Glossary · SecAIQ

A

Access Control: The set of policies and technical mechanisms that decide who or what may view or use a resource, such as a file, system, or network.
Access Control List (ACL): A list of rules that specifies which users or systems are permitted or denied access to a particular resource.
Account Takeover: When an attacker gains unauthorized control of a legitimate user's online account, usually to steal money, data, or identity.
Advanced Persistent Threat (APT): A sophisticated, well-resourced attacker, often state-sponsored, that maintains long-term stealthy access to a target network.
Adware: Software that automatically displays or downloads unwanted advertisements, often bundled with free software or built into a browser.
AI Alignment: The field of ensuring that an AI system's goals and behavior stay consistent with human values and intentions.
AI Governance: The policies, rules, and oversight structures that guide the responsible development and deployment of AI systems.
Air Gap: A security measure that physically isolates a computer or network from the internet and other unsecured networks.
Antivirus: Software that detects, blocks, quarantines, or removes known malicious programs on a device.
Application Allowlisting: A security approach that only permits pre-approved software to run, blocking everything else by default.
Attack Surface: The complete set of points where an unauthorized user could try to enter or extract data from a system.
Attack Vector: The specific path or method an attacker uses to gain unauthorized access to a system or network, such as a phishing email or exploit.
Audit Log: A chronological record of events and actions taken on a system, used to track activity and investigate incidents.
Authentication: The process of proving that a user, device, or system really is who or what it claims to be.
Authorization: The process of deciding what resources and actions an already-authenticated user is allowed to access.

B

Backdoor: A hidden way into a system that bypasses normal authentication and security checks.
Backup: A copy of data stored separately from the original, used to restore information after loss, corruption, or a ransomware attack.
Baiting: A social engineering tactic that lures victims with a tempting offer to trick them into compromising their security.
Biometrics: Authentication using unique physical or behavioral traits such as a fingerprint, face, or voice.
Black Hat: A hacker who breaks into systems with malicious intent, typically for personal or financial gain.
Blue Team: The defensive security team responsible for protecting an organization's systems, detecting attacks, and responding to incidents.
Botnet: A network of infected computers controlled remotely by an attacker, often used to send spam or launch large-scale attacks.
Brute Force: An attack method that tries every possible password or key combination until the correct one is found.
Buffer Overflow: A software bug where a program writes more data to a memory buffer than it can hold, potentially letting an attacker run code.
Bug Bounty: A program that rewards independent security researchers for finding and responsibly reporting vulnerabilities.
Business Continuity: An organization's planning and processes for keeping essential operations running during and after a disruptive event.
Business Email Compromise (BEC): A scam where an attacker impersonates a company executive or partner by email to trick an employee into transferring money or data.

C

CAPTCHA: A challenge-response test used on websites to distinguish human users from automated bots.
CEO Fraud: A scam where an attacker impersonates a company executive to trick an employee into making a fraudulent payment or disclosure.
Certificate Authority: A trusted organization that issues digital certificates verifying the identity of websites and services.
CIA Triad: The three core principles of information security: confidentiality, integrity, and availability.
Clickjacking: A technique that tricks users into clicking something different from what they perceive, hijacking their click.
Clone Phishing: A phishing technique that copies a legitimate email a victim already received and replaces its links or attachments with malicious ones.
Cloud Security: The practices, policies, and technologies used to protect data and systems hosted in cloud services.
Command and Control (C2): The infrastructure attackers use to remotely send instructions to and receive data from malware installed on compromised devices.
Common Vulnerabilities and Exposures (CVE): A public catalog assigning a unique reference number to each publicly disclosed cybersecurity vulnerability.
Common Vulnerability Scoring System (CVSS): A standardized scale from 0 to 10 used to rate how severe a software security vulnerability is.
Computer Virus: A type of malicious software that attaches itself to a legitimate program and spreads by infecting other files when run.
Conditional Access: A security policy model that grants or blocks access to resources based on real-time signals like device, location, and risk level.
Container Security: The practices and tools used to protect containerized applications and their underlying infrastructure throughout their lifecycle.
Cookie: A small piece of data a website stores in your browser to remember information about you between visits.
Credential Stuffing: An attack that automatically tries stolen username-password pairs from one breach across many other websites to find reused logins.
Credential Theft: The act of stealing login information, such as usernames and passwords, through phishing, malware, or data breaches.
Cross-Site Request Forgery (CSRF): An attack that tricks a logged-in user's browser into performing unwanted actions on a site without their consent.
Cross-Site Scripting (XSS): A web vulnerability that lets attackers inject malicious scripts into pages viewed by other users.
Cryptojacking: The unauthorized use of someone's computer, phone, or server to mine cryptocurrency, usually without the owner's knowledge or consent.
Cyber Espionage: State-sponsored or organized hacking aimed at secretly stealing sensitive government, military, or corporate information.
Cyber Hygiene: The set of basic good habits, practiced regularly, that keep you reasonably safe online.
Cyber Insurance: A policy that helps cover the financial costs of a cyberattack, such as data breach response and recovery expenses.
Cyber Resilience: An organization's ability to keep operating and recover quickly during and after a cyberattack.
Cyberattack: A deliberate attempt to damage, disrupt, or gain unauthorized access to a computer system or network.
Cybersecurity: The practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage.

