2663 terms covering AIOps, DevOps, MLOps, FinOps, observability and cloud-native operations.
Written by AI. Published under human oversight.
Advanced Persistent Threat (APT)
A prolonged and targeted cyberattack where an intruder gains access to a network and remains undetected for an extended period. APTs are often state-sponsored and aim for espionage or data theft.
Adversary Emulation
A testing methodology that simulates real-world attacker behaviors based on known threat actor techniques. It helps validate detection and response capabilities against realistic attack scenarios.
API Security Monitoring
A security practice that monitors API traffic, detects abnormal API usage patterns, and protects against API-based attacks and data exposure. API security monitoring ensures that application programming interfaces are used securely and comply with authentication policies.
Application Security Testing (AST)
The examination of application code for vulnerabilities and security flaws, performed through various methods such as static and dynamic analysis to strengthen software security.
Attack Path Analysis
Attack path analysis identifies potential routes an attacker could use to move through systems and escalate privileges. It helps security teams prioritize remediation efforts based on exploitable relationships and exposures.
Attack Surface Management (ASM)
The continuous discovery, monitoring, and assessment of an organization’s exposed digital assets. ASM helps SecOps teams identify vulnerabilities and reduce external risk exposure.
Behavioral Analysis
The process of examining user actions and patterns to identify anomalies that could indicate a security threat, enhancing the detection of insider threats and compromised accounts.
Blue Team Operations
Defensive security activities focused on monitoring, detecting, and responding to threats. Blue teams work to strengthen controls and improve resilience against attacks.
Breach and Attack Simulation (BAS)
An automated technique that simulates cyberattacks to evaluate detection and response effectiveness. BAS tools continuously test security defenses against known tactics and techniques.
Bypassing Security Controls
The act of evading or overcoming security measures designed to protect systems and data. Understanding how such actions occur is vital for strengthening defenses and developing countermeasures.
Cloud Access Security Broker (CASB)
A security policy enforcement point that acts as an intermediary between an organization's on-premises infrastructure and cloud services. CASBs help protect data in the cloud and enforce security policies.
Cloud Security Posture Management (CSPM)
A security approach aimed at improving an organization’s security configuration and compliance in cloud environments. CSPM tools continuously monitor cloud configurations to prevent misconfigurations and security breaches.
Compliance Monitoring
The continuous tracking of systems and processes to ensure adherence to regulatory and security standards. It provides audit trails and alerts for non-compliant activities.
Compliance Monitoring and Automation
A continuous process that monitors adherence to regulatory requirements, security standards, and internal policies using automated assessment tools. Compliance automation reduces manual audit work and provides real-time compliance dashboards.
Container and Kubernetes Security
Specialized security practices and tools designed to protect containerized applications and orchestration platforms from vulnerabilities and misconfigurations. This includes image scanning, runtime protection, and policy enforcement for container environments.
Container Security
A practice aimed at securing container-based applications and environments throughout the lifecycle. This includes securing images, runtime environments, and orchestration tools to protect against vulnerabilities.
Continuous Security Validation
Continuous security validation uses automated testing to verify that security controls are functioning effectively over time. It provides ongoing assurance against evolving threats and infrastructure changes.
Continuous Threat Exposure Management (CTEM)
A strategic approach that continuously identifies, validates, and mitigates exploitable risks across the attack surface. CTEM aligns security efforts with real-world threat likelihood and business impact.
Cyber Threat Intelligence (CTI)
CTI is the collection and analysis of information about current and emerging cyber threats. It enables organizations to anticipate attacker behavior and strengthen defensive strategies.
Data Loss Prevention (DLP)
A set of strategies and tools focused on preventing data breaches and unauthorized data exfiltration. DLP solutions monitor, detect and block the transfer of sensitive data outside of the organization.
Deception Technology
Security controls that deploy decoys, honeypots, or fake assets to lure attackers. These techniques provide early detection and high-fidelity alerts when adversaries interact with deceptive resources.
Deception Technology (Honeypots/Honeynets)
A defensive security technique that deploys fake assets, systems, or data to detect and analyze attacker behavior and lateral movement. Deception technologies provide early warning of compromises and valuable intelligence about attack methods.
Detection Engineering
The practice of designing, testing, and tuning detection rules to identify malicious behavior. Detection engineers continuously refine analytics to improve accuracy and reduce false positives.
Digital Forensics and Incident Response (DFIR)
A discipline combining forensic investigation techniques with incident response processes. DFIR enables detailed analysis of breaches to determine root cause, impact, and remediation steps.
