Offensive Cybersecurity Glossary

Clear, self-contained definitions of pentesting, Red Team, bug bounty and compliance terms (NIS2, DORA, CRA).

• 3-2-1 Backup Strategy — The 3-2-1 strategy is a practical backup rule that recommends keeping at least three copies of the data, on two different types of media, with at least one copy stored off-site. Its goal is to ensure recovery even in scenarios such as a fire, hardware failure or a ransomware attack that encrypts local copies.
• 51% Attack — A 51% attack occurs when an entity or group gains control of more than half of a blockchain network's computing or staking power, allowing it to reverse confirmed transactions (double spending) or block other participants' transactions from being included.
• Account Deprovisioning — Account deprovisioning is the process of systematically revoking a user's access and permissions when they leave the organization or change roles, preventing active accounts or unnecessary privileges from remaining that could be exploited.
• Account Takeover (ATO) — Account takeover (ATO) is an attack in which a third party gains unauthorized access to a legitimate user's account, typically through stolen credentials, phishing, or credential stuffing, to use it for fraud, data exfiltration, or as an entry point into other systems.
• Active and Passive Reconnaissance — Active and passive reconnaissance are the two initial phases of a pentest: passive reconnaissance gathers public information about the target without directly interacting with its systems, while active reconnaissance involves direct contact — such as port scanning — that can be detected by the target.
• Active Defense — Active defense encompasses measures that go beyond passively protecting a system, such as using decoys, attributing an ongoing attack or deliberately interacting with the attacker to slow them down and gather intelligence. It must be clearly distinguished from hack-back retaliation, which is illegal in most jurisdictions.
• Adversarial Examples — Adversarial examples are inputs deliberately modified — often with perturbations imperceptible to a human — designed to deceive a machine learning model into making an incorrect classification or prediction.
• Adversary Emulation — Adversary emulation is an advanced pentesting or red team methodology that reproduces the tactics, techniques, and procedures (TTPs) of a real, known threat actor — often mapped to the MITRE ATT&CK framework — to assess an organization's detection and response capability.
• Adware — Adware is software that displays unwanted advertising on a device, often by hijacking the browser or injecting ads into legitimate applications. While not always as damaging as other malware, it can degrade system performance and act as an entry vector for more serious threats.
• AEPD (Spanish Data Protection Agency) — The AEPD (Spanish Data Protection Agency) is the Spanish supervisory authority responsible for overseeing GDPR compliance, resolving citizens' complaints and imposing sanctions for data protection infringements.
• AES — AES (Advanced Encryption Standard) is a symmetric block cipher algorithm, adopted as a standard by the US government in 2001, that operates with 128, 192 or 256-bit keys and is widely used to protect data at rest and in transit.
• Agentic AI Risk — Agentic AI risk arises when an AI system can autonomously plan and execute actions — calling tools, modifying systems, or interacting with other services — without adequate oversight, widening the attack surface for manipulation or cascading errors.
• AI Act (EU AI Regulation) — The AI Act (EU Regulation 2024/1689) is the world's first comprehensive AI law: it classifies AI systems by risk level and requires, for high-risk systems, conformity assessments, transparency and human oversight, with fines of up to 7% of global turnover.
• AI Assistant Data Leakage — AI assistant data leakage occurs when confidential corporate information is entered into third-party generative AI tools — through prompts, attachments, or integrations — and ends up exposed outside the organization's control, whether through storage, retraining, or provider breaches.
• AI Bill of Materials (AI-BOM) — An AI-BOM (AI Bill of Materials) is a detailed inventory of the components that make up an AI system — models, datasets, dependencies, and libraries — enabling an organization to trace their provenance, assess risk, and respond to vulnerabilities in the AI supply chain.
• AI Guardrails — AI guardrails are technical controls — input and output filters, content policies, or validators — applied to an AI system to restrict its responses to safe, intended behavior, preventing misuse or harmful outputs.
• AI Hallucination — An AI hallucination is a response generated by a language model that presents false, fabricated, or source-inconsistent information as if it were a verified fact — a significant risk in contexts where the model's output feeds decisions without human oversight.
• AI Red Teaming — AI Red Teaming applies traditional Red Team methodology to AI systems: it actively and adversarially attacks a model or AI-based application to find prompt injections, jailbreaks, training-data leaks and other flaws before a real attacker does.
• AI Watermarking — AI watermarking is a technique that embeds an identifiable, typically imperceptible signal into text, images, audio, or video generated by artificial intelligence, aimed at enabling later detection and helping combat disinformation or fraud.
• Air Gap — An air gap is a security measure that physically isolates a critical network or system from any other network, including the internet, to prevent unauthorized remote access. While it significantly raises the bar for attacks, it does not make them impossible: infected USB devices or supply chain attacks can still breach the isolation.
• Air-Gapped Backup — An air-gapped backup is a copy of data kept without any physical or logical network connection to the rest of the infrastructure. This disconnection prevents an attacker who compromises the network from also reaching and encrypting or deleting the backup copies.
• Alert Fatigue — Alert fatigue is the desensitization a security team experiences when it receives such a high volume of alerts, with a high proportion of false positives, that it ends up ignoring or only superficially reviewing notifications that could be legitimate. It is a common reason a real incident goes unnoticed in a SOC.
• Algorithmic Bias — Algorithmic bias is a systematic distortion in an AI model's decisions or predictions, caused by unrepresentative training data or the algorithm's own design, which can result in discrimination or unfair outcomes for certain groups.
• Android Malware — Android malware is malicious software specifically designed for devices running this operating system, typically distributed through fake apps, third-party app stores, or phishing links, and used to steal banking credentials, intercept verification SMS messages, or take control of the device. Google Play Protect and accessibility permissions are common evasion targets.
• API Gateway — An API gateway is a component that centralizes access to a set of APIs, handling authentication, authorization, rate limiting and routing — and it becomes a critical security chokepoint, since a misconfiguration can expose every service behind it at once.
• APT (Advanced Persistent Threat) — An APT is a threat actor (often state-sponsored or highly resourced) that maintains covert, prolonged access to a victim's systems for months or years, prioritizing stealth over speed.
• ARP Spoofing — ARP spoofing is a local-network attack technique in which an attacker sends forged ARP (Address Resolution Protocol) messages to associate its MAC address with another device's IP address, allowing it to intercept, modify or block traffic intended for that device.
• Artifact Repository Poisoning — Artifact repository poisoning consists of introducing malicious versions of packages, images or binaries into an internal repository (Nexus, Artifactory, container registry) that build or deployment pipelines then consume as trusted.
• Assumed Breach Exercise — An assumed breach exercise is a pentesting or red team approach that starts from the premise that the attacker has already gained an initial foothold inside the network, focusing the exercise on evaluating lateral movement, privilege escalation, and post-compromise detection capability.
• Asymmetric Encryption — Asymmetric encryption, or public-key cryptography, uses a pair of mathematically related keys, one public and one private, so that data encrypted with one can only be decrypted with the other, removing the need to share a secret key between parties.
• Attack Surface — The attack surface is the total set of points — systems, APIs, accounts, integrations — through which an attacker could try to break in or exfiltrate data from an organization; the larger and less inventoried it is, the harder to defend.
• Baiting — Baiting is a social engineering attack that lures the victim with an enticing hook (a "lost" USB drive, a free download, or a tempting offer) to get them to unknowingly run malware or hand over their credentials.
• Banking Trojan — A banking Trojan is malware specialized in stealing online banking credentials and financial data, often through web injects that alter legitimate bank pages in real time or overlay fake screens to capture credentials and verification codes. It is particularly common in mobile device variants.
• bcrypt, scrypt and Argon2 — bcrypt, scrypt and Argon2 are hashing algorithms designed specifically for storing passwords, as they introduce a deliberately high computational and memory cost that slows down brute-force attacks compared to generic hash functions such as SHA-256.
• BEC (Business Email Compromise) — BEC fraud, also called "CEO fraud", occurs when an attacker compromises or impersonates a corporate email account (often an executive's) to trick an employee into making a wire transfer or another fraudulent action.
• BGP Hijacking — BGP hijacking occurs when an actor illegitimately announces routes to IP address blocks it does not own through the Border Gateway Protocol (BGP), diverting traffic toward systems under its control in order to intercept or block it.
• Biometric Authentication — Biometric authentication verifies a person's identity using unique physical or behavioral characteristics, such as fingerprints, facial recognition or voice patterns.
• Biometric Spoofing — Biometric spoofing involves deceiving a biometric authentication system by presenting a fake replica of a physical trait, such as a silicone fingerprint or a photo used to bypass facial recognition.
• Black Box / White Box / Grey Box — These are the three information levels a pentest can run under: black box (no prior access or documentation, like a real external attacker), white box (full access to code and configuration) and grey box (a middle ground, with user credentials but no source code).
• Blockchain — A blockchain is a distributed, immutable data structure in which transactions are grouped into cryptographically linked blocks and validated through a consensus mechanism among nodes, without requiring a central authority to guarantee its integrity.
• Blue Team — The Blue Team is an organization's defensive team: responsible for detecting, containing and responding to intrusions, managing the SIEM/EDR, and keeping defenses operational against real or simulated attacks.
• BOLA (Broken Object Level Authorization) — BOLA is an access-control flaw where an API returns data for an object (e.g. another user's order) without checking whether the requester actually has permission over that specific object — it's #1 on the OWASP API Security Top 10.