D

Dark Web: A hidden part of the internet, accessible only with special software, often used for anonymous and sometimes illegal activity.
Data Breach: An incident in which sensitive, protected, or confidential data is accessed, copied, or disclosed without authorization.
Data Encryption: The process of converting information into a coded form so that only someone with the correct key can read it.
Data Exfiltration: The unauthorized transfer of data out of a system, typically by an attacker after gaining access.
Data Loss Prevention (DLP): Tools and policies that detect and block sensitive data from leaving an organization's control.
Data Masking: Replacing sensitive data with realistic but fake values so it can be used safely in non-production settings.
Deepfake: Synthetic audio, video, or images generated by AI to convincingly depict a real person saying or doing something they never did.
Defense in Depth: A security strategy that layers multiple independent defenses so that no single failure leaves a system fully exposed.
Denial-of-Service (DoS) Attack: An attack that overwhelms a system, server, or network with traffic so legitimate users cannot access it.
Dictionary Attack: A password-cracking method that tries every word in a precompiled list of common words and passwords.
Digital Footprint: The trail of data a person leaves behind from their online activity, including posts, purchases, and browsing history.
Digital Forensics: The practice of collecting, preserving, and analyzing digital evidence to investigate a security incident or crime.
Digital Signature: A cryptographic technique that verifies the authenticity and integrity of a digital message, document, or software file.
Disaster Recovery: The plans and processes for restoring systems and data from backups after a major outage.
Distributed Denial-of-Service (DDoS): A cyberattack that floods a target with traffic from many compromised devices at once to knock it offline.
DMZ (Demilitarized Zone): A separate network segment that isolates public-facing servers from an organization's internal network.
DNS Poisoning: The technique of injecting false records into a DNS resolver's cache so future lookups return a malicious address.
DNS Spoofing: An attack that corrupts DNS records so a domain name resolves to a fraudulent IP address instead of the real one.
Downgrade Attack: An attack that forces a system to use an older, weaker, and more vulnerable version of a protocol or encryption.
Doxxing: Publicly revealing someone's private personal information online, such as their home address or phone number, usually without consent.
Drive-by Download: Malware that installs on a device automatically just from visiting a compromised website, with no user action required.
Dumpster Diving: Searching through an organization's or individual's discarded trash to find sensitive documents or information.

E

Eavesdropping: Secretly intercepting communications, such as network traffic or conversations, without the parties' knowledge or consent.
Encryption: The process of converting information into a coded form that only authorized parties can read.
Encryption Key: A piece of information used by an encryption algorithm to scramble or unscramble data.
End-to-End Encryption: Encryption where only the sender and intended recipient can read a message, not even the service provider.
Endpoint: Any device, laptop, phone, server, that connects to a network and can be a target for attackers.
Endpoint Detection and Response (EDR): Security software that continuously monitors devices for threats and enables rapid investigation and response.
Evil Twin: A fraudulent Wi-Fi access point set up to mimic a legitimate one, tricking users into connecting so their traffic can be intercepted.
Exploit: A piece of code, technique, or sequence of commands that takes advantage of a software vulnerability to cause unintended behavior.
Extended Detection and Response (XDR): A security platform that unifies threat detection and response data across endpoints, networks, and cloud environments.

F

Fileless Malware: Malicious software that runs directly in a computer's memory instead of installing files on the hard drive.
Firewall: A security system that monitors and filters incoming and outgoing network traffic based on defined rules.
Frontier AI: Highly capable, general-purpose AI models at the leading edge of development, whose risks and capabilities are not yet fully understood.

G

Governance, Risk, and Compliance (GRC): A framework aligning an organization's security practices with its policies, risk tolerance, and regulatory obligations.

H

Hacktivism: The use of hacking techniques to promote a political or social cause rather than for financial gain.
Hallucination (AI): When an AI model generates confident but factually incorrect or fabricated information.
Hardening: The process of reducing a system's vulnerabilities by removing unnecessary features and tightening configurations.
Hashing: A process that converts data into a fixed-length string of characters, used to verify data integrity and securely store passwords.
Honeypot: A decoy system deliberately set up to look vulnerable in order to attract, detect, and study attackers.

