Security glossary

A deceptive message impersonating a trusted party to steal credentials, money, or sensitive data.

Targeted phishing tailored to a specific person or organization using researched details.

Social-engineering fraud impersonating execs/vendors to trigger wires or data leaks — often with no link or attachment.

A supply-chain BEC where a trusted vendor's account is hijacked to swap payment details on invoices.

Phishing that hides a malicious link behind a QR code to bypass URL filters.

Phishing via SMS (smishing) or voice calls (vishing), often combined with email attacks.

Forging the sender address or display name to appear as a legitimate sender.

Faking only the display name (e.g., an exec or brand) while the real address differs.

A near-identical impostor domain (e.g., rn vs m, 0 vs o) used to fool the eye.

Seizing a real account with stolen credentials to attack from the inside.

Collecting usernames/passwords, typically via fake login pages.

A brand-new vulnerability or attack with no patch or signature yet.

An attack that uses large language models to mass-produce highly natural, personalized phishing emails free of grammatical errors.

A phishing technique using fake customer-support accounts on social media to approach complaining users and steal their information.

A technique that lures victims into running malware themselves using enticing bait such as infected USB drives or free downloads.

A technique that mimics a well-known brand's logo, design, and domain to deceive users with emails or sites that look authentic.

A common BEC variant in which an attacker impersonates a CEO or top executive to instruct finance staff to make urgent wire transfers.

A phishing technique that copies a legitimate previously delivered email and resends it with attachments or links swapped for malicious ones.

A phishing technique that tricks users into granting permissions to a malicious OAuth app, enabling data access without stealing passwords.

An attack where adversaries monitor an ongoing business email conversation and inject themselves to alter payment details or commit fraud.

An attack using AI-generated fake audio or video to impersonate executives in calls or voice messages to induce wire transfers or data leaks.

An attack where adversaries steal credentials to seize a legitimate email account and abuse it for internal impersonation or fraud.

A common BEC social-engineering scam that impersonates an executive to urgently ask an employee to buy gift cards and send the codes.

An attack using visually identical Unicode characters (e.g., Cyrillic 'a' vs Latin 'a') to create fraudulent domains that look legitimate.

A general class of attacks that masquerade as trusted persons, brands, or organizations so victims believe requests are legitimate.

A BEC-style financial fraud that sends fake or altered invoices to redirect payments to attacker-controlled accounts.

An attack vector delivering malware or malicious macros hidden in email attachments such as documents or archives that infect upon opening.

Spam email carrying malicious attachments or links, sent in bulk and serving as a primary vector for malware infections.

A BEC scam that impersonates an employee to ask HR or payroll to change direct-deposit details, diverting wages to an attacker's account.

An attack that redirects users to fraudulent websites via DNS poisoning or host-file manipulation even when they enter a legitimate address.

A cybercrime business model that sells phishing infrastructure, kits, and hosting as a subscription service, lowering the barrier to attacks.

A pre-built package bundling fake login pages and collection scripts so non-experts can quickly deploy phishing sites.

A social-engineering technique where an attacker fabricates a plausible scenario or false identity to gain a victim's trust and extract information.

A social-engineering technique that offers a service or benefit, such as fake tech support, in exchange for credentials or access.

An email attack that inserts malicious links or attachments into an existing reply chain from a compromised account so recipients open them without suspicion.

An extortion scam email that threatens to release supposed compromising sexual material unless the victim pays money such as Bitcoin.

A phishing attack delivered via SMS text messages using malicious links or fraudulent prompts to deceive users.

The manipulation of human psychology and trust, rather than technical vulnerabilities, to induce information disclosure or security bypass.

Unsolicited bulk email sent without recipient consent, often abused as a vector for phishing or malware distribution.

An attack that floods a victim's inbox with massive email volume in a short time to bury legitimate security or fraud-alert notifications, often as a precursor to follow-on scams.

A physical social-engineering technique of following an authorized person into a restricted area without credentials, also known as piggybacking.

An attack that replies into an existing conversation thread from a compromised mailbox to insert malicious content while exploiting established trust.

Registering misspelled variants of popular domains to capture users who make typing errors and redirect them to malicious sites.