Encrypting Data at Rest
The practice of encrypting data stored on disk storage to protect sensitive information from unauthorized access, especially in the event of data breaches.
Endpoint Detection and Response (EDR)
A security solution focused on monitoring and responding to threats on endpoint devices such as laptops and servers. EDR tools collect data from endpoints for detection of anomalous behaviors and automate threat responses.
Extended Detection and Response (XDR)
An integrated security solution that unifies detection and response across endpoints, networks, cloud workloads, and email systems. XDR enhances visibility and correlation across domains to improve threat detection accuracy and response speed.
Identity Threat Detection and Response (ITDR)
A security approach focused on detecting and responding to identity-based attacks. ITDR protects authentication systems, directory services, and privileged accounts from compromise.
Incident Analysis
The ongoing process of understanding the causes and impact of security incidents after they occur, used to inform improvements in policies and response strategies.
Incident Management System (IMS)
A systematic approach to managing security incidents from detection through resolution. An IMS establishes procedures to restore service operations while minimizing impact on the business.
Incident Response Plan (IRP)
A documented strategy outlining an organization's approach to responding to and managing cybersecurity incidents. An effective IRP helps organizations quickly contain and remediate security breaches.
Incident Response Playbook
A documented set of procedures outlining steps to detect, contain, eradicate, and recover from security incidents. Playbooks standardize response actions and improve coordination across teams.
Incident Timeline Reconstruction
A forensic analysis process that establishes the chronological sequence of events during a security incident to understand attack progression and impact. Timeline reconstruction uses logs, artifacts, and system data to identify the root cause and affected systems.
Incident Triage
The process of evaluating and prioritizing security incidents based on their severity and potential impact. Effective triage helps security teams allocate resources efficiently during incident response.
Indicators of Attack (IoAs)
IoAs focus on suspicious behaviors and attacker techniques rather than static signatures. They help detect active attacks earlier by identifying patterns associated with adversary actions.
Indicators of Compromise (IoC)
Observable artifacts such as IP addresses, file hashes, or domain names that indicate a potential security breach. SecOps teams use IoCs to detect and investigate malicious activity within their environments.
Indicators of Compromise (IoCs)
IoCs are forensic artifacts such as malicious IP addresses, file hashes, or domain names that indicate a system may have been breached. Security teams use them to detect and investigate attacks.
Insider Threat Management
A comprehensive program that detects and mitigates security risks from employees, contractors, or business partners with legitimate system access. Insider threat management monitors abnormal user behavior, data exfiltration attempts, and policy violations.
Integrated Risk Management (IRM)
The practice of aligning an organization’s risk management processes with its overall business strategy. IRM encompasses cybersecurity, operational, and compliance risks to provide a holistic view of risk.
Lateral Movement Detection
A security control that identifies when attackers move from one compromised system to another within a network to expand access and persistence. Detection methods include monitoring network traffic, privilege escalation attempts, and suspicious account activities.
Log Management
The process of collecting, storing, analyzing, and managing log data generated by various systems to track user activity, monitor system performance, and support incident response.
Malware Analysis
The process of dissecting and examining malware to understand its capabilities, functionalities, and potential impacts. This analysis helps in developing countermeasures to mitigate malware threats.
Managed Detection and Response (MDR)
An outsourced security service that provides continuous threat monitoring, detection, and response. MDR providers combine technology and human expertise to manage security operations on behalf of organizations.
MITRE ATT&CK Framework
A globally accessible knowledge base of adversary tactics and techniques based on real-world observations. SecOps teams use it to map detections, identify coverage gaps, and improve defensive strategies.
Multi-Factor Authentication (MFA)
A security process requiring more than one form of verification to gain access to a resource, significantly enhancing protection against unauthorized access.
Network Detection and Response (NDR)
A security capability focused on monitoring and analyzing network traffic to detect malicious activity. NDR tools use behavioral analytics and machine learning to identify anomalies and intrusions.
Network Intrusion Detection System (NIDS)
A security technology that monitors network traffic for suspicious activity and policy violations. NIDS tools analyze incoming and outgoing traffic to detect potential breaches in real-time.
Network Segmentation
The practice of splitting a computer network into multiple segments, or subnets, to improve performance and security. This limits the attack surface by restricting access between different network areas.
Passwordless Authentication
An authentication method that removes the need for passwords, using alternative means such as biometrics, hardware tokens, or one-time codes to enhance security and user experience.
