Glossary
Security terms, defined plainly
The vocabulary that turns up in assessment reports, audit findings and vendor proposals — written out once, without the marketing. Each term links to the service where we do that work.
Jump to a term
- Autonomous SOC
- BEC
- Cloud misconfiguration
- Configuration management plan
- CVE
- CVSS
- DKIM
- DMARC
- DSPM
- Human risk score
- IoC
- ISMS
- MDR
- MSSP
- MTTD
- MTTR
- OSINT
- OT security
- OWASP Top 10 for LLM Applications
- Phishing
- Purple team
- Quishing
- SCORM
- Security awareness training
- SIEM
- Smishing
- SOAR
- SOC
- Social engineering
- Spear phishing
- SPF
- VAPT
- Vishing
- YARA
- Zero trust
Autonomous SOC
also AI-driven or AI-native security operations
- A security operations model in which AI performs the first pass of triage and investigation and analysts review the result and decide. The term is used loosely by vendors: nearly every real deployment still keeps a person in the loop before anything is contained, so the useful question is which decisions have actually been delegated, not whether the label fits.
BEC
Business email compromise
- A fraud in which the attacker impersonates somebody the recipient trusts — an executive, a supplier, a colleague — and asks for a payment, a change of bank details, or a file. There is usually no malware and often no link, so the message passes technical filters intact. What catches it is a person who verifies the request through a second channel.
Cloud misconfiguration
- A cloud resource left in a state that exposes it — storage readable by anyone, a role granted far more than it needs, a management port open to the internet. It is a configuration error rather than a software flaw, which is why it carries no CVE and has no patch: it is found by reviewing settings, not by scanning for versions.
Configuration management plan
- The document that states how a system’s configuration is defined, changed and verified — what the approved baseline is, who may depart from it, and how drift is detected. Auditors ask for it because most of the controls they go on to test are configuration settings that somebody is able to change.
CVE
Common Vulnerabilities and Exposures
- A public identifier assigned to one specific vulnerability in one specific product, written as CVE-2026-12345. It exists so that two parties discussing a flaw can be certain they mean the same one. The identifier carries no severity of its own — that is what CVSS is for.
CVSS
Common Vulnerability Scoring System
- A method for expressing how severe a vulnerability is on a scale to ten, derived from how it can be reached and what it yields. The base score describes the flaw in isolation and deliberately knows nothing about your environment, so a high score is a reason to assess rather than a statement of your risk.
DKIM
DomainKeys Identified Mail
- An email authentication method in which the sending server signs a message with a private key and the receiving server checks that signature against a public key published in DNS. It establishes that the signing domain authorised the message and that it was not altered on the way. It says nothing about whether the contents are honest.
DMARC
Domain-based Message Authentication, Reporting and Conformance
- A policy published in DNS telling receiving servers what to do with mail claiming to come from your domain when SPF and DKIM do not line up: accept it, quarantine it, or reject it — and where to send reports about what arrived. It is what turns the other two checks from a signal into an enforceable rule.
DSPM
Data Security Posture Management
- Tooling that discovers where data actually lives across cloud services, classifies it, and reports who is able to reach it. It answers the question an asset inventory misses: not which systems exist, but which of them hold something that would matter if it leaked.
Human risk score
- A single figure, per person or per group, summarising how somebody behaves when tested: whether they click, whether they report, whether they finish what they were given. It measures behaviour over time rather than knowledge, which is why a score that never moves tells you more than a score that is merely low.
IoC
Indicator of compromise
- An observable artefact suggesting a system has been attacked — a file hash, a domain, an address, a registry key, a sending account. Indicators are cheap to exchange and trivial for an attacker to change, so they are good at finding a known intrusion quickly and poor at recognising an unfamiliar one.
ISMS
Information Security Management System
- The documented set of policies, roles, risk decisions and review cycles through which an organization manages security. ISO/IEC 27001 certifies the management system rather than the technology, which is why an ISMS consists mostly of recorded decisions and evidence that they were reviewed.
MDR
Managed Detection and Response
- A service that supplies the detection and response capability of a SOC without the client building one. The provider monitors telemetry, investigates what the tooling raises, and either contains the threat directly or hands over a verified incident with the evidence already assembled.
MSSP
Managed Security Service Provider
- The older outsourcing model, in which a provider manages security devices — firewalls, gateways, sometimes a SIEM — and forwards what they raise. The practical difference from MDR is where the work stops: an MSSP typically passes an alert on, while MDR is expected to investigate it and act.
MTTD
Mean Time to Detect
- The average time between a compromise beginning and the defenders noticing it. It should be measured from the earliest evidence found afterwards rather than from the first alert, because an intrusion that generated no alert at all still has to count against the number.
MTTR
Mean Time to Respond
- The average time between detecting a threat and containing it. The same abbreviation is also used for mean time to recover, which measures something different — the return to normal service — so a reported figure is only meaningful once it says which of the two it is.
OSINT
Open Source Intelligence
- Intelligence assembled from sources anyone can reach: public registries, breached credential dumps, code repositories, social platforms and criminal forums. Used defensively, it establishes what an attacker could learn about an organization before touching anything the organization owns.
OT security
Operational Technology security
- The security of systems that run physical processes — production lines, building services, energy and water. It differs from IT security mainly in its constraints: equipment can have a service life measured in decades, patching may mean stopping production, and availability usually outranks confidentiality.