A technique abusing open-redirect vulnerabilities on trusted sites so links appear legitimate but forward victims to malicious destinations.

A social-engineering attack that uses phone or voice calls to deceive victims into divulging personal or financial information.

A fraud technique where AI clones a target's voice from short samples to impersonate family or superiors and demand urgent money transfers.

A targeted attack that compromises websites frequently visited by a target group to infect their visitors.

An Office or PDF document manipulated with macros, exploits, or embedded objects to execute malware merely upon opening.

A form of spear phishing that targets high-profile executives such as CEOs or CFOs to exploit their authority and access to funds.

DNS record declaring which mail servers may send for a domain.

Cryptographic signature on a message that verifies it was not altered.

Policy layer that enforces SPF/DKIM results (reject/quarantine) and reports.

Chain that preserves and re-signs authentication results across relays/forwarders.

DNS record pointing to a domain's inbound mail servers; inline gateways change it.

A standard that displays a brand's verified logo next to authenticated messages in the inbox for domains passing DMARC, with the logo validated via DNS and a Verified Mark Certificate.

A protocol that binds TLS certificates or public keys to DNS names using DNSSEC-protected TLSA records, enabling verification of server certificates for protocols such as SMTP without relying solely on CAs.

An identifier used to distinguish among multiple DKIM keys for a domain; the corresponding public key is published at the DNS location selector._domainkey.domain.

A periodic XML report sent by receiving servers to a domain owner, summarizing statistics on SPF, DKIM, and DMARC authentication results for the domain's mail.

The core DMARC requirement that the domain authenticated by SPF or DKIM match the domain in the message's From header, evaluated in strict or relaxed mode.

Extensions that add digital signatures to DNS responses to provide data integrity and origin authentication, preventing DNS spoofing and cache poisoning and underpinning DANE.

A TLS property using ephemeral per-session keys so that even if a long-term private key is later compromised, previously recorded encrypted traffic cannot be decrypted.

A mechanism letting a domain publish, over HTTPS, a policy requiring TLS encryption and certificate validation for inbound SMTP connections, defending against downgrade and man-in-the-middle attacks.

An open standard for email encryption derived from PGP (RFC 4880 and successors) that defines message and key formats so implementations like GnuPG can interoperate.

A public-key cryptography program for encrypting and signing email and files, using a web-of-trust model to validate keys.

The envelope sender (MAIL FROM) address of an email, where bounce messages are returned, and whose domain is the basis for SPF verification and DMARC alignment.

A standard for end-to-end signing and encryption of email messages using X.509 certificate-based public-key cryptography, providing message integrity, authentication, and confidentiality.

The standard internet protocol for transmitting email between mail servers and from clients to servers; plaintext by default, it is secured with STARTTLS or SMTPS.

A method of encrypting SMTP with TLS from the start of the connection (implicit TLS, typically port 465), encrypting from the outset rather than via the opportunistic upgrade of STARTTLS.

A DNS TXT record listing a domain's authorized sending mail servers, beginning with v=spf1 and composed of mechanisms like include, a, mx, ip4 and qualifiers such as -all.

A command that opportunistically upgrades an existing plaintext protocol connection to a TLS-encrypted one, used in SMTP, IMAP, and POP3 to secure the transport while keeping standard ports.

A standard that lets domains using MTA-STS or DANE receive daily aggregate reports from sending mail servers about TLS negotiation successes and failures.

A digital certificate issued by an authority that verifies a brand's trademark rights to a logo, used in BIMI to display a validated logo in the inbox.

Traditional inline filter that sits in front of MX, scanning mail before delivery.

Modern API-based approach that scans/remediates post-delivery on M365/Workspace — no MX change.

Sending a copy of every message to the security system for non-disruptive monitoring/audit.

Isolated environment that detonates suspicious files/links to observe malicious behavior.

Strips active content (e.g., macros) from attachments and rebuilds a safe version.

Keeping data under the laws/control of its jurisdiction — achieved via on-prem / in-region deployment.

Collateral spam in which bounce messages or auto-replies to spam with forged sender addresses flood innocent third parties.

A security control that inserts a warning banner at the top of messages from outside the organization to raise user awareness.

A core ICES capability that automatically retracts or removes messages already delivered to inboxes once they are found malicious, via API (clawback).