I

Identity and Access Management (IAM): The framework of policies and technologies used to ensure the right individuals have the right access to the right resources.
Identity Theft: When someone's personal identity information is stolen and used to commit fraud in their name.
Incident Response: The organized process an organization follows to detect, contain, and recover from a cybersecurity incident.
Indicator of Compromise (IOC): A piece of forensic evidence, such as a file hash or IP address, that suggests a system may have been breached or infected.
Industrial Control Systems (ICS/SCADA): Computer systems that monitor and control physical industrial processes like power grids, water treatment, and factories.
Information Security: The broader practice of protecting information and information systems from unauthorized access, use, or disclosure.
Insider Threat: A security risk that comes from someone within an organization, such as an employee or contractor, rather than an outside attacker.
Internet of Things (IoT): The network of everyday physical devices, from thermostats to cameras, that connect to the internet and exchange data.
Intrusion Detection System (IDS): A network security tool that monitors traffic for signs of malicious activity and alerts administrators without blocking it directly.
Intrusion Prevention System (IPS): A network security tool that monitors traffic for malicious activity and automatically takes action to block it in real time.
IP Address: A unique numerical label assigned to every device connected to a network, used to identify and locate it for communication.

K

Keylogger: Malicious software or hardware that secretly records every keystroke a user types, often to steal passwords.

L

Large Language Model (LLM): An AI model trained on vast amounts of text that can generate and understand human language, such as GPT-style models.
Lateral Movement: Techniques an attacker uses to move through a network after gaining an initial foothold to reach valuable targets.
Logic Bomb: Malicious code secretly planted in a system that stays dormant until a specific condition or date triggers it to activate.

M

Macro Virus: A type of malware written in the macro language of an application like Microsoft Word or Excel, spreading through infected documents.
Malvertising: The use of online advertising to distribute malware, often through legitimate ad networks on otherwise trustworthy websites.
Malware: Any software intentionally designed to cause harm to a computer, server, or network, including viruses, ransomware, and spyware.
Man-in-the-Middle Attack: An attack where a third party secretly intercepts and possibly alters communication between two parties who believe they're talking directly.
Managed Detection and Response (MDR): An outsourced service where a third-party team monitors, detects, and responds to threats on a client's behalf.
Multi-Factor Authentication (MFA): A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.

N

Network Segmentation: Dividing a computer network into smaller isolated sections to limit how far an attacker can move if one part is compromised.

O

One-Time Password (OTP): A password valid for only a single login session or transaction, commonly used as a second authentication factor.
Operational Security (OPSEC): A risk management process that identifies critical information and the steps needed to prevent it from falling into the wrong hands.
Operational Technology (OT): The hardware and software used to monitor and control physical industrial equipment and processes, such as factory machinery.

P

Packet Sniffing: The practice of intercepting and analyzing data packets as they travel across a network, which can reveal unencrypted information.
Passkey: A modern, phishing-resistant sign-in credential based on public-key cryptography that replaces traditional passwords.
Passphrase: A longer sequence of words or a sentence used in place of a traditional password, offering greater security while staying memorable.
Password Manager: An application that securely stores and generates strong, unique passwords for each of a user's accounts.
Password Spraying: An attack that tries one common password against many different accounts before moving to the next, to avoid triggering lockouts.
Patch: A software update released by a vendor to fix a security vulnerability or bug.
Patch Management: The process of systematically identifying, testing, and installing software updates that fix vulnerabilities.
Payload: The part of malware that carries out its actual harmful action, such as encrypting files, stealing data, or opening a backdoor.
Penetration Testing: An authorized simulated attack on a system to find exploitable security weaknesses before real attackers do.
Personally Identifiable Information (PII): Any data that could be used to identify a specific individual, such as a name, ID number, address, or biometric record.
Pharming: An attack that redirects website traffic to a fraudulent site without the user's knowledge, often by manipulating DNS settings.
Phishing: A deceptive attempt, usually by email or message, to trick someone into revealing sensitive information or installing malware.
Principle of Least Privilege: The security concept of giving users and systems only the minimum access needed to perform their job, and nothing more.
Privilege Escalation: A technique attackers use to gain higher-level access or permissions than they were originally granted on a system.
Privileged Access Management (PAM): A set of tools and policies for controlling, monitoring, and securing accounts with elevated system access.
Prompt Injection: An attack technique where malicious instructions are hidden in input given to an AI system to make it behave against its intended purpose.
Public-Key Cryptography: An encryption system using a mathematically linked public key to encrypt data and a private key to decrypt it.

