Cybersecurity glossary

80 terms from SOC operations, Security+ domains, and AI security — each written for someone who has to make a decision, not pass a quiz.

• Agentic tool abuse

  An AI agent misusing its own permissions.

  AI security
• AI hallucination

  Model invents confident-sounding info.

  AI security
• Alert

  A signal that something might be wrong.

  SOC fundamentals
• Alert fatigue

  Too many alerts, so real ones get missed.

  Triage
• Attack surface

  Everything an attacker could reach.

  Architecture
• Blue Team

  Defenders.

  SOC fundamentals
• Botnet

  Network of compromised machines.

  Threats & attacks
• Brute force

  Trying many passwords until one works.

  Threats & attacks
• Business Email Compromise (BEC)

  Fraud through a trusted mailbox.

  Threats & attacks
• Chain of custody

  Documented handling of evidence.

  SOC fundamentals
• CIA Triad

  Confidentiality, Integrity, Availability.

  General security concepts
• Command and Control (C2)

  Attacker's remote handler.

  Threats & attacks
• Compensating control

  A stopgap when you can't patch.

  Vulnerability management
• Containment

  Stop the spread before cleanup.

  SOC fundamentals
• Credential stuffing

  Replaying leaked passwords elsewhere.

  Threats & attacks
• CVE

  Common Vulnerabilities and Exposures ID.

  Vulnerability management
• CVSS

  Standard vulnerability severity score.

  Vulnerability management
• Cyber Kill Chain

  Stages of a typical intrusion.

  Frameworks
• Data poisoning

  Corrupting an AI's training data.

  AI security
• Defense in Depth

  Layer your protections.

  Architecture
• Detection engineering

  Building and maintaining detections as code.

  Detection engineering
• Digital Forensics

  Investigating what happened, with evidence.

  SOC fundamentals
• DKIM

  Cryptographic signature on email.

  Email security
• DLP

  Data Loss Prevention.

  Data security
• DMARC

  Policy that ties SPF and DKIM together.

  Email security
• EDR

  Endpoint detection & response agent.

  SOC tooling
• EPSS

  Probability a flaw gets exploited soon.

  Vulnerability management
• False positive

  Alert that looked bad but wasn't.

  Triage
• Firewall

  Network traffic filter.

  Network security
• Guardrails

  Safety controls around an AI system.

  AI security
• Honeypot

  Decoy system to lure attackers.

  Detection engineering
• Human in the loop

  A person approves consequential actions.

  AI governance
• IDS

  Intrusion Detection System.

  Network security
• Impossible travel

  Two logins too far apart to be real.

  Identity & access
• Incident Response (IR)

  Coordinated reaction to a breach.

  SOC fundamentals
• Indicator of Compromise (IOC)

  Forensic clue that an attack may have happened.

  Threat intel
• IPS

  Intrusion Prevention System.

  Network security
• Known Exploited Vulnerability (KEV)

  A flaw CISA confirms is being exploited now.

  Vulnerability management
• Lateral movement

  Attacker hops to other systems.

  Threats & attacks
• Living off the land (LOTL)

  Abusing built-in tools instead of malware.

  Threats & attacks
• Malware

  Any malicious software.

  Threats & attacks
• Mean time to detect (MTTD)

  How long until you notice.

  SOC fundamentals
• Mean time to respond (MTTR)

  How long until it's contained.

  SOC fundamentals
• MFA

  Multi-factor authentication.

  Identity & access
• MITRE ATT&CK

  Map of attacker techniques.

  Frameworks
• Model context poisoning

  Untrusted content steering an AI's context.

  AI security
• Model inversion

  Reconstructing training data from a model.

  AI security
• MSSP

  Managed Security Service Provider.

  SOC fundamentals
• Patch window

  Agreed time to deploy a fix.

  Vulnerability management
• Persistence

  Surviving reboots and logoffs.

  Threats & attacks
• Phishing

  Tricking a user via email or messaging.

  Threats & attacks
• Playbook

  Agreed steps for a specific alert type.

  SOC fundamentals
• Principle of Least Privilege

  Give only the access needed.

  Identity & access
• Privilege escalation

  Going from low to high access.

  Threats & attacks
• Prompt injection

  Hidden instructions hijack an AI.

  AI security
• Purple Team

  Red + Blue working together.

  Offensive security
• Purple-book triage

  Recognise the technique, then detect it.

  Triage
• RAG (Retrieval Augmented Generation)

  AI grounded in your own data.

  AI architecture
• Ransomware

  Malware that encrypts files for ransom.

  Threats & attacks
• RBAC

  Role-Based Access Control.

  Identity & access
• Red Team

  Offensive simulators.

  Offensive security
• RLS

  Row-Level Security.

  Application security
• SBOM

  Ingredient list for software.

  Application security
• Secrets management

  Storing keys outside code.

  Application security
• Shadow AI

  Unsanctioned AI use inside the org.

  AI governance
• SIEM

  Central log + alerting platform.

  SOC tooling
• Sigma rule

  Vendor-neutral detection rule format.

  Detection engineering
• SOC

  Security Operations Center.

  SOC fundamentals
• Spear phishing

  Phishing aimed at a specific person.

  Threats & attacks
• SPF

  Which servers may send your mail.

  Email security
• SQL Injection

  Injecting SQL into app inputs.

  Application security
• Supply chain attack

  Compromise through a trusted supplier.

  Threats & attacks
• Threat Hunting

  Proactively searching for hidden attackers.

  SOC fundamentals
• True positive

  Alert that was real malicious activity.

  Triage
• TTP

  Tactics, Techniques, and Procedures.

  Threat intel
• UEBA

  User & Entity Behavior Analytics.

  Detection engineering
• XSS

  Cross-site scripting.

  Application security
• YARA

  Pattern rules for files and memory.

  Detection engineering
• Zero Trust

  Never trust, always verify.

  Architecture
• Zero-day

  Vulnerability with no patch yet.

  Vulnerability management