A mail server control that limits SMTP connection or send rates per source IP or domain to mitigate spam, abuse, and overload.

An availability and disaster-recovery capability ensuring users can send and receive email even during a primary mail system outage.

A technology that inspects outbound email content to detect, block, or encrypt unauthorized transmission of sensitive data.

A gateway solution that automatically encrypts outbound email according to policy to protect sensitive information.

A feature that holds suspected spam, malware, or phishing email in a separate quarantine area instead of the inbox for admin or user review.

A technology that detonates suspicious attachments or URLs in an isolated virtual environment to dynamically analyze malicious behavior.

A capability that temporarily stores mail on a backup server when the destination is down and re-delivers it after recovery to prevent loss.

A technique that temporarily rejects email from unknown senders, relying on legitimate MTAs to retry, thereby filtering out spambots.

An email retrieval protocol that keeps messages on the server and allows synchronized access across multiple devices.

The two email security deployment models: inline, which sits in the mail flow to block in transit, versus API-based, which integrates with mailbox APIs to act post-delivery.

A queue within an MTA that temporarily holds email that cannot be delivered immediately and manages retries.

Software that delivers email received from an MTA into the recipient's mailbox.

A server that receives outgoing mail from clients, applies authentication and policy checks, and hands it to an MTA, typically over port 587.

Software that transfers and routes email between mail servers using SMTP.

Client software that lets users compose, read, and manage email, commonly known as an email client.

An email retrieval protocol that downloads messages from the server to a local client, typically removing them from the server.

A reputation-based blocklist of IP addresses known to send spam, queried via DNS to reject mail.

A filtering technique that uses reputation scores based on the historical behavior of sending IPs or domains to block or allow mail.

A designated external relay server through which a mail server routes all outbound email instead of delivering directly to destinations.

The process by which one mail server forwards email through another, which if misconfigured can be abused as an open relay.

An attack technique that exploits differing interpretations of message-end sequences between sending and receiving servers to inject spoofed email.

Encrypting an SMTP connection via the STARTTLS command to protect message content in transit.

An SMTP submission port using implicit TLS where encryption applies from the start of the connection.

The standard SMTP submission port used by authenticated clients to submit mail, distinct from port 25 used for relaying.

A protection that re-evaluates a link's safety at the moment a user clicks it, catching URLs weaponized after delivery.

A mail flow policy rule that evaluates conditions on email and automatically applies actions such as blocking, redirecting, adding headers, or encryption.

A technique that rewrites links in email to point to a security proxy so their safety is checked in real time at click time.

Platform that aggregates and correlates security events/logs (Splunk, Sentinel, etc.).

Automated orchestration of incident response actions.

Forensic artifact that signals compromise (malicious IP, domain, file hash, …).

Remediation that moves/holds a risky message out of the inbox.

Requires an extra authentication factor beyond a password, mitigating takeover.

A targeted adversary that uses sophisticated techniques to maintain stealthy, long-term access. It is often associated with nation-state actors.

The desensitization of analysts caused by an overwhelming volume of alerts, leading to missed critical threats. It is a major challenge in SOC operations.

A chronological record of activities and changes within a system. It is essential for accountability and post-incident investigation.

A defensive team responsible for protecting assets and detecting and responding to attacks. They are the core staff of SOC operations.

The mandatory process of informing regulators and affected individuals when a data breach occurs. It is required under regulations such as GDPR and data protection laws.

The documented chronological handling of digital evidence to ensure its integrity. It is essential for legal admissibility.

The communication channel and infrastructure attackers use to remotely control compromised systems. It is used for data exfiltration and issuing further commands.

A specialized organization that receives, coordinates, and responds to security incidents. They operate at national, sector, and organizational levels.

A dedicated team responsible for handling security incidents within an organization. It performs detection, analysis, recovery, and post-incident activities.

A model defined by Lockheed Martin describing the stages of a cyberattack. It breaks an attack into seven phases from reconnaissance to actions on objectives.

The unauthorized transfer of data from inside an organization to an external destination. It is often the ultimate goal of an attack.

A field combining forensic investigation with incident response. It simultaneously determines root cause and drives rapid remediation.

The discipline of collecting, preserving, and analyzing digital evidence to determine the cause and course of an incident. It emphasizes legal admissibility.

A solution that continuously monitors endpoint activity to detect, investigate, and respond to threats. It uses behavioral analysis to identify advanced attacks.

An alert that incorrectly flags benign activity as a threat. Excessive false positives cause analyst fatigue and alert dismissal.

The European Union's regulation on personal data protection and processing. It includes breach notification obligations and strong penalties.

An integrated approach to managing an organization's governance, risk management, and regulatory compliance. It aligns security decisions with business objectives.

The structured process of detecting, containing, eradicating, and recovering from security incidents. Its goal is to minimize damage and restore normal operations.

Indicators that reveal an attacker's intent and behavioral patterns. They focus on detecting an attack in progress before compromise completes.

An international standard for information security management systems (ISMS). It requires risk-based controls and continual improvement.

A technique where an attacker expands access from a compromised system to others within the network. It is used to reach target assets.

The practice of collecting, storing, analyzing, and retaining system and application logs. It underpins detection, forensics, and compliance.

The average time taken to detect a security incident after it occurs. It is a key metric for SOC detection performance.

The average time taken to respond to and remediate an incident after detection. It measures response efficiency.

A globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It serves as a common framework for detection and defense.

A solution that analyzes network traffic to detect and respond to anomalous behavior and threats. It excels at identifying lateral movement and stealthy attacks.

A cybersecurity management framework from the U.S. NIST organized around Identify, Protect, Detect, Respond, and Recover functions. It provides a common language for risk management.

A security standard that organizations handling payment card data must comply with. It governs the storage, transmission, and processing of cardholder data.

Techniques that allow an attacker to maintain access across reboots or credential changes. It is one of the key tactics in MITRE ATT&CK.

A standardized set of procedures for responding to a specific type of incident. It forms the basis for SOAR automation.

An attack technique for gaining higher privileges from a lower-privileged context. It is a key step toward system control and persistence.

An exercise that has offensive (red team) and defensive (blue team) collaborate to improve detection and response. It integrates feedback from both sides.

An offensive team that emulates real adversaries to test an organization's defenses. It exposes gaps in detection and response.

A step-by-step guide documenting operational tasks or response procedures. It ensures consistency and repeatability.

A centralized team and facility that continuously monitors, detects, and responds to security events. It combines analysts, processes, and technology to manage threats.

A generic, vendor-agnostic format for log-based detection rules. It allows a rule to be written once and converted for multiple SIEM platforms.

An AICPA audit report attesting to a service organization's adherence to trust principles such as security, availability, and confidentiality. It is widely used by SaaS firms to demonstrate trustworthiness.

A standardized language for representing structured cyber threat intelligence. It supports consistent sharing of threat information.

A standard protocol used by network devices and systems to send log messages. It is widely used for centralized log collection.

A discussion-based exercise that walks through a hypothetical incident scenario. It surfaces gaps in procedures and communication beforehand.

A concept describing adversary behavior at the levels of tactics, techniques, and procedures. It serves as the basis for threat analysis and detection.

A transport protocol for exchanging STIX-based threat intelligence. It enables automated sharing of threat information.

An individual or group responsible for causing a security incident. They are classified by motivation, capability, and resources.

A rule defining specific malicious patterns or conditions that trigger alerts. It is the basic unit of SIEM and EDR detection logic.

The proactive, hypothesis-driven search for threats that evade existing detection tools. Analysts actively look for signs of compromise.

Collected and analyzed information about threat actors and attacks. It supports defensive decision-making and proactive response.

Technology that learns baselines of normal user and entity behavior to detect anomalies. It is effective at spotting insider threats and account takeover.

A solution that unifies detection and response across endpoints, network, cloud, and email layers. It provides visibility beyond isolated security silos.

A tool and rule language for identifying and classifying malware based on patterns. It is widely used in malware hunting and forensics.

Large language models and self-hostable small models (sLLM), used for intent classification.

Standard neural network (dense, continuous) — transformers/LLMs belong here (our shipped engine).

Third-generation, event-driven spiking network — ultra-low-power and streaming-friendly (research).

Retrieves external knowledge (threat intel) to ground the model’s judgment.

Analyst-like automation where specialist agents combine clues to judge intent.

An input subtly perturbed to be misclassified by a model while appearing normal to humans. A core threat in ML security.

The study of attacks that deceive or subvert machine learning models, and the defenses against them.

An autonomous LLM-based system that invokes tools and reasons over multiple steps to accomplish goals.

The research field of steering AI systems' goals and behavior toward human intent and values. Central to safe LLM operation.

A technique for identifying data or behavior that deviates from normal patterns. Central to intrusion and fraud detection.

A neural network technique that weights the most relevant parts of an input sequence. A key component of the Transformer.

An attack that implants a hidden function in a model so it behaves maliciously only when a specific trigger is present.

A model that assigns inputs to one of a set of predefined categories. Used for spam/ham and malicious/benign decisions.

An evaluation table that cross-tabulates a classifier's predictions versus true labels, showing TP, FP, TN, and FN.

An attack that injects malicious samples into training data to manipulate a model's performance or behavior.

A subfield of machine learning using multi-layer neural networks to learn complex representations. Applied to image- and text-based threat detection.

A dense vector representation that captures the semantic meaning of words or documents. Forms the basis of similarity search and RAG.

Techniques and a field for making AI model predictions interpretable to humans. Important for trusting detection outcomes.

The harmonic mean of precision and recall, summarizing classification performance in a single value.

The rate at which actual negatives are incorrectly classified as positive. Directly linked to alert fatigue in detection systems.

The process of transforming and selecting raw data into features suitable for a model. Greatly impacts detection performance.

The process of further training a pre-trained model on task- or domain-specific data. Used to specialize security classifiers.

A neural architecture where a generator and discriminator compete during training. Used to create deepfakes and synthetic attack data.

An ensemble technique that sequentially combines weak learners to reduce error. Used in detection models such as XGBoost.

Safety controls that inspect and constrain LLM inputs/outputs to block harmful or policy-violating content.

The phenomenon where an LLM plausibly generates false or unsupported content. Treated as a reliability threat.

A technique that bypasses safety guardrails to make an LLM produce prohibited content. Carried out through prompt manipulation.

A branch of AI where systems learn patterns from data to make predictions or classifications without explicit programming. Widely used in security for spam and malware detection.

A privacy attack that infers whether a specific data point was part of a model's training set.

An open protocol that standardizes how LLM applications connect to external tools and data sources.

An attack that manipulates inputs at inference time to evade a detection model. Common in malware detection bypass.

An attack that replicates a target model's functionality or parameters through repeated query-response probing.

A privacy attack that reconstructs sensitive training inputs by analyzing a model's outputs.

A probabilistic classifier based on Bayes' theorem assuming feature independence. A standard for early spam filtering.

The AI field enabling computers to understand and generate human language. Applied to phishing text analysis.

A computational model of interconnected nodes inspired by biological neurons. Forms the basis of pattern recognition and anomaly detection.

When a model fits the training data too closely and fails to generalize to new data.

An OWASP list cataloging the ten most critical security risks for large language model applications.

Precision is the fraction of positive predictions that are correct; recall is the fraction of actual positives detected. Key evaluation metrics.

A machine learning algorithm that ensembles many decision trees for prediction. Frequently used for malicious traffic classification.

An adversarial evaluation that deliberately probes an AI model for vulnerabilities and harmful outputs.

Learning an action policy by optimizing for reward signals. Researched for automated defense and penetration simulation.

A reinforcement learning method that aligns models using human preference feedback as reward. Used to suppress harmful LLM outputs.

The area under the true-positive-rate vs false-positive-rate curve across thresholds, measuring classifier performance.

Learning an input-output mapping from labeled data. Used for label-based detection such as spam/ham classification.

A classification algorithm that finds a hyperplane maximizing the margin between classes. Used in classic spam filters.

The preprocessing step of splitting text into smaller units called tokens for model input.

A machine learning approach that reuses knowledge learned on one task for a related task. Useful in data-scarce security domains.

A neural network architecture based on the self-attention mechanism, the core of modern LLMs. Excels at processing sequential data.

Learning structure or patterns from unlabeled data. Used in clustering-based anomaly detection.

A database that stores embedding vectors and performs approximate nearest-neighbor search. Used in RAG and semantic search.

Malware that encrypts data for ransom; RaaS sells it as a subscription criminal service.

Real-time proxy phishing that steals session tokens to bypass even MFA (rapidly rising).

Flooding a user with MFA push prompts until they approve one by accident.

AI-synthesized voice/video used to impersonate execs, supercharging BEC and vishing.

Injecting hidden instructions into an AI model to make it act against intent (an LLM-era threat).

Data-leak risk from staff feeding sensitive info into unsanctioned AI tools.

"Never trust, always verify" — access governed by identity/context, not network location.

Compromising a trusted vendor, software, or update channel to hit many at once.

Detection & response on endpoints (EDR), extended across email/cloud/network (XDR).

Controls that detect and block sensitive data from leaving (email, uploads, etc.).

Harm from insiders (malicious or careless); a hijacked account also behaves like one.

Authentication resistant to phishing/AiTM (passkeys, FIDO2 keys); the passwordless direction.

Criminals who breach orgs and sell the access to others (e.g., ransomware crews).

Continuously discovering/managing exposed assets, domains, and services to shrink attack paths.

A sophisticated, prolonged, and stealthy intrusion by a well-resourced adversary to achieve specific goals. Often conducted by nation-state groups.

A network of compromised devices remotely controlled by an attacker. It is used for DDoS, spam, and cryptomining.

An attack that systematically tries all possible passwords or key combinations to break authentication. Weak passwords are especially vulnerable.

A security broker that sits between users and cloud services to enforce policy and provide visibility. It helps control shadow IT.

An attack that automatically tries leaked username-password pairs against other services to hijack accounts. It exploits password reuse.

A tool that continuously assesses and remediates misconfigurations and compliance gaps in cloud environments. It reduces risk from improper configuration.

An attack that tricks an authenticated user into executing unintended requests. It performs actions using the victim's privileges.

An attack that floods a target service with traffic from many devices to disrupt it. It undermines availability.

An encryption method where only the sender and recipient can decrypt the message. Even intermediary servers cannot read the content.

A security device or software that allows or blocks network traffic based on defined rules. It protects internal networks from external threats.

A framework for identifying users and managing their access to resources. It encompasses authentication and authorization.

Security systems that detect (IDS) or actively block (IPS) malicious activity on networks or hosts. They operate on signatures or anomaly detection.

A tool that secretly records a user's keystrokes. It is used to steal passwords and sensitive information.

A technique that abuses legitimate tools already present on a system, such as PowerShell, to evade detection. It operates without dropping extra malware.

A general term for malicious software designed to harm or gain unauthorized access to systems. It includes viruses, worms, and trojans.

An attack where the adversary intercepts or alters communication between two parties. Unencrypted communications are especially vulnerable.

An authorization protocol that lets users delegate limited access to third-party apps without sharing passwords. It operates using tokens.

A security discipline that controls, monitors, and audits access by high-privilege accounts. It mitigates misuse and credential theft.

Cryptographic algorithms designed to resist attacks by quantum computers. Standardization is underway to replace classical public-key schemes.

An asymmetric cryptography scheme using a public-private key pair for encryption and digital signatures. It enables secure communication without prior key exchange.

A stealthy malicious toolset that hides deep in a system to maintain privileged access and evade detection. It conceals activity at the OS level.

An architecture that delivers networking and security functions as a unified cloud service. It combines SD-WAN with zero-trust security.

Malware that covertly monitors activity and exfiltrates collected information. It steals keystrokes, screens, and credentials.

An attack that injects malicious SQL statements into input to manipulate a database. It can lead to data exfiltration or tampering.

An authentication scheme that lets users access multiple applications with a single login. It improves usability and credential management.

A standard protocol that encrypts network communication and provides integrity and authentication. It underpins HTTPS and succeeds SSL.

Malware disguised as legitimate software to trick users into running it. It is used to install backdoors or steal data.

A technology that creates an encrypted tunnel over public networks for secure communication. It is used for remote access and privacy.

Malware that self-replicates and spreads across networks without user interaction. Its rapid propagation can cause widespread damage.

An attack that injects malicious scripts into web pages to run in other users' browsers. It is used for session hijacking and more.