R

Rainbow Table: A precomputed table of password hashes used to quickly reverse-engineer a stolen hash back into its original password.
Ransomware: Malware that encrypts a victim's files and demands payment, usually in cryptocurrency, in exchange for the decryption key.
Ransomware-as-a-Service (RaaS): A criminal business model where ransomware developers rent or sell their malware to other attackers in exchange for a cut of the profits.
Red Team: A group that simulates real-world attacks against an organization or AI system to test and improve its defenses.
Responsible Disclosure: The practice of privately reporting a security vulnerability to the affected organization before it's made public.
Risk Assessment: The process of identifying, analyzing, and prioritizing potential security threats and their likely impact.
Risk Management: The ongoing process of identifying, assessing, and prioritizing risks, then applying resources to minimize their potential impact.
Rootkit: A type of malware designed to gain and hide privileged, administrator-level access to a system while evading detection.

S

Salting: Adding random data to a password before hashing it, making stolen password hashes far harder to crack.
Sandbox: An isolated environment where untested or suspicious code can run safely without affecting the real system.
Scareware: Malicious software or fake alerts that trick users into believing their device is infected, pressuring them into a payment or download.
Script Kiddie: An unskilled attacker who uses pre-built hacking tools and scripts written by others rather than developing their own techniques.
Security Information and Event Management (SIEM): A platform that aggregates and analyzes security log data from across an organization to detect and alert on threats.
Security Key: A small physical hardware device used as a strong second factor to verify your identity when logging in.
Security Operations Center (SOC): A dedicated team and facility responsible for continuously monitoring, detecting, and responding to security threats.
Security Orchestration, Automation and Response (SOAR): Technology that automates and coordinates security tasks and incident response workflows to speed up threat handling.
Shadow IT: Software, devices, or cloud services used by employees without the knowledge or approval of the IT department.
Shoulder Surfing: The act of secretly watching someone enter a password, PIN, or other sensitive information by looking over their shoulder.
Single Sign-On (SSO): A system that lets users log in once to access multiple connected applications without re-entering credentials.
Smishing: A phishing attack delivered through SMS text messages rather than email.
Social Engineering: Manipulating people, rather than technical systems, into divulging confidential information or taking harmful actions.
Software Bill of Materials (SBOM): A detailed inventory listing every component and library used to build a piece of software.
Spam: Unsolicited, often bulk-sent messages, typically advertising, scams, or malware, sent through email or other communication channels.
Spear Phishing: A targeted phishing attack customized for a specific individual or organization using researched personal details.
Spoofing: Disguising communication from an unknown source as coming from a known, trusted one, such as faking an email address or caller ID.
Spyware: Malicious software that secretly monitors a user's activity and sends the collected information to a third party.
SQL Injection: An attack that inserts malicious database commands through vulnerable input fields to access or manipulate data.
SSL/TLS: The cryptographic protocols that encrypt data traveling between a web browser and a website, shown by the padlock icon.
Steganography: The practice of hiding secret data within an ordinary file, such as an image, so its presence isn't obvious.
Symmetric Encryption: An encryption method that uses the same secret key to both encrypt and decrypt data.

T

Tailgating: A physical security breach where an unauthorized person follows an authorized person through a secured door or checkpoint.
Threat Actor: An individual or group responsible for carrying out malicious activity against systems or networks.
Threat Hunting: The proactive search for hidden threats already present in a network before they trigger an alert.
Threat Intelligence: Gathered and analyzed information about current attackers, their methods, and attack indicators.
Threat Modeling: A structured process for identifying and prioritizing potential security threats to a system before it's built.
Tokenization: The process of replacing sensitive data with a non-sensitive placeholder that has no exploitable value if stolen.
Trojan: Malware disguised as legitimate software that tricks users into installing it themselves.
Two-Factor Authentication (2FA): A specific form of multi-factor authentication that combines exactly two verification methods to confirm identity.
Typosquatting: Registering domain names that closely resemble a legitimate website, relying on users mistyping the real address.

U

User and Entity Behavior Analytics (UEBA): A security approach that uses analytics to detect abnormal behavior by users or devices that could indicate a compromise or insider threat.

V

Virtual Private Network (VPN): A service that encrypts internet traffic and routes it through a remote server, hiding a user's location and activity.
Vishing: A phone-based phishing scam where an attacker impersonates a trusted party to trick someone into revealing information.
Vulnerability: A weakness in software, hardware, or a process that could be exploited by an attacker to cause harm.
Vulnerability Scanning: The process of automatically scanning systems for known security weaknesses on a regular basis.

W

Watering Hole Attack: An attack that compromises a website its intended victims are known to frequently visit.
Whaling: A highly targeted phishing attack aimed at senior executives or other high-profile individuals within an organization.
White Hat: A security researcher or hacker who uses their skills legally and ethically to find and fix vulnerabilities.
Worm: A type of self-replicating malware that spreads across networks without needing a host file or human action.

Z

Zero Trust: A security model that assumes no user or device should be trusted by default, even inside the network perimeter, and verifies every request.
Zero-Day: A previously unknown software vulnerability that is exploited by attackers before the vendor has released a fix.
Zombie: A computer infected with malware that lets an attacker control it remotely, usually as part of a botnet.