assessment TIA
-
An assessment of whether the laws and practices of a destination country undermine the protection given by transfer tools such as SCCs, and of any supplementary measures needed.
- Transformer
-
A neural network architecture built on attention mechanisms that weigh relationships between all parts of an input. It underpins most modern large language models.
- Transparency (AI)
-
Openness about when AI is used, how it works, its limitations and the data behind it, so that affected people and overseers can understand and challenge it.
Remarks The EU AI Act sets transparency duties for chatbots, emotion recognition, deepfakes and AI-generated text published on matters of public interest.
- Trojan
-
Malware disguised as legitimate software, which gives an attacker access or control once run.
- True positive
-
An alert that correctly identifies malicious or policy-violating activity.
- Trust Services Criteria TSC
-
The AICPA criteria used in SOC 2 and SOC 3 examinations, covering security, availability, processing integrity, confidentiality and privacy.
- Trusted computing base
-
All the hardware, firmware and software that must work correctly for a system's security policy to be enforced.
Remarks Abbreviated TCB. Keeping it small reduces what has to be trusted and verified.
- Trusted execution environment TEE
-
A secure, isolated area of a processor that runs code and handles data protected from the rest of the system.
- Trusted platform module
-
A dedicated chip that securely stores keys and measurements, supporting secure boot, disk encryption and device attestation.
Remarks Abbreviated TPM; specified by the Trusted Computing Group.
- Trustworthy AI
-
AI that is valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. These are the characteristics listed in the NIST AI RMF.
- Two-factor authentication 2FA
-
Multi-factor authentication that uses exactly two factors.
- Typosquatting
-
Registering misspelled versions of popular domains or package names to catch users who mistype them.
U
- UAE PDPL
-
The UAE's federal personal data protection law (Federal Decree-Law No. 45 of 2021). Free zones such as DIFC and ADGM have their own data protection laws.
- UK GDPR
-
The UK's version of the GDPR retained after Brexit, read with the Data Protection Act 2018 and amended by later legislation such as the Data (Use and Access) Act 2025. It is enforced by the ICO.
- Unified compliance
-
Running one integrated control set and evidence process that satisfies several standards and laws at once, instead of a separate programme for each.
- Unsupervised learning
-
Machine learning that finds structure, such as clusters or anomalies, in data without labels.
- URL rewriting
-
Replacing links in emails with links through a security service, so each click is checked at the time it happens.
- US state privacy laws
-
The growing set of comprehensive consumer privacy laws passed by individual US states, such as Virginia, Colorado, Connecticut, Texas and others, in the absence of a federal privacy law.
- User and entity behaviour analytics UEBA
-
Analytics that build baselines of normal behaviour for users and systems and flag significant deviations, such as unusual logins or data access.
V
- Validation data
-
Data held back from training and used to tune a model and choose between versions.
- Vector database
-
A database optimised to store embeddings and find the most similar ones quickly. It is often used to supply context to language models.
Remarks Apply access control at retrieval time; otherwise users may retrieve documents they are not allowed to see.
- Vendor risk assessment
-
Evaluating a supplier's security, privacy and resilience, for example with questionnaires, reports such as SOC 2 or ISO certificates, and contract review.
- Verifiable parental consent
-
Consent from a parent or lawful guardian obtained in a way that reasonably confirms who they are, before a child's personal data is processed.
- VEX Vulnerability Exploitability eXchange
-
A machine-readable statement of whether a product is actually affected by a known vulnerability in one of its components.
- Virtual machine VM
-
Software emulation of a computer that runs its own operating system on shared physical hardware managed by a hypervisor.
- Vishing Voice phishing
-
Phishing by phone call or voicemail, such as fake IT support or bank fraud teams. It is increasingly combined with AI voice cloning.
- VLAN Virtual local area network
-
A logical network partition on shared switches, used to separate traffic. It is not a security boundary by itself without filtering between VLANs.
- Voice phishing
-
Another name for vishing: social engineering carried out over voice calls.
- VPN Virtual private network
-
An encrypted tunnel over an untrusted network that gives remote users or sites secure access, such as IPsec or SSL/TLS VPNs.
Remarks VPN appliances are frequent targets of mass exploitation; patch quickly and require MFA.
- Vulnerability
-
A weakness in a system, process, control or person that a threat could exploit.
Remarks Includes software flaws, misconfigurations, missing controls and gaps in training. Not every vulnerability is exploitable in a given environment.
- Vulnerability assessment
-
Identifying, quantifying and prioritising vulnerabilities, usually with automated scanning plus validation, but without exploiting them to see how far an attacker could get.