Penetration Testing
A simulated cyber attack against your system to check for exploitable vulnerabilities, typically performed by ethical hackers to improve security posture.
Phishing Simulation
A security training technique where users are subjected to simulated phishing attacks to assess their response and preparedness against real phishing threats. This helps to raise awareness and improve organizational security posture.
Privilege Access Management (PAM)
A security strategy and toolset for controlling, monitoring, and auditing privileged accounts. PAM reduces the risk of misuse by enforcing least-privilege and session oversight.
Privileged Access Management (PAM)
A security framework that controls and monitors access to critical systems and sensitive accounts. PAM reduces the risk of misuse or compromise of high-privilege credentials.
Privilege Escalation
A type of security vulnerability where an attacker gains elevated access rights that exceed normal permissions, allowing unauthorized actions on system resources. Understanding and mitigating this risk is crucial for system security.
Purple Teaming
A collaborative approach where red and blue teams share insights to enhance detection and response effectiveness. Purple teaming accelerates security improvements through continuous feedback.
Ransomware
A type of malicious software that encrypts files on a victim's system, demanding payment for decryption. Ransomware attacks can cause significant financial and operational disruption to organizations.
Ransomware Defense and Recovery
A multi-layered security strategy combining detection, prevention, containment, and recovery measures against ransomware attacks. It includes backup strategies, network segmentation, and incident response procedures tailored for ransomware threats.
Ransomware Readiness Assessment
An evaluation process that measures an organization’s preparedness against ransomware attacks. It reviews backup strategies, detection capabilities, response plans, and recovery procedures.
Red Team/Blue Team Exercises
Simulated cyberattack exercises where a 'Red Team' emulates attackers and a 'Blue Team' defends against them. These exercises help organizations assess their security effectiveness and prepare for real-world attacks.
Red Team Operations
Simulated adversarial exercises designed to test an organization’s detection and response capabilities. Red teams emulate real-world attack techniques to identify security gaps.
Red Team vs. Blue Team
A security exercise involving two teams: Red Team (offensive) simulates attacks to identify vulnerabilities, while Blue Team (defensive) defends against these attacks. This methodology enhances an organization’s security readiness.
Risk Assessment
The process of identifying and analyzing potential events that may negatively impact individuals, assets, and operations, allowing organizations to prioritize security efforts.
Secure Access Service Edge (SASE)
A cloud-delivered architecture that converges networking and security services into a unified platform. SASE supports secure remote access, zero trust policies, and scalable protection.
Secure Software Development Lifecycle (SSDLC)
A process that integrates security at every phase of software development, ensuring that security considerations are included from design to deployment.
Security Analytics
The application of data analysis techniques to identify patterns and anomalies indicative of cyber threats. Security analytics enhances detection accuracy and supports informed decision-making in SecOps.
Security Assessment
An evaluation of an organization's information system security posture, identifying weaknesses and vulnerabilities through testing, audits, or reviews. The goal is to enhance security measures based on assessment findings.
Security Automation Framework
A structured approach to automating repetitive security tasks such as alert validation and containment actions. It integrates APIs, scripts, and workflows to enhance operational efficiency.
Security Automation Playbooks
Predefined, automated workflows that outline step-by-step actions for handling specific security incidents. These playbooks standardize response procedures and improve consistency across the SecOps team.
Security Automation Runbook
A documented, executable workflow that automates repetitive security operations tasks such as log collection, alert triage, and containment actions. Security runbooks improve response speed and consistency while reducing human error.
Security Awareness Training
A program designed to educate employees about security best practices, potential threats, and the role they play in protecting organizational assets. This training is crucial for building a security-conscious culture.
Security Baseline Configuration
A predefined set of security settings applied to systems and applications to minimize risk. Baselines ensure consistent hardening and compliance across infrastructure components.
Security Compliance
The act of adhering to regulations, laws, and internal policies that govern data protection and cybersecurity. Compliance helps ensure that an organization meets its legal and ethical obligations.
Security Configuration Management
The process of maintaining secure system configurations and preventing unauthorized changes. It ensures compliance with security baselines and reduces misconfiguration risks.
Security Configuration Management (SCM)
The process of maintaining secure configurations for systems throughout their lifecycle. SCM ensures that changes do not introduce vulnerabilities or drift from approved security baselines.
Security Control Validation
The process of testing and verifying that security controls function as intended. Validation may include automated testing, red teaming, or breach and attack simulation tools.
Security Data Lake
A centralized repository that stores large volumes of structured and unstructured security data. It enables advanced analytics, long-term retention, and cross-domain investigations.