OWASP Top 10 for LLM Applications
- A community-maintained list of the most significant security risks specific to applications built on large language models — prompt injection, insecure handling of model output, training-data poisoning and related failures. It is a checklist to review a design against, not a standard anybody certifies against.
Phishing
- A message impersonating a trusted sender in order to make the reader hand over a credential, approve something, or open a file. Enough of them reach an inbox that the decision the reader makes is the remaining control, which is why it is treated as a behavioural problem rather than a mail-filtering one.
Purple team
- An exercise in which the attacking side and the defending side work together in the same room instead of against each other. The attackers narrate each technique as they run it and the defenders check whether their tooling saw it, so the output is a list of detection gaps rather than a win or a loss.
Quishing
- Phishing that carries its link as a QR code instead of as text. The code is an image, so it tends to survive link scanning, and it is read on a personal phone — where the mail client’s warnings and most of the organisation’s controls do not reach.
SCORM
Sharable Content Object Reference Model
- A packaging standard that lets a course built in one authoring tool run inside any learning platform that supports it, and report completion and scores back in a common format. Its practical effect is that existing material stays portable rather than being tied to the tool that produced it.
Security awareness training
- Structured teaching intended to change what people do when an attack reaches them, as distinct from informing them that attacks exist. Supervisors increasingly treat it as a named obligation, and what they ask to see is a record per person rather than a description of the programme.
SIEM
Security Information and Event Management
- A platform that collects log and event data from across an estate, normalizes it into a common shape, and runs detection rules against it. A SIEM is where detection logic lives and where an investigation is reconstructed; it does not decide anything or act by itself.
Smishing
- Phishing delivered by SMS or a messaging app. The format removes the cues people lean on in email — no display name to inspect, no signature block, shortened links as a matter of routine — and it lands on a device that is usually personal and usually unmanaged.
SOAR
Security Orchestration, Automation and Response
- Tooling that carries out the repeatable parts of a response — enriching an alert, isolating a host, raising a ticket — so that analyst time goes on judgement rather than on steps. It is normally deployed alongside a SIEM rather than instead of one.
SOC
Security Operations Center
- The people, process and tooling that watch an organization’s systems for signs of attack and respond when they find one. A SOC may be staffed in-house, bought as a service, or run as a hybrid in which an external team covers nights and weekends. What makes it a SOC rather than a monitoring product is the escalation path behind the alerts.
Spear phishing
- Phishing aimed at one person or a handful, written using details gathered beforehand — a project name, a counterparty, a trip that actually happened. The volume is tiny and the plausibility high, which is the reverse of the bulk trade-off and the reason defences tuned to volume tend to miss it.
SPF
Sender Policy Framework
- A DNS record naming the servers permitted to send mail for a domain, so a receiving server can check whether a message came from one of them. It validates the envelope sender rather than the address a reader actually sees, which is why a message can pass SPF and still display a forged name.
VAPT
Vulnerability Assessment and Penetration Testing
- Two activities usually bought together. The assessment enumerates known weaknesses across an agreed scope, largely through automated scanning; the penetration test has a tester attempt to exploit them and chain them into something worse. The assessment tells you what is exposed, the test tells you what an attacker could do with it.
Vishing
- Phishing conducted by voice call, including automated calls that ask the person to press a key or read a code back. Caller ID is trivial to forge, and a live conversation applies a pressure a written message cannot, so the standard advice — stop, and call back on a number you already know — is harder to follow than it sounds.
YARA
- A rule language for describing patterns in files and messages — strings, byte sequences, structural traits — so that anything matching a known pattern is identified automatically. Rules are written and shared by analysts, which makes them good at recognising a family of threats and no use at all against one nobody has described yet.
Zero trust
- An architectural principle: no request is trusted on account of where it came from. Every access decision is taken at the point of use against identity, device state and context, rather than being inherited from having already reached the inside of a network.
Where we do this: Managed Detection & Response
Where we do this: Cybersecurity Advisory
Where we do this: Implementation Services
Where we do this: Vulnerability Alerts
Where we do this: Vulnerability Alerts
Where we do this: Phishing Investigation
Where we do this: Phishing Investigation
Where we do this: Cybersecurity Advisory
Where we do this: Cyber Awareness
Where we do this: Managed Detection & Response
Where we do this: Compliance Frameworks
Where we do this: Managed Detection & Response
Where we do this: Managed Detection & Response
Where we do this: Managed Detection & Response
Where we do this: Managed Detection & Response
Where we do this: Digital Risk Protection
Where we do this: Cyber Awareness
Where we do this: Incident Response
Where we do this: Cyber Awareness
Where we do this: Cyber Awareness
Where we do this: Cyber Awareness
Where we do this: Implementation Services
Where we do this: Cyber Awareness
Where we do this: Implementation Services
Where we do this: Managed Detection & Response
Where we do this: Cyber Awareness
Where we do this: Phishing Investigation
Where we do this: Implementation Services
Where we do this: Cyber Awareness
Where we do this: Phishing Investigation
Not sure which of these applies to you?
Tell us what is being asked of you — by an auditor, a customer, or your own board — and we will say which of these matters for your situation and which does not.
Social engineering
Where we do this: Cyber Awareness