- Vulnerability disclosure policy VDP
-
A public policy explaining how researchers can report vulnerabilities, what is in scope, and the safe harbour the organisation offers.
Remarks A security.txt file (RFC 9116) on the website tells researchers where to report.
- Vulnerability management
-
The continuous process of discovering, prioritising, remediating, and verifying vulnerabilities across the environment, and reporting on them.
Remarks Prioritise by exploitability and business impact (KEV, EPSS, asset criticality), not only CVSS score. Measure time to remediate against agreed SLAs.
- Vulnerability scanning
-
Automated checking of systems or applications against databases of known vulnerabilities and misconfigurations.
Remarks Authenticated (credentialed) scans find far more than unauthenticated ones. PCI DSS requires quarterly external scans by an Approved Scanning Vendor.
W
- Watering hole attack
-
Compromising a website that a target group often visits, so that visitors are infected or redirected.
- Watermarking (AI)
-
Embedding a detectable signal in AI-generated content so it can later be identified as machine-made.
- Web application firewall WAF
-
A filter in front of web applications that blocks common attacks such as SQL injection and cross-site scripting, using rules and behaviour analysis.
Remarks Buys time but does not replace fixing vulnerable code. PCI DSS accepts an automated technical solution for public-facing web applications.
- Web application penetration test
-
Testing a web application for flaws such as injection, broken access control, authentication weaknesses and business logic errors.
Remarks The OWASP Web Security Testing Guide (WSTG) and the Application Security Verification Standard (ASVS) are common references.
- WebAuthn
-
The W3C web standard that lets websites register and authenticate users with public-key credentials, such as security keys and passkeys.
- Whaling
-
Spear phishing aimed at senior executives or other high-value individuals.
- White team
-
The people who plan, referee and oversee a red team or exercise, set rules and judge outcomes.
- White-box testing
-
Testing with full knowledge, such as source code, architecture and credentials, to cover the target thoroughly. Also called clear-box testing.
- Wiper
-
Destructive malware that irreversibly erases data or disks, often disguised as ransomware.
- Wireless penetration test
-
Testing Wi-Fi and other wireless networks for weak encryption, rogue access points, poor segmentation and client attacks.
- Withdrawal of consent
-
A person's right to withdraw consent at any time, after which processing based on that consent must stop.
Remarks Withdrawal does not make earlier processing unlawful.
- Workload identity
-
An identity assigned to software, such as a container, function or VM, so it can authenticate to other services without hard-coded secrets.
- Worm
-
Malware that spreads by itself across networks by exploiting vulnerabilities, without user action.
- WPA3 Wi-Fi Protected Access 3
-
The current Wi-Fi security standard, with stronger password-based authentication (SAE) and individual encryption on open networks.
- Write blocker
-
A hardware or software tool that allows reading from storage media while preventing any writes, so evidence is preserved.
X
- XDR Extended detection and response
-
Detection and response that correlates telemetry across endpoints, identity, email, network and cloud, usually from one vendor's integrated platform.
Y
- YARA rule
-
A pattern-matching rule used to identify and classify malware samples by text or binary patterns.
Z
- Zero standing privileges
-
An approach in which no account holds permanent privileged access; all elevation is just-in-time.
- Zero trust
-
A security model that grants no implicit trust based on network location. Every request is authenticated, authorised and checked against policy and device health, continuously.
Remarks Described in NIST SP 800-207. It is an architecture and a journey, not a single product; identity, device posture and segmentation are its building blocks.
- Zero trust architecture
-
An enterprise design that applies zero trust principles through policy decision and enforcement points placed in front of every resource.
Remarks Often abbreviated ZTA. Policy engines weigh identity, device, location and behaviour signals for each access request.
- Zero trust network access ZTNA
-
Access to specific applications granted per session after verifying identity and device, instead of placing users on the network as a traditional VPN does.
- Zero-day
-
A vulnerability that is unknown to the vendor, or for which no fix is yet available, so defenders have had "zero days" to patch it.
Remarks Zero-days are valuable to attackers and are often used in targeted operations. Defence relies on layered controls and detection rather than patching alone.
- Zero-knowledge proof
-
A method by which one party proves a statement is true, such as being over 18, without revealing any other information.
Manipulating people into revealing information, granting access or taking harmful actions by exploiting trust, fear, urgency, curiosity or helpfulness.
Remarks Involved in a large share of breaches. Technical controls help, but verification habits and a reporting culture are essential.
See also Phishing, Pretexting, Vishing, Business email compromise
Search Google for “Social engineering” ↗