Security Framework
A structured set of guidelines and best practices to help organizations manage and improve their cybersecurity posture. Frameworks like NIST or ISO 27001 provide a comprehensive approach to security management.
Security Incident Response Plan (SIRP)
A documented strategy and set of procedures defining how an organization detects, responds to, and recovers from security incidents. SIRPs establish clear roles, communication protocols, and remediation steps to minimize impact.
Security Incident Response (SIR)
A structured approach to managing and mitigating the impact of cybersecurity incidents. SIR includes preparation, detection, containment, eradication, recovery, and post-incident analysis.
Security Incident Triage
The process of evaluating and prioritizing security alerts based on severity and potential impact. Triage ensures that critical threats are addressed promptly while reducing unnecessary escalations.
Security Information and Event Management (SIEM)
A type of software solution that aggregates and analyzes security data from across an organization’s infrastructure in real-time to provide insights on threats and facilitate incident response. It combines Security Information Management (SIM) and Security Event Management (SEM) functionalities.
Security Metrics and KPIs
Quantifiable measures used to evaluate the effectiveness of security operations. Common metrics include mean time to detect (MTTD) and mean time to respond (MTTR) for incidents.
Security Metrics and Reporting
A framework for collecting, analyzing, and communicating security performance indicators to stakeholders and leadership. Security metrics track incident trends, response times, remediation progress, and compliance status.
Security Operations Center (SOC)
A centralized team responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents. The SOC coordinates tools, processes, and personnel to maintain an organization’s security posture.
Security Orchestration, Automation, and Response (SOAR)
A technology stack that integrates security tools and automates incident response workflows. SOAR platforms reduce manual effort by orchestrating actions such as enrichment, ticketing, and containment across multiple security systems.
Security Posture Assessment
The evaluation of an organization’s overall security readiness and risk exposure. It involves reviewing policies, controls, configurations, and compliance alignment to identify improvement areas.
Security Posture Management
A continuous monitoring and improvement process that evaluates an organization's overall security hygiene, compliance status, and risk exposure. It involves assessing configurations, policies, and controls against security standards and industry benchmarks.
Security Risk Scoring
A quantitative methodology that assigns risk scores to vulnerabilities, misconfigurations, and security gaps based on exploitability, impact, and asset criticality. Risk scoring prioritizes remediation efforts on the most dangerous security issues.
Security Stack Integration
The process of connecting disparate security tools and platforms to enable data sharing, automated workflows, and unified security operations. Integration reduces tool sprawl and creates a cohesive security operations environment.
Security Telemetry
Operational data generated by security tools, endpoints, and infrastructure components. Telemetry feeds analytics systems to support detection, investigation, and response activities.
Security Token
A physical or digital credential used to access systems securely, often implementing multifactor authentication to enhance security.
Social Engineering
The psychological manipulation of people into performing actions or divulging confidential information, posing significant risks to organizational security when left unchecked.
Supply Chain Security
Ensuring the integrity and security of an organization's supply chain by identifying and mitigating risks associated with vendors and third parties. This includes addressing potential vulnerabilities introduced by suppliers.
Threat Actor Attribution
The analytical process of identifying and linking cyber attacks to specific threat actors, nation-states, or criminal groups based on tactics, tools, and evidence. Attribution supports strategic decision-making and helps prioritize defensive measures.
Threat Hunting
The proactive and iterative search for indicators of compromise (IOCs) or suspicious activities in an organization's networks and systems. This approach anticipates threats rather than waiting for alerts from detection tools.
Threat Intelligence
The collection and analysis of information about potential or current threats against an organization. This intelligence is used to inform security decisions and improve defense strategies against emerging threats.
Threat Intelligence Platform (TIP)
A system designed to collect, aggregate, and analyze threat intelligence from multiple sources. TIPs help SecOps teams operationalize threat data by integrating indicators of compromise into detection and response workflows.
User and Entity Behavior Analytics (UEBA)
A security analytics approach that models normal user and system behavior to detect anomalies. UEBA leverages machine learning to identify insider threats, compromised accounts, and lateral movement.
Vulnerability Assessment and Management (VAM)
A systematic process of identifying, analyzing, prioritizing, and remediating vulnerabilities across IT systems and applications. VAM combines automated scanning with risk-based prioritization to guide remediation efforts.
Vulnerability Disclosure Program (VDP)
A formal process that enables external researchers to report security vulnerabilities responsibly. VDPs help organizations identify and remediate weaknesses before exploitation.