• Bootkit — A bootkit is malware that infects a system boot process, such as the MBR, UEFI, or boot loader, so it runs before the operating system itself, allowing it to hide and survive reboots or OS reinstalls. Removing it usually requires rewriting the affected firmware or boot sector.
• Botnet — A botnet is a network of compromised devices (computers, IoT, servers) controlled remotely and centrally by an attacker, commonly used to launch DDoS attacks, distribute spam, or mine cryptocurrency without their owners' knowledge.
• Bounty Tiers — Bounty tiers are the payout ranges a bug bounty program establishes based on the severity of the reported vulnerability, ranging from low-criticality findings to critical flaws.
• Breach and Attack Simulation (BAS) — Breach and Attack Simulation (BAS) is a technology that automates the continuous execution of known attack techniques against an organization's own environment, to validate whether security controls detect and block each technique as expected. Unlike a point-in-time penetration test, it offers recurring validation at a lower cost per run.
• Broken Authentication — Broken authentication covers flaws in an application's identity and session management mechanisms, such as weak passwords, predictable session tokens or missing brute-force protection, that let an attacker impersonate a legitimate user. It is often exploited alongside other weaknesses to escalate privileges.
• Brute Force and Password Spraying — Brute force systematically tries many passwords against a single account, while password spraying reverses the logic: it tries a few common passwords against many different accounts to avoid lockouts from failed-attempt thresholds.
• Buffer Overflow — A buffer overflow occurs when a program writes more data than an allocated memory area can hold, overwriting adjacent memory; an attacker can exploit this flaw to corrupt program execution or inject and run arbitrary code.
• Bug Bounty — A bug bounty program financially rewards external security researchers for finding and reporting vulnerabilities in a company's systems, with payouts proportional to the severity of the finding.
• Bug Bounty Hunter — A bug bounty hunter is an independent security researcher who searches for vulnerabilities in public or private bug bounty programs in exchange for financial rewards.
• Bug Bounty Platform — A bug bounty platform is an intermediary service that manages vulnerability reward programs, handling report validation, communication with researchers and payment processing.
• Business Continuity Plan (BCP/DR) — A Business Continuity Plan (BCP) and Disaster Recovery plan (DR) define how an organization keeps critical operations running and restores its systems after a major incident — a cyberattack, an infrastructure failure — minimizing downtime.
• Business Impact Analysis (BIA) — A Business Impact Analysis (BIA) evaluates the operational, financial and reputational consequences of disrupting critical processes, establishing recovery priorities for business continuity.
• Business Logic Vulnerability — A business logic vulnerability abuses an application's legitimate workflow in a way its code never anticipated — like applying the same discount twice or skipping a verification step — without exploiting any traditional technical flaw, which is why no automated scanner catches it.
• C2 (Command and Control) — C2 infrastructure is the channel an attacker uses to communicate with compromised systems after an intrusion: sending commands, exfiltrating data, and maintaining persistence, usually designed to evade the defensive team's detection.
• CAN Bus — The CAN bus (Controller Area Network) is the internal communication protocol used by most modern vehicles to let their electronic control units, such as the engine, brakes, and airbags, exchange messages. Since it was not designed with authentication or encryption, an attacker with physical or remote access to the CAN network can inject forged messages to manipulate critical vehicle functions.
• Card Skimming — Card skimming involves installing a physical device on an ATM or payment terminal to copy the magnetic stripe or chip data from cards used there.
• Card-Based Access Control — Card-based access control uses RFID or NFC credentials to authorize entry to physical facilities, though it can be vulnerable to signal cloning or interception if proper encryption protocols are not implemented.
• CASB (Cloud Access Security Broker) — A CASB is a security layer positioned between an organization's users and the cloud services they use, applying visibility, access control, data loss prevention and threat detection policies consistently across different SaaS applications. It helps detect the use of shadow IT in the cloud.
• CCN-STIC Guidelines — The CCN-STIC Guidelines are a set of technical documents published by Spain's National Cryptologic Center (CCN) that develop security requirements, procedures, and best practices for public administrations and related entities, serving as a reference for implementing the National Security Framework (ENS).
• CDN (Content Delivery Network) — A CDN (Content Delivery Network) is a distributed network of servers located in different geographic regions that caches a website's content, reducing latency for users and absorbing part of the traffic during demand spikes or denial-of-service attacks.
• Chain of Custody — Chain of custody is the documented, unbroken record of who has had access to a piece of digital evidence and when — a requirement for that evidence to be admissible in a legal or disciplinary proceeding.
• CI/CD Pipeline Injection — CI/CD pipeline injection is a technique that exploits unsanitized inputs (branch names, a pull request title, environment variables) to execute arbitrary commands in the build runner's context, with potential access to secrets and deployment credentials.
• CI/CD Security — CI/CD security means protecting continuous integration and deployment pipelines (runner permissions, secrets management, dependency integrity, artifact signing) against an attacker seeking to compromise the pipeline to inject malicious code into production.
• CIAM (Customer Identity and Access Management) — CIAM (Customer Identity and Access Management) is the discipline and set of tools dedicated to managing the registration, authentication, consent, and access of an organization's external customers, as distinct from identity management focused on internal employees.
• CIS Benchmark — CIS Benchmarks are secure configuration guides published by the Center for Internet Security for operating systems, applications and cloud services, with concrete, verifiable recommendations. They are widely used as a reference for building security baselines and for automated compliance tools.
• CIS Controls — The CIS Controls are a prioritized set of technical and organizational safeguards, developed by the Center for Internet Security, designed to help organizations reduce their attack surface against the most common threats.
• CISO (Chief Information Security Officer) — The CISO (Chief Information Security Officer) is the executive responsible for an organization's cybersecurity strategy, tasked with defining policies, managing risk and coordinating incident response alongside senior leadership.
• Clickjacking — Clickjacking overlays an invisible page on top of a legitimate interface to trick the user into clicking something different from what they see, triggering an unwanted action (a like, a follow, a transfer) without real consent.
• Cloud Misconfiguration — A cloud misconfiguration is a setup error in a cloud service (a public S3 bucket, an open management port, overly broad IAM permissions) that exposes data or access without any software vulnerability involved — the most common cause of cloud data breaches.
• CMMC (Cybersecurity Maturity Model Certification) — CMMC (Cybersecurity Maturity Model Certification) is the US Department of Defense certification framework that verifies, through increasing maturity levels, that supply chain contractors effectively implement the required cybersecurity controls, largely based on NIST SP 800-171.
• CNAPP — CNAPP is a platform that unifies CSPM, CWPP and application security capabilities (such as SCA or IaC scanning) into a single solution, giving end-to-end risk visibility across cloud-native environments, from code to runtime.
• COBIT — COBIT (Control Objectives for Information and Related Technologies) is an IT governance and management framework developed by ISACA that aligns an organization's technology objectives with its business goals and control requirements.
• Command Injection — Command injection happens when an application passes user input to an operating system call without sanitizing it, letting an attacker run arbitrary commands with the same privileges as the vulnerable process.
• Common Criteria (ISO/IEC 15408) — Common Criteria (ISO/IEC 15408) is an international standard for the independent security evaluation of IT products and systems, assigning an Evaluation Assurance Level (EAL) based on the rigor with which their security functions have been verified.
• Configuration Drift — Configuration drift (IaC drift) occurs when the actual state of production infrastructure no longer matches what is defined in the Infrastructure as Code, usually due to manual changes applied outside the pipeline, introducing unaudited and potentially insecure configurations.
• Connected Medical Device Security — Connected medical device security protects equipment such as pacemakers, insulin pumps, or hospital monitors against unauthorized manipulation, since a compromise can directly endanger a patient's health or life, not just data confidentiality. Long device lifecycles and the difficulty of applying patches are characteristic challenges in this area.
• Connected Vehicle Security — Connected vehicle security covers protecting a vehicle's telematics, infotainment, and driver-assistance systems against remote attacks, which can leverage the vehicle cellular, Bluetooth, or Wi-Fi connectivity as an entry point into internal networks such as the CAN bus. It is a growing area given the increasing number of vehicles with permanent internet connectivity.
• Container (Docker) — A Docker container is a software unit that packages an application together with its dependencies and libraries in an isolated environment sharing the host operating system kernel — lighter than a virtual machine, but with its own attack surface (vulnerable images, escapes, daemon misconfiguration).
• Container Escape — A container escape is an exploitation technique that lets an attacker break out of a container's isolated environment and gain access to the host operating system, potentially compromising every other container running on the same host.
• Cookie Consent Management — Cookie consent management is the technical and legal process by which a website informs users and obtains their consent before setting non-essential cookies, in line with the GDPR and electronic communications regulations.
• Coordinated Vulnerability Disclosure (CVD) — Coordinated vulnerability disclosure is the agreed process between a researcher and a vendor to publish a flaw's technical details only after a patch is available, avoiding exposing users while the issue remains unfixed.
• CORS Misconfiguration — A CORS misconfiguration occurs when a web application allows cross-origin requests too permissively (for example, reflecting any origin with credentials enabled), which can let a malicious site read a logged-in user's private data.
• CRA (Cyber Resilience Act) — The Cyber Resilience Act (EU Regulation 2024/2847) requires manufacturers of products with digital elements to build in cybersecurity requirements by design and report actively exploited vulnerabilities to ENISA within 24 hours.
• Credential Dumping — Credential dumping is the process of extracting credentials (passwords, hashes, or tickets) stored in memory, the registry, or databases on a compromised system, usually as a precursor to lateral movement within the network.
• Credential Stuffing — Credential stuffing automatically tests username-password pairs leaked in previous data breaches from other services against a target service, exploiting the fact that many users reuse the same password across platforms.
• Cross-Account Role Abuse — Cross-account role abuse exploits a misconfigured trust relationship between accounts — for example, an IAM role assumable from an external account with broader permissions than necessary — to pivot from a compromised account into another with higher privilege.
• Cross-Chain Bridge — A cross-chain bridge is a protocol that transfers assets or data between two different blockchains, typically by locking the original asset on one chain and minting an equivalent version on the other — their complexity and the often-centralized custody of funds involved make them one of the most heavily targeted components of the crypto ecosystem.
• Crypter — A crypter is a tool that encrypts or obfuscates malware code so its signature no longer matches known samples, with the goal of evading antivirus and EDR detection. It is commonly sold on underground forums as a service to threat actors.
• Crypto Custody (cold/hot wallet) — Crypto custody defines who controls a wallet's private keys: with self-custody (a cold wallet, offline storage) the user bears full responsibility for the key, while with third-party custody (an exchange's hot wallet) the security of the funds depends on the provider's controls.
• Crypto Mixer — A crypto mixer is a service that pools funds from multiple users and redistributes them to obscure the origin of a blockchain transaction, used both for legitimate privacy reasons and to launder funds derived from illicit activity.
• Crypto Wallet Security — Crypto wallet security covers the practices and controls (private key custody, hardware wallets, transaction signature verification, phishing protection) needed to prevent an attacker from taking control of the funds associated with an address.
• Cryptographic Hash Function — A cryptographic hash function transforms an input of any size into a fixed-length output (digest) in a deterministic, irreversible way, and is used to verify data integrity and store passwords securely.
• Cryptojacking — Cryptojacking is the unauthorized use of a victim's computing resources (a server, a browser, a cloud container) to mine cryptocurrency for the attacker's benefit, usually going unnoticed as mere system slowdown.
• CSPM (Cloud Security Posture Management) — CSPM (Cloud Security Posture Management) is a category of tools that continuously assesses a cloud account's configuration against best practices and compliance frameworks, flagging deviations such as excessive permissions or publicly exposed resources.
• CSRF (Cross-Site Request Forgery) — CSRF tricks a victim's authenticated session into having their browser unknowingly perform an unwanted action on a web application (like changing their email or transferring money) simply by visiting a malicious page.
• CVE — A CVE (Common Vulnerabilities and Exposures) is a unique, public identifier assigned to a known vulnerability, letting vendors, researchers and security tools reference the same flaw unambiguously.
• CVSS — CVSS (Common Vulnerability Scoring System) is the industry standard for scoring vulnerability severity from 0 to 10, based on factors like attack complexity, required privileges, and impact on confidentiality, integrity and availability.
• CWE (Common Weakness Enumeration) — CWE is a public taxonomy classifying generic types of software weakness (e.g. "improper neutralization of input"), unlike a CVE, which identifies one specific vulnerability in one specific product.
• CWPP (Cloud Workload Protection Platform) — CWPP (Cloud Workload Protection Platform) is a category of tools focused on protecting individual workloads (virtual machines, containers, serverless functions) through vulnerability detection, runtime behavior monitoring and integrity control.
• Cyber Essentials (UK) — Cyber Essentials is a UK government certification scheme that verifies the implementation of five basic technical controls — firewalls, secure configuration, access control, malware protection, and patch management — to protect organizations against the most common cyberattacks.
• Cybersecurity Product Labeling — Cybersecurity product labeling is a certification or marking system that informs buyers about the security level of a connected device, such as whether it uses default passwords or how long it will receive updates, similar to an energy efficiency label. Its purpose is to give consumers and businesses visibility into the security posture of IoT products before purchase.
• Cybersecurity Risk Analysis — Cybersecurity risk analysis is the process of identifying assets, threats and vulnerabilities to estimate the likelihood and impact of an incident, providing the basis for deciding which controls to implement.
• DAST (Dynamic Application Security Testing) — DAST (Dynamic Application Security Testing) analyzes a running application by sending real requests against it to detect vulnerabilities exploitable from the outside (injections, authentication flaws, exposed configuration) without access to the source code.
• Data Anonymization — Data anonymization is the irreversible process of removing or transforming personal information within a dataset so that no individual can be identified, placing it outside the scope of the GDPR.
• Data Breach — A data breach is any security incident resulting in unauthorized access, disclosure, alteration or loss of data, especially relevant when it affects personal data subject to GDPR.
• Data Controller — A data controller is the natural or legal person that determines the purposes and means of processing personal data, bearing primary responsibility for compliance under the GDPR.
• Data Exfiltration — Data exfiltration is the unauthorized transfer of information from an organization's systems to an external destination controlled by the attacker, typically the final stage of a targeted attack and a key objective to detect in a red team exercise.
• Data Minimization — Data minimization is the GDPR principle requiring an organization to collect and retain only the personal data strictly necessary for the purpose of processing, avoiding the collection of additional information without justification.
• Data Poisoning — Data poisoning involves feeding manipulated data into a model's training set or into the sources it retrieves from (including content in RAG systems), aiming to skew its behavior or plant a backdoor.
• Data Processor — A data processor is the natural or legal person that processes personal data on behalf of the data controller, following its instructions under a contract that sets out the terms of processing, as required by the GDPR.
• Data Protection Impact Assessment (DPIA) — A Data Protection Impact Assessment (DPIA) is an analysis required under the GDPR for data processing likely to result in a high risk to individuals' rights, identifying measures to mitigate that risk.
• DCSync Attack — DCSync is an attack technique that abuses Active Directory replication permissions to impersonate a domain controller and directly request the password hashes of any account, including administrator accounts, without needing to execute code on the controller itself.
• DDoS (Distributed Denial of Service) — A DDoS attack floods a service's resources or bandwidth with traffic from many distributed systems (often a botnet) to make it unreachable for legitimate users.
• Debug Mode Enabled in Production — Debug mode enabled in production occurs when an application keeps diagnostic features meant for development active in its live environment, such as detailed error traces, interactive consoles or test endpoints. It can reveal internal paths and software versions, and in some frameworks allow code execution.
• Deception Technology — Deception technology is a defensive approach that deploys decoys, fake credentials and fictitious assets across the network to lure and detect an attacker who has already gained internal access. Any interaction with these elements is by definition illegitimate and triggers a high-confidence alert.
• Deepfake Fraud — Deepfake fraud involves using AI-generated or manipulated audio or video to impersonate a real person's voice or likeness (for example, an executive) to trick the victim into authorizing a payment or disclosing confidential information.
• Default IoT Credentials — Default IoT credentials are the factory-preset usernames and passwords on a connected device, which many manufacturers do not force users to change during setup. Their widespread use enables attackers to gain mass, automated access through internet scanning, and is one of the leading causes behind large IoT botnets.
• Defense in Depth — Defense in depth is the strategy of layering several independent security controls (network, endpoint, identity, application, data) so that a single layer failing doesn't compromise the whole system.
• DeFi Security — DeFi (decentralized finance) security covers the risks specific to financial protocols built on smart contracts — price oracle manipulation, flash loan attacks, flaws in liquidity pool logic — which, combined with the public exposure of the code, make them high-value targets.
• Dependency Confusion — Dependency confusion is a supply chain attack technique that exploits the fact that a package manager may resolve an internal dependency with a matching name from a public registry instead, causing the build to inadvertently install a malicious package the attacker published with a higher version number.
• Detection Engineering — Detection engineering is the discipline of systematically designing, building and maintaining a SOC's detection rules and logic, based on threat intelligence and frameworks such as MITRE ATT&CK, rather than relying solely on a product's out-of-the-box signatures. It includes testing and tuning each rule to reduce false positives without losing coverage.
• Device/Browser Fingerprinting — Fingerprinting is a tracking technique that identifies and follows a user by combining characteristics of their device and browser, such as screen resolution or installed fonts, without needing to set cookies.
• DevSecOps — DevSecOps is the approach that embeds automated security controls into every stage of the software development lifecycle (code, build, deployment, operation), rather than treating it as a separate review at the end of the process.
• DHCP Spoofing — DHCP spoofing is an attack in which an actor deploys a rogue DHCP server on the network to respond to clients' configuration requests before the legitimate one does, potentially assigning them a malicious gateway or DNS server.
• Differential Privacy — Differential privacy is a mathematical technique that adds controlled noise to the results of a data analysis to prevent inferring information about a specific individual, without significantly affecting the statistical utility of the dataset.
• Digital Certificate — A digital certificate is an electronic document issued by a certificate authority (CA) that binds a public key to the identity of its holder, allowing that identity to be verified and encrypted communications to be established.
• Digital Forensics — Digital forensics technically reconstructs, with legal validity, exactly what happened during a security incident: which systems were affected, how the attacker got in, and what data was compromised.
• Digital Identity Theft — Digital identity theft is the fraudulent use of a person's personal data or credentials, typically obtained through phishing or data breaches, to impersonate them and commit fraud in their name.
• Digital Markets Act (DMA) — The Digital Markets Act (DMA) is the European Union regulation imposing specific obligations on large digital platforms designated as "gatekeepers," aiming to ensure fairer and more contestable digital markets.
• Digital Services Act (DSA) — The Digital Services Act (DSA) is the European Union regulation governing the obligations of digital platforms and services regarding content moderation, algorithmic transparency, and user protection against illegal content.
• Digital Signature — A digital signature is a cryptographic mechanism based on asymmetric keys that allows the authenticity of a message or document to be verified and confirms it has not been altered, while also providing non-repudiation of origin for the signer.
• DLL Hijacking — DLL hijacking involves tricking an application into loading a malicious dynamic-link library (DLL) instead of the legitimate one, exploiting the system's path search order, in order to execute arbitrary code with the privileges of the affected process.
• DLP (Data Loss Prevention) — DLP policies detect and block unauthorized exfiltration of sensitive data from an organization — via email, cloud storage or third-party integrations — before a leak occurs.
• DMARC, SPF and DKIM — SPF, DKIM and DMARC are the three standards that authenticate email and prevent a company's domain from being spoofed: SPF authorizes which servers can send on its behalf, DKIM cryptographically signs messages, and DMARC defines what to do with mail that fails those checks.
• DMZ (Demilitarized Zone) — A DMZ (demilitarized zone) is an isolated network segment placed between the internal network and an untrusted network such as the Internet, where services that must be externally accessible (such as web or mail servers) are hosted to limit the impact if they are compromised.
• DNP3 Protocol — DNP3 (Distributed Network Protocol) is a communication protocol used mainly in the electric utility sector to exchange data between SCADA systems and field devices. Versions without the Secure Authentication extensions lack robust authentication, exposing them to spoofing or command injection attacks.
• DNS — DNS (Domain Name System) is the hierarchical, distributed system that translates human-readable domain names into the IP addresses that devices use to locate each other on the network.
• DNS Amplification Attack — A DNS amplification attack is a type of distributed denial-of-service (DDoS) attack in which the attacker sends DNS queries with the victim's spoofed IP address to open DNS resolvers, causing them to send responses far larger than the original query toward the victim.
• DNS Spoofing / Cache Poisoning — DNS spoofing poisons a DNS server's responses so a legitimate domain resolves to a malicious IP address controlled by the attacker, redirecting victims without them ever changing the URL they typed.
• DNS Tunneling — DNS tunneling is a technique that encapsulates data from other protocols within DNS queries and responses, exploiting the fact that this traffic is usually permitted through firewalls, to exfiltrate information or establish a covert command-and-control channel.
• DNSSEC — DNSSEC (Domain Name System Security Extensions) is a set of extensions to the DNS protocol that adds cryptographic signatures to responses, allowing their authenticity and integrity to be verified and preventing manipulation attacks such as DNS cache poisoning.
• DORA — DORA (EU Regulation 2022/2554) requires European financial entities to manage ICT risk, report incidents, and — for entities designated as critical — run TLPT operational resilience tests every 3 years.
• Double Extortion — Double extortion is a ransomware tactic in which, in addition to encrypting the victim's files, attackers exfiltrate sensitive data before encryption and threaten to publish it if the ransom is not paid. This pressures the victim even when backups are available to restore the systems.
• Doxing — Doxing consists of researching and publishing a person's private information, such as their home address or phone number, without their consent and with the intent to harass, intimidate or publicly expose them.
• DPO (Data Protection Officer) — The DPO (Data Protection Officer) is the role, mandatory in certain cases under the GDPR, responsible for overseeing regulatory compliance in data protection and acting as the point of contact with supervisory authorities.
• Dropper — A dropper is a malware component whose sole purpose is to install or download the actual malicious payload onto the compromised system, often evading security controls by posing as a harmless file. Once executed, it delivers the payload and may delete itself to hinder forensic analysis.
• Dumpster Diving — Dumpster diving is the practice of examining an organization's discarded trash or paperwork in search of sensitive information, such as internal documents, credentials or network diagrams.
• EASM (External Attack Surface Management) — EASM is a discipline and category of tools that continuously discovers and monitors an organization's internet-facing assets, including those unknown to its own IT team, such as forgotten subdomains or misconfigured cloud services. Its purpose is to keep an up-to-date inventory of what an attacker would see from the outside.
• Edge Computing Security — Edge computing security protects the devices and processing nodes located close to the data source, outside the central data center or cloud, where physical and network controls are typically weaker than in a centralized environment. The geographic distribution and heterogeneity of these nodes expand the attack surface compared to a traditional centralized model.
• EDR (Endpoint Detection and Response) — An EDR is a tool that monitors endpoint behavior in real time to detect malicious activity that a traditional signature-based antivirus would miss.
• eIDAS Regulation — The eIDAS Regulation (EU 910/2014) sets the European legal framework for electronic identification and trust services — such as electronic signatures, timestamps, or website certificates — ensuring their legal recognition and cross-border validity across the European Union.
• Elliptic Curve Cryptography (ECC) — Elliptic curve cryptography (ECC) is a type of asymmetric cryptography based on the mathematical properties of elliptic curves, which achieves security levels equivalent to RSA with smaller key sizes, reducing computational cost.
• Encryption at Rest and in Transit — Encryption at rest protects data stored on disks, databases or backups, while encryption in transit protects data as it moves across the network (for example, via TLS); both are necessary for comprehensive data protection.
• End-to-End Encryption (E2EE) — End-to-end encryption (E2EE) ensures that only the sender and receiver of a communication can read its content, since data is encrypted on the originating device and decrypted only on the destination device, with no intermediary such as the service provider able to access it.
• ENS (National Security Framework) — The ENS is the Spanish regulatory framework (Royal Decree 311/2022) governing information system security for public administrations and their providers, with three requirement levels: basic, medium and high.
• Enumeration — Enumeration is the pentesting phase in which detailed information is extracted from already-identified target systems — users, services, shared resources, or software versions — to locate exploitable entry points in later phases.
• EPSS — EPSS (Exploit Prediction Scoring System) estimates, as a 0-100% probability, the likelihood that a specific vulnerability will be actively exploited in the next 30 days — complementing CVSS, which measures severity but not real exploitation likelihood.
• Ethical Hacker — An ethical hacker uses the same techniques as a malicious attacker, but with the explicit authorization of the system owner, aiming to detect and remediate security weaknesses.
• Evil Twin (rogue Wi-Fi network) — An evil twin is a fake Wi-Fi access point set up by an attacker to mimic the network name (SSID) of a legitimate one, aiming to trick users into connecting to it so their credentials or traffic can be intercepted.
• Excessive Agency — Excessive agency is a vulnerability in which an LLM-based system is granted permissions, functions, or autonomy beyond what its task requires, allowing a manipulated or erroneous model response to trigger unintended, harmful actions.
• Explainable AI (XAI) — Explainable AI (XAI) is the set of techniques and design principles that make it possible to understand and interpret how an AI model arrives at a given decision — key for auditing bias, detecting anomalous behavior, and meeting regulatory transparency requirements.
• Exposed API Key — An exposed API key is a service authentication credential that becomes unintentionally accessible, for example in a public code repository, a decompiled mobile app or a website's source code. Its discovery lets third parties consume the service on the organization's behalf or access the data it protects.
• Exposed JTAG Debug Port — An exposed JTAG debug port allows an attacker with physical access to a device to interact directly with its hardware, extracting firmware, memory or keys without going through software-level protections.
• False Positive / False Negative — A false positive is a finding reported as a vulnerability that isn't actually one; a false negative is a real vulnerability a tool or analysis fails to catch — both are the core reason automated scanning never replaces manual penetration testing.
• Faraday Cage — A Faraday cage is a metal enclosure that blocks external electromagnetic signals, used in security to isolate devices during forensic analysis or to prevent signal leakage in sensitive areas.
• FedRAMP — FedRAMP (Federal Risk and Authorization Management Program) is the US government program that standardizes the security assessment, authorization and continuous monitoring of cloud services used by federal agencies.
• Fileless Malware — Fileless malware runs directly in memory or abuses legitimate system tools, such as PowerShell or WMI, without writing a malicious file to disk, making it harder for traditional file-based antivirus solutions to detect. It is typically identified through EDR and behavioral monitoring.
• Fine-Tuning Risk — Fine-tuning risk includes the introduction of biases or vulnerabilities through contaminated or low-quality tuning datasets, the potential leakage of sensitive data used in retraining, and the degradation of the base model's original safety measures.
• FIPS 140-2 / 140-3 — FIPS 140-2 and its successor FIPS 140-3 are US government standards specifying the security requirements for cryptographic hardware and software modules, commonly required in public procurement and in regulated sectors handling sensitive information.
• Firewall — A firewall is a hardware or software security system that controls inbound and outbound network traffic by applying predefined rules, allowing or blocking connections based on criteria such as source, destination, port or protocol.
• Firmware Security — Firmware security focuses on protecting the low-level software embedded in a device's hardware, such as routers, IP cameras, or PLCs, against tampering or exploitation, since compromised firmware can give an attacker persistence and full control over the device, surviving even a factory reset. It includes practices such as firmware signing and secure boot.
• Flash Loan Attack — A flash loan attack exploits an uncollateralized loan that is borrowed and repaid within a single transaction to temporarily manipulate an asset's price in a DeFi protocol (for example, in an oracle or liquidity pool) and extract profit before the transaction completes.
• Footprinting — Footprinting is the technique of systematically gathering information about a target organization — domains, IP addresses, infrastructure, employees, or technologies in use — used in the early stages of a pentest or a real attack to build a detailed profile.
• Format String Attack — A format string attack exploits functions that accept user-controlled format strings (such as printf in C) without proper validation, allowing arbitrary memory to be read or written and, in some cases, enabling code execution.
• Formjacking — Formjacking involves injecting malicious code into the payment forms of a legitimate website (typically e-commerce) to capture, in real time, the card and personal data users enter.
• Foundation Model — A foundation model is a large-scale artificial intelligence model, trained on vast amounts of general-purpose data, that serves as a base to be adapted through fine-tuning or prompting to multiple downstream tasks and applications.
• Fuzzing — Fuzzing is a security testing technique that automatically sends large volumes of malformed, unexpected, or random data to an application or system to trigger crashes, failures, or anomalous behavior that reveal exploitable vulnerabilities.
• Gap Analysis — A gap analysis compares an organization's current security posture against the level required by a reference standard or regulation, identifying the shortfalls that must be closed to achieve compliance.
• GDPR — The General Data Protection Regulation governs personal data processing in the EU, requiring clear legal bases, security measures proportionate to risk, and data breach notification within 72 hours.
• Get Out of Jail Free Letter — The Get Out of Jail Free Letter is the legal document signed by the client that explicitly authorizes the pentesting or red team to carry out the agreed tests, protecting the professionals from potential legal implications during the exercise.
• Golden Image — A golden image is a pre-configured, hardened and validated virtual machine or container template used as the standard base for deploying new instances, ensuring a consistent security configuration across the environment.
• Golden Ticket Attack — A Golden Ticket is an attack against Kerberos in Active Directory in which the attacker, after compromising the krbtgt account, forges ticket-granting tickets (TGTs) to gain unlimited, persistent access to any resource in the domain by impersonating any user.
• GraphQL Vulnerabilities — GraphQL vulnerabilities cover flaws specific to this API style, such as unbounded nested queries, introspection left enabled in production, field-level authorization gaps, or data exposure through poorly controlled batched queries.
• GRC Analyst — A GRC (Governance, Risk and Compliance) analyst assesses an organization's regulatory compliance, maintains risk registers and coordinates internal and external audits.
• Hacktivist — A hacktivist uses hacking techniques to advance a political, social or ideological cause, typically targeting websites or systems of organizations or governments as a form of protest.
• Hall of Fame (bug bounty) — The Hall of Fame is a public listing that recognizes researchers who have reported valid vulnerabilities in a bug bounty program, without necessarily implying a financial reward.
• Hardcoded Credentials — Hardcoded credentials are usernames, passwords, tokens or cryptographic keys written directly into source code instead of being managed through a secrets store. They remain exposed to anyone with access to the repository, including its version history, even after being removed in a later commit.
• Hardening — Hardening is the set of configuration measures that reduce a system's attack surface — disabling unnecessary services, applying least privilege, updating components — before an attacker can exploit it.
• Hash Collision — A hash collision occurs when two different inputs produce the same output value from a hash function, which can compromise the security of systems that rely on each input producing a unique result, such as integrity verification or digital signatures.
• HIPAA — HIPAA (Health Insurance Portability and Accountability Act) is the 1996 US federal law that sets the standards for protecting patient health information, applicable to healthcare providers, insurers and their business associates.
• HMAC — HMAC (Hash-based Message Authentication Code) is a mechanism that combines a hash function with a secret key to generate a code that verifies both the integrity of a message and the authenticity of its origin.
• HMI (Human-Machine Interface) — An HMI (Human-Machine Interface) is the panel or software through which an operator monitors and controls an industrial process, displaying sensor data and allowing commands to be sent to PLCs or other equipment. Compromising it lets an attacker directly manipulate the operator view and control of the process, making it a critical target in ICS environments.
• Homomorphic Encryption — Homomorphic encryption is a cryptographic technique that allows mathematical operations to be performed directly on encrypted data, producing a result that, once decrypted, matches what would be obtained by operating on the original unencrypted data.
• Honeypot — A honeypot is a deliberately exposed and monitored decoy system that mimics a real asset to lure an attacker in, study their techniques, and trigger early alerts without putting production infrastructure at risk.
• Honeytoken — A honeytoken is a decoy piece of data or credential, such as a fake database user or an attractively named file, placed in a system with no intended legitimate use. Any attempt to access or use that data reliably reveals the presence of an attacker.
• Host Header Injection — Host header injection is an attack in which the HTTP Host header is manipulated to trick the application in tasks such as link generation, cache poisoning, or bypassing security controls that blindly trust that value.
• HSM (Hardware Security Module) — An HSM (Hardware Security Module) is a dedicated physical device used to generate, store and protect cryptographic keys, as well as to perform encryption and signing operations within an isolated, tamper-resistant environment.
• HTTP Request Smuggling — HTTP request smuggling exploits differences in how a proxy or load balancer and the backend server interpret the same HTTP request, allowing an attacker to smuggle a hidden second request that gets processed in another victim's context.
• Human in the Loop — Human in the Loop is an AI system design principle requiring a person's oversight or approval before executing critical or irreversible decisions generated by the model, reducing the risk of errors, hallucinations, or unwanted actions.
• IAM (Identity and Access Management) — IAM is the discipline and toolset that manages who each user is, what credentials they hold, and what resources they can access within an organization — the foundation on which least privilege and every other access control is applied.
• ICS Security — ICS (Industrial Control Systems) security covers the practices and controls aimed at protecting environments that manage industrial and critical infrastructure processes, where availability and physical safety are usually prioritized over confidentiality. It requires specific approaches because many ICS devices cannot support frequent patching or conventional security tooling.
• Identity Federation — Identity federation is a model in which multiple organizations or systems trust a common identity provider to authenticate users, allowing them to access different applications with a single identity without needing separate credentials for each one.
• Identity Provider (IdP) — An identity provider (IdP) is the system responsible for authenticating users and issuing the assertions or tokens that other applications (service providers) accept as proof of identity, acting as the central piece in single sign-on architectures.
• IDOR (Insecure Direct Object Reference) — An IDOR occurs when an application exposes a direct reference to an internal object (a file ID, an order number) without verifying the user is authorized to access that specific object, allowing access to other users' data by changing the identifier in the request.
• IDS/IPS — An IDS (Intrusion Detection System) monitors network traffic or system activity to detect malicious patterns and generate alerts, while an IPS (Intrusion Prevention System) adds the ability to actively block those threats in real time.
• IIoT (Industrial Internet of Things) — IIoT (Industrial Internet of Things) refers to the use of connected devices, sensors, and data analytics in industrial settings to optimize production processes, predictive maintenance, and remote monitoring. Its connectivity to IT networks and the cloud introduces security risks that traditionally did not exist in isolated OT systems.
• Immutable Backups — Immutable backups are backup copies that, once written, cannot be modified or deleted for a defined period, not even by an account with administrative privileges. This property protects them against an attacker who, after compromising credentials, tries to destroy the copies to force a ransom payment.
• Immutable Infrastructure — Immutable infrastructure is a pattern in which servers or containers are never modified after deployment — any change means building and deploying a new instance from scratch — which reduces configuration drift and makes it harder for an attacker to persist after a compromise.
• Improper Error Handling — Improper error handling occurs when an application returns overly detailed error messages, such as stack traces, SQL queries or system paths, instead of generic responses to the user. That information helps an attacker understand the internal architecture and prepare more precise attacks.
• Incident Responder — An incident responder investigates, contains and remediates active security breaches, coordinating system recovery and the collection of forensic evidence.
• Incident Response — Incident response is the structured process — identification, containment, eradication, recovery and lessons learned — an organization follows to manage an ongoing cyberattack and minimize its impact.
• Incident Response Playbook — An incident response playbook is an operational document that defines, step by step, the actions to follow for a specific type of security incident, such as ransomware or a data breach, including roles, escalation criteria and communications. Its goal is to reduce reaction time and avoid improvised decisions under pressure.
• Indirect Prompt Injection — Indirect prompt injection is a variant of prompt injection in which the malicious instructions are not typed by the user but hidden in external content the LLM processes — a web page, a document, or an email — manipulating the model's behavior without direct interaction from the attacker.
• Information Security Policy — An information security policy is the high-level document that sets out an organization's principles, objectives and responsibilities for protecting information, serving as the framework for its technical standards and procedures.
• Informed Consent (GDPR) — Under the GDPR, informed consent is a freely given, specific, informed and unambiguous indication by which a person agrees to the processing of their personal data for a particular purpose, and must be as easy to withdraw as to give.
• Infostealer — An infostealer is malware specialized in stealing credentials, session cookies, credit card data, and other sensitive information stored in the browser or in system applications, sending it to a server controlled by the attacker. Stolen credentials are commonly resold on dark web marketplaces.
• Infrastructure as Code (IaC) — Infrastructure as Code (IaC) is the practice of defining and managing infrastructure (servers, networks, policies) through versioned configuration files (Terraform, CloudFormation, Pulumi) instead of manual setup — it allows the environment to be audited, reviewed and reproduced just like application code.
• Insecure Default Configuration — An insecure default configuration is the out-of-the-box setup of a system, service or device that lacks necessary security settings, such as preset credentials, open ports or disabled encryption. If it is not reviewed and hardened before going into production, it gives an attacker an immediate entry vector.
• Insecure Deserialization — Insecure deserialization happens when an application rebuilds objects from untrusted data without validating it, letting an attacker manipulate that flow to execute arbitrary code or tamper with the program's internal logic.
• Insecure File Upload — Insecure file upload is a feature that allows a user to upload files to the server without properly restricting their type, content or storage location. An attacker can abuse it to upload an executable script and achieve remote code execution.
• Insecure Output Handling — Insecure output handling occurs when a language model's response is passed directly to another system — a browser, code interpreter, or database — without validation or sanitization, which can lead to code execution, XSS, or SQL injection.
• Insider Threat — An insider threat is the risk posed by someone with legitimate access to an organization's systems — an employee, a vendor, a former employee — who, intentionally or through negligence, compromises security or leaks information from within.
• Insufficient Input Validation — Insufficient input validation occurs when an application fails to properly check, filter or sanitize data received from a user or external system before processing it. It is the root cause of many vulnerabilities, including SQL injection, cross-site scripting and buffer overflows.
• Integer Overflow — An integer overflow occurs when an arithmetic operation produces a value that exceeds the range representable by its data type, causing the result to wrap around unexpectedly; this can lead to logic errors or exploitable vulnerabilities such as buffer overflows.
• Internal vs. External Audit — An internal audit is performed by an organization's own staff to continuously evaluate its controls, while an external audit is carried out by an independent third party, typically required for certifications or regulatory compliance.
• International Data Transfer — An international data transfer is the sending of personal data to a country outside the European Economic Area, which the GDPR only permits when the destination has an adequacy decision or appropriate safeguards, such as Standard Contractual Clauses, are in place.
• IOC (Indicator of Compromise) — An IOC is forensic evidence that a system may be compromised — a malicious file hash, a C2 IP address, an anomalous registry entry — used by defensive teams to detect and hunt active intrusions.
• IoT Botnet — An IoT botnet is a network of internet-connected devices, such as cameras, routers, or video recorders, infected with malware and remotely controlled by an attacker, typically to launch large-scale distributed denial-of-service (DDoS) attacks. Its proliferation is largely driven by the use of default credentials and unpatched firmware.
• IoT Network Segmentation — IoT network segmentation involves isolating connected devices on separate networks or VLANs from critical systems and the main corporate network, limiting the impact if one of them is compromised. It is one of the most effective mitigation measures, since many IoT devices cannot support advanced host-level security controls.
• IoT Security — IoT security is the discipline of protecting internet-connected devices, such as sensors, cameras, wearables, and smart appliances, and the networks they connect to, against attacks that exploit their limited hardware, firmware, or communication protocols. It is a particularly complex challenge due to device heterogeneity and the lack of computing capacity to implement traditional security controls.
• ISMS (Information Security Management System) — An ISMS (Information Security Management System) is the framework of policies, processes and controls defined in the ISO/IEC 27001 standard for systematically managing an organization's information security risks.
• ISO 22301 (Business Continuity) — ISO 22301 is the certifiable international standard that specifies the requirements for implementing, maintaining and improving a business continuity management system, ensuring an organization can keep operating through major disruptions.
• ISO 27001 — ISO 27001 is the international reference standard for implementing an Information Security Management System (ISMS), certifiable through external audit.
• ISO 27001 Lead Auditor — An ISO 27001 Lead Auditor is a professional certified to lead audits of an organization's information security management system against the requirements of the ISO/IEC 27001 standard.
• ISO 27002 — ISO 27002 is an international standard providing guidelines and best practices for implementing the information security controls defined in Annex A of ISO 27001, serving as a practical reference for applying them within an organization.
• ISO 27017 and ISO 27018 — ISO 27017 and ISO 27018 are standards that complement ISO 27001 for cloud environments: the former defines security controls specific to cloud service providers and customers, while the latter sets out guidelines for protecting personal data (PII) in cloud computing.
• ISO 27701 (Privacy Information Management) — ISO 27701 is an extension of ISO 27001 that adds the requirements for implementing a Privacy Information Management System (PIMS), helping organizations demonstrate compliance with data protection regulations such as the GDPR.
• ISO 31000 — ISO 31000 is the international standard that sets out generic principles and guidelines for risk management, applicable to any type of organization or sector, though unlike ISO 27001 it is not certifiable.
• ISO 42001 (AI Management System) — ISO 42001 is the first internationally certifiable standard defining the requirements for implementing an AI Management System (AIMS), establishing controls over the lifecycle, risks, and responsible use of AI systems within an organization.
• Just-In-Time (JIT) Access — Just-in-time (JIT) access is a privilege management model in which elevated permissions are granted to a user only for the time strictly needed to complete a specific task, being automatically revoked afterward instead of remaining permanently active.
• JWT (JSON Web Token) — A JWT is a compact, digitally signed token that securely carries information about a user's identity and permissions between a client and a server, widely used in API authentication — a poorly validated JWT or one signed with a weak secret is a common critical vulnerability.
• Kerberoasting — Kerberoasting is a technique that abuses the Kerberos protocol to request service tickets for accounts with an associated Service Principal Name (SPN) and then subjects their hash to offline brute-force cracking, aiming to recover the plaintext password of those service accounts.
• KEV (Known Exploited Vulnerabilities) — The KEV catalog, published by CISA, lists vulnerabilities confirmed as actively exploited in the wild — a more urgent patching-priority signal than the CVSS score alone.
• Key Management — Key management encompasses the processes of generating, distributing, storing, rotating and revoking cryptographic keys throughout their lifecycle, and is a critical factor in the security of any system that relies on encryption.
• Keylogger — A keylogger is software or hardware that secretly records every keystroke a victim makes, commonly used to steal passwords, banking details, or private conversations.
• Kill Chain — The Kill Chain is a model describing the sequential phases of a cyberattack — reconnaissance, weaponization, delivery, exploitation, installation, C2 and actions on objectives — used to understand and break the attack as early as possible.
• KRIs and KPIs — Security KRIs (key risk indicators) and KPIs (key performance indicators) are metrics that let an organization monitor its risk exposure and the effectiveness of its controls, supporting decision-making and reporting to leadership.
• Kubernetes Security — Kubernetes security covers the controls (RBAC, network policies, pod security standards, secrets management, API server hardening) needed to prevent a misconfigured cluster from allowing lateral movement, privilege escalation or workload exposure across namespaces.
• Lateral movement — Lateral movement is the phase of an attack where, after compromising a first system, the attacker moves toward other systems on the internal network in search of higher privileges or the attack's final objective.
• LDAP Injection — LDAP injection consists of manipulating a query to an LDAP directory by inserting unexpected characters or filters through an unvalidated input field, in order to alter the search or authentication logic. It can allow an attacker to bypass access controls or extract information from the corporate directory.
• Least Privilege — The principle of least privilege states that every user, service or process should only have the permissions strictly necessary for its function, never more — drastically limiting the potential damage if that account or system is compromised.
• LFI / RFI (Local/Remote File Inclusion) — LFI and RFI let an attacker force an application to include and execute unintended files: local ones already on the server (LFI) or hosted on an external server (RFI), often leading to sensitive file disclosure or remote code execution.
• Living off the Land (LOLBins) — Living off the land describes the tactic of using legitimate tools already present on the operating system (PowerShell, WMI, certutil) to carry out an attack instead of dropping custom malware, making signature-based detection far harder.
• LLM Denial of Service — LLM denial of service is an attack aimed at exhausting a language model's computational resources or context window — through extremely long or repetitive inputs — to degrade its performance, inflate its operating cost, or render it unusable.
• LLM Firewall — An LLM firewall is a security layer placed between users or applications and a language model, inspecting and filtering inputs and outputs in real time to block prompt injection attempts, sensitive data leakage, or off-policy responses.
• LLM Jailbreak — An LLM jailbreak is a prompt injection technique specifically designed to bypass a model's safety and content filters, getting it to generate responses its creators explicitly tried to block.
• Log Retention and Correlation — Log retention and correlation is the practice of keeping event records from different systems for a defined period and analyzing them together to reconstruct the full sequence of an incident. Without sufficient retention, the forensic investigation of an attack can be limited to what happened in the last few days.
• Logic Bomb — A logic bomb is a piece of malicious code inserted into a legitimate program or system that remains dormant until a specific condition is met, such as a particular date, a user action, or the absence of a periodic signal, at which point it triggers its damaging action. It is a common technique in insider sabotage by current or former employees.
• LOPDGDD (Spanish Data Protection Act) — The LOPDGDD (Organic Law 3/2018) is the Spanish law that develops and complements the GDPR, adding specific safeguards such as workers' digital rights and adapting the penalty regime to the national legal framework.
• Malvertising — Malvertising involves injecting malicious code into legitimate ads distributed through advertising networks, so the user is infected or redirected to a malicious site simply by viewing or interacting with the ad on an otherwise trusted website. It does not require the website itself to be compromised.
• Malware Analyst — A malware analyst examines malicious software samples through reverse engineering to understand their behavior, origin and impact, producing indicators of compromise and mitigation measures.
• Malware Loader — A loader is malware similar to a dropper, but instead of containing the payload, it downloads it from a remote server at execution time, allowing the attacker to change the final payload without modifying the initial file. It is common as the first stage in modular infection chains.
• Man-in-the-Middle (MITM) — A Man-in-the-Middle attack intercepts communication between two parties who believe they're talking directly to each other, letting the attacker read, modify or inject traffic without either side noticing.
• Manual vs. Automated Exploitation — Manual vs. automated exploitation distinguishes between vulnerability verification performed by an expert pentester, capable of chaining flaws and avoiding false positives, and the use of automated tools that scale detection but require human validation to confirm real-world impact.
• Mass Assignment — Mass assignment is a vulnerability that occurs when an application automatically binds parameters received in a request to the fields of an internal object or model, allowing an attacker to modify fields they should not control, such as their own user role.
• MCP (Model Context Protocol) Security — MCP (Model Context Protocol) security addresses the risks of connecting an LLM to external tools and data sources through this standard, including authenticating MCP servers, controlling per-tool permissions, and preventing attacks such as tool poisoning.
• MCP Tool Poisoning — MCP tool poisoning is an attack in which the instructions or metadata of a tool exposed through the Model Context Protocol are manipulated to induce the LLM to perform malicious actions or hide unauthorized behavior from the user.
• MDR (Managed Detection and Response) — MDR is a service in which an external provider continuously operates an organization's threat detection and incident response capabilities, combining technology with human analysts who investigate and contain alerts. It is typically chosen when a company lacks its own SOC with 24/7 coverage.
• Membership Inference Attack — A membership inference attack attempts to determine whether a specific record was part of an AI model's training dataset by analyzing differences in the model's behavior or confidence toward that input, potentially violating the privacy of the individuals whose data was used.
• MFA / 2FA — Multi-factor (MFA) or two-factor authentication (2FA) requires, in addition to the password, a second verification factor (an app, a security key, a one-time code) to sign in, drastically reducing the impact of a stolen or leaked password.
• MFA Fatigue / Push Bombing — MFA fatigue (or push bombing) is a technique in which the attacker, after obtaining the victim's password, repeatedly sends multi-factor authentication push notifications hoping the victim will eventually approve one out of mistake or annoyance, granting access to the account.
• MiCA Regulation — The MiCA Regulation (Markets in Crypto-Assets) is the European Union framework governing the issuance, provision of services, and supervision of crypto-assets, establishing security, transparency, and investor protection requirements applicable to exchanges, stablecoin issuers, and other crypto-asset service providers.
• Microsegmentation — Microsegmentation divides the internal network into small, isolated zones, applying specific access policies between individual workloads instead of relying on a single perimeter. Its goal is to limit lateral movement by an attacker who manages to compromise one system.
• Misconfigured HTTP Security Headers — Misconfigured HTTP security headers are missing or incorrect values for headers such as Content-Security-Policy, Strict-Transport-Security or X-Frame-Options, which leave a website's users exposed to attacks like clickjacking, cross-site scripting or downgrade to unencrypted HTTP. Reviewing them is one of the quickest controls to apply during a web audit.
• MITRE ATT&CK — MITRE ATT&CK is a public knowledge base cataloging real tactics, techniques and procedures (TTPs) used by attackers, widely used as a common reference for designing Red Team exercises and detection rules.
• Modbus Protocol — Modbus is an industrial communication protocol, widely used in SCADA and automation environments, that enables data exchange between PLCs, sensors, and control systems. Because it lacks native authentication or encryption mechanisms, it is vulnerable to spoofing, command manipulation, or traffic interception unless protected through additional network segmentation.
• Model Extraction — Model extraction is the technique by which an attacker reconstructs or clones a proprietary AI model by observing only its responses through the public API, without direct access to its weights or internal architecture.
• Model Inversion — Model inversion is an attack technique that, from an AI model's outputs, approximately reconstructs the original input data used to train or query it, potentially revealing sensitive information such as images or personal attributes.
• MTTD and MTTR — MTTD (mean time to detect) and MTTR (mean time to respond) are metrics that measure, respectively, how long an organization takes to detect a security incident after it occurs and how long it takes to contain and resolve it once detected. They are used to track the maturity of detection and response capabilities over time.
• Multi-Cloud Strategy — A multi-cloud strategy distributes workloads across several cloud providers (AWS, Azure, GCP) to avoid single-vendor dependency, which from a security standpoint means duplicating and harmonizing identity, network and monitoring controls across each platform.
• N-Day Vulnerability — An N-day vulnerability is a security flaw that is already publicly known and for which a vendor patch exists, but which remains exploitable on systems that have not yet applied it. It differs from a zero-day precisely in that a fix is already available.
• NAC (Network Access Control) — NAC (Network Access Control) is a set of technologies that verifies a device's identity and security posture (patch level, antivirus, configuration) before allowing it to connect to the network, applying access policies based on the result.
• NAT — NAT (Network Address Translation) is a technique that translates private IP addresses into one or more public IP addresses as traffic crosses a router or firewall, allowing multiple devices to share a single public address to reach the Internet.
• National Interoperability Framework (ENI) — The National Interoperability Framework (ENI) is the Spanish regulation that sets criteria and recommendations to ensure secure and effective information exchange between public administrations, complementing the National Security Framework (ENS) in the area of interoperability.
• NDR (Network Detection and Response) — NDR is a category of solutions that analyzes network traffic, including encrypted traffic via metadata, to detect malicious behavior and coordinate an automated or guided response. It provides visibility into network segments where endpoint agents are not always installed.
• Network Segmentation — Network segmentation involves dividing an infrastructure into isolated subnetworks or zones using VLANs, firewalls or access control lists, with the goal of limiting an attacker's lateral movement and reducing the exposure surface of critical systems.
• Next-Generation Firewall (NGFW) — A next-generation firewall (NGFW) is a firewall that, beyond traditional port and protocol filtering, incorporates deep packet inspection, application identification, intrusion prevention and encrypted traffic analysis capabilities.
• NFT Fraud — NFT fraud includes techniques such as selling counterfeit collections that imitate legitimate projects, wash trading to artificially inflate an asset's price, or using malicious metadata and contracts that grant the attacker control over the NFT or the buyer's wallet.
• NIS2 — NIS2 (EU Directive 2022/2555) is the European regulation requiring essential and important entities across 18 sectors to implement risk management measures, report incidents and ensure service continuity, with fines up to €10M or 2% of global turnover.
• NIST AI Risk Management Framework — The NIST AI Risk Management Framework is a voluntary guide from the US NIST that helps organizations identify, measure, and manage the risks associated with designing, developing, and deploying AI systems, structured around the Govern, Map, Measure, and Manage functions.
• NIST Cybersecurity Framework (CSF) — The NIST Cybersecurity Framework (CSF) is a voluntary framework from the US National Institute of Standards and Technology that organizes cybersecurity risk management around the functions of identify, protect, detect, respond and recover.
• NIST SP 800-115 — NIST SP 800-115 is a technical guide published by the US NIST that sets out the recommended principles and phases for planning and executing security testing and technical assessments, including pentesting, on information systems.
• NIST SP 800-171 — NIST SP 800-171 defines the requirements for protecting Controlled Unclassified Information (CUI) when it resides in the systems of contractors and external providers to US federal agencies, forming the technical basis required in defense contracts and supply chains.
• NIST SP 800-53 — NIST SP 800-53 is a catalog of security and privacy controls published by the US NIST for federal information systems, also widely adopted by private organizations as a foundation for designing and assessing cybersecurity programs.
• NoSQL Injection — NoSQL injection is the manipulation of queries directed at non-relational databases, such as MongoDB, by inserting unexpected operators or objects into input parameters. Unlike classic SQL injection, it often exploits how JSON-like structures are interpreted rather than plain text strings.
• OAuth 2.0 — OAuth 2.0 is the open standard that lets an application access a user's resources on another service (like reading their calendar) without the user ever sharing their password, using access tokens with limited scope and lifetime.
• Office Macro Malware — Office macro malware is malicious code embedded in the macros of documents such as Word or Excel files, which executes when the victim enables active content, typically after being tricked via a phishing email. It remains a classic initial delivery technique despite Microsoft progressive restrictions on macros.
• Open Redirect — Open redirect is a vulnerability where an application redirects users to a URL controlled by a parameter without validating it, which an attacker can exploit to send victims to a malicious site while the link still appears to belong to the original, trusted domain.
• Orphaned Account — An orphaned account is a user account that remains active in a system after the person it belonged to has left the organization or changed roles, posing a security risk because no one monitors or legitimately uses it.
• OSI Model — The OSI (Open Systems Interconnection) model is a reference framework that divides network communication into seven layers (physical, data link, network, transport, session, presentation and application), each with specific functions, used to design protocols and diagnose connectivity issues.
• OSINT (Open Source Intelligence) — OSINT is the discipline of gathering information from public, open sources (social media, public records, previous leaks, metadata) to build a profile of an organization's exposed surface before an attack or an authorized exercise.
• OSSTMM Methodology — OSSTMM (Open Source Security Testing Methodology Manual) is an open security testing methodology that defines a scientific, measurable approach for assessing the operational security of systems, networks, people, and physical processes.
• OTA (Over-the-Air) Update — An OTA (Over-the-Air) update is a mechanism that allows firmware or software updates to be distributed and installed on a device remotely, without physical access. If the process does not verify the package's integrity and authenticity through digital signing, an attacker can abuse it to distribute malicious firmware at scale.
• Out of Scope — An out-of-scope asset or vulnerability type is one that a bug bounty program explicitly excludes from authorized testing, so reporting it does not earn a reward and may violate the program's rules.
• OWASP ASVS — OWASP ASVS (Application Security Verification Standard) is a reference framework defining security requirements, organized into increasing levels of rigor, for verifying and building web applications that are robust against vulnerabilities.
• OWASP MASVS (Mobile Security) — OWASP MASVS (Mobile Application Security Verification Standard) is the reference standard defining security requirements for iOS and Android mobile applications, used as the basis for mobile audits and pentesting alongside the MASTG testing guide.
• OWASP Top 10 — The OWASP Top 10 is the world's reference list of the most critical web application security risks, periodically updated by the Open Worldwide Application Security Project, and used as the methodological basis for most web pentests.
• OWASP Top 10 for LLMs — The OWASP Top 10 for LLMs is the reference list of the most critical security risks specific to language-model-based applications — prompt injection, sensitive data leakage, model poisoning — the generative-AI equivalent of the classic OWASP Top 10.
• Package Typosquatting — Package typosquatting is the publication, on registries such as npm or PyPI, of packages with names very similar to popular legitimate libraries, betting that a developer will make a typo while installing a dependency and unknowingly run malicious code.
• Packet Sniffing — Packet sniffing is the technique of capturing and inspecting traffic flowing through a network using specialized tools, used both to diagnose network problems and, maliciously, to intercept sensitive information traveling unencrypted.
• PAM (Privileged Access Management) — PAM is the IAM subset focused on accounts with elevated privileges (admins, service accounts): it controls, audits and time-limits their use, because they're the priority target for any attacker who already has a foothold in the network.
• Pass-the-Hash — Pass-the-hash is a lateral-movement technique in Windows/Active Directory where the attacker reuses a password hash stolen from memory to authenticate to other systems, never needing the plaintext password at all.
• Passkeys / FIDO2 — Passkeys are credentials based on the FIDO2/WebAuthn standard that replace passwords with a cryptographic key pair: the private key never leaves the user's device, making them immune to credential phishing and credential stuffing.
• Patch Management — Patch management is the ongoing process of identifying, prioritizing, testing and deploying the security updates vendors release, before a known vulnerability gets exploited.
• Path Traversal — Path traversal is a vulnerability that allows an attacker to manipulate file path references (for example, using "../" sequences) to access files or directories outside the folder intended by the application, exposing source code, configuration, or sensitive data.
• PCI DSS — PCI DSS is the mandatory security standard for any organization that stores, processes or transmits payment card data, required by the card brands themselves (Visa, Mastercard) regardless of company size.
• Penetration Testing (Pentest) — A penetration test is a simulated, authorized cyberattack against an organization's systems, carried out by an expert who actively attempts to exploit the vulnerabilities found to demonstrate real impact, not just detect them.
• Pentest Report — The pentest report is the deliverable document of an intrusion test that details the vulnerabilities identified, their severity, technical evidence of exploitation, and remediation recommendations, serving as the basis for prioritizing fixes and demonstrating compliance to clients or auditors.
• Pentester — A pentester is a professional who simulates controlled attacks against systems, applications or networks to identify exploitable vulnerabilities before real attackers do.
• Pentesting as a Service (PTaaS) — Continuous pentesting, or PTaaS (Pentesting as a Service), is a service model that combines recurring intrusion testing with a real-time tracking platform, enabling vulnerabilities to be detected and remediated continuously instead of through one-off annual audits.
• Perfect Forward Secrecy (PFS) — Perfect Forward Secrecy (PFS) is a property of certain cryptographic protocols that generates unique, temporary session keys for each communication, so that compromising a long-term private key does not allow past communications to be decrypted.
• Perimeter Security — Perimeter security comprises the physical and technological barriers (fences, cameras, sensors, access control) deployed at the boundaries of a facility to detect and deter intrusions.
• Persistence — Persistence is the technique used by an attacker to maintain access to a compromised system over time, surviving reboots, credential changes, or remediation attempts, typically through scheduled tasks, services, or hidden accounts.
• Phishing — Phishing is a social engineering attack that impersonates a legitimate entity (a bank, a supplier, a colleague) via email to trick the victim into revealing credentials, data, or performing a fraudulent action.
• Physical Access Control — Physical access control comprises the mechanisms (cards, biometrics, locks, security personnel) that regulate who can enter a given facility or area of an organization.
• Physical Security — Physical security encompasses the measures designed to protect facilities, equipment and people against unauthorized access, damage or theft, complementing logical cybersecurity controls.
• PII (Personally Identifiable Information) — PII (Personally Identifiable Information) is any data that can directly or indirectly identify a natural person, such as their name, national ID number, email address or phone number.
• Pivoting — Pivoting is the technique that allows an attacker or pentester to use an already compromised system as a stepping stone to reach other networks or segments that would not be directly accessible from their original position.
• PKI (Public Key Infrastructure) — A PKI (Public Key Infrastructure) is the set of policies, roles and systems needed to create, manage, distribute and revoke digital certificates, providing the foundation for authentication and encryption based on asymmetric cryptography.
• PLC (Programmable Logic Controller) — A PLC (Programmable Logic Controller) is an industrial device that runs control logic to automate physical processes, such as opening valves or activating motors, based on the signals it receives from sensors. Compromising a PLC allows an attacker to directly manipulate physical processes, with the risk of material damage or physical safety incidents.
• PoC (Proof of Concept) — A PoC is the technical evidence — a script, a screenshot, a reproducible request — proving that a reported vulnerability is genuinely exploitable, distinguishing a real finding from a false positive.
• Polymorphic Malware — Polymorphic malware is malware that alters its own code or encryption on each infection, keeping the same functionality while changing its signature, which makes it harder for signature-based antivirus tools to detect. Effective identification requires heuristic or behavioral analysis.
• Port Scanning — Port scanning is a technique that sends requests to a range of ports on a system to determine which are open, closed or filtered, and which services are listening on them, used both in offensive reconnaissance phases and defensive audits.
• Post-Exploitation — Post-exploitation is the pentesting phase following initial access to a system, in which the real impact of the compromise is assessed through techniques such as privilege escalation, lateral movement, or extraction of sensitive data.
• Post-Quantum Cryptography — Post-quantum cryptography refers to cryptographic algorithms designed to withstand attacks carried out with quantum computers, which could theoretically break current schemes such as RSA or ECC using algorithms like Shor's algorithm.
• Pretexting — Pretexting is a social engineering technique where the attacker fabricates a credible false scenario or identity (for example, posing as IT support or a vendor) to gain the victim's trust and get them to disclose information or perform an action.
• Privacy by Design — Privacy by Design is the GDPR principle requiring data protection measures to be built into a system or service from its earliest design stages, rather than added as an afterthought.
• Private Key (crypto) — A private key is the cryptographic data that proves ownership of a blockchain address and allows transactions to be signed — whoever holds it controls the funds irrevocably, so its exposure or theft amounts to the total, unrecoverable loss of the associated assets.
• Private vs. Public Bug Bounty Program — A private bug bounty program invites only a selected group of researchers, while a public program is open to any researcher, which broadens coverage but also increases the volume of reports to manage.
• Privilege escalation — Privilege escalation is the technique by which an attacker, starting from limited access, gains higher permissions (from standard user to administrator, for example) by exploiting a misconfiguration or system vulnerability.
• Program Scope — The scope of a bug bounty program defines the assets, domains and vulnerability types researchers may legitimately test, delimiting what the company accepts as part of the program.
• Prompt Injection — Prompt injection is an input crafted to manipulate a language model's (LLM's) instructions, making it ignore its original rules, leak confidential system information, or perform actions never intended by its designer — the #1 vulnerability on the OWASP Top 10 for LLMs.
• PSD2 (Payment Services Directive) — PSD2 is the European directive regulating electronic payment services, requiring among other things Strong Customer Authentication (SCA) and the opening of bank APIs to authorized third-party providers under the open banking framework.
• Pseudonymization — Pseudonymization is the processing of personal data that replaces direct identifiers with pseudonyms, so that identifying the individual is only possible using additional information stored separately, as defined by the GDPR.
• PTES (Penetration Testing Execution Standard) — PTES (Penetration Testing Execution Standard) is a methodological standard defining the phases a professional pentest should cover — from preparation and reconnaissance through to the final report — serving as a common reference between providers and clients of offensive security services.
• Publicly Exposed Storage Bucket — A publicly exposed storage bucket is a cloud object container (S3, Azure Blob, Google Cloud Storage) whose permissions allow read or write access from the internet without authentication — one of the most common causes of sensitive data leaks in cloud environments.
• Purdue Model — The Purdue model is a reference framework that organizes an industrial plant systems into hierarchical levels, separating the corporate network (IT) from control systems (OT) through intermediate zones and segmentation controls. It is used as an architectural guide to limit lateral movement between IT and OT networks in industrial environments.
• Purple Team — Purple Teaming is a collaborative way of working where the red and blue teams execute and observe attack techniques in real time, tuning detection rules on the spot, instead of operating covertly and separately.
• Quid Pro Quo Social Engineering — Quid Pro Quo is a social engineering attack in which the attacker offers something in return (such as technical help or a prize) to convince the victim to share credentials, install software, or disable security controls.
• Race Condition (TOCTOU) — A race condition exploits the time window between an application checking a condition (time-of-check) and acting on it (time-of-use) to slip in an unauthorized operation during that gap — for example, redeeming the same discount coupon multiple times before the system marks it as used.
• RACI Matrix in Security — A RACI matrix in security assigns each task or control who is Responsible, who is Accountable, who is Consulted and who is Informed, removing ambiguity from cybersecurity governance.
• RAG (Retrieval-Augmented Generation) Security — RAG (Retrieval-Augmented Generation) security covers the measures to protect the document sources and vector stores that feed an LLM, preventing malicious content injected into that data from manipulating the model's responses or causing confidential information leaks.
• Rainbow Table — A rainbow table is a precomputed data structure that stores chains of hash values and their original passwords, allowing a hash to be reversed to its password far faster than testing combinations one by one, unless a salt is used.
• Ransomware — Ransomware is malware that encrypts an organization's files and demands a payment (ransom) to restore access, often combined with the threat of publishing stolen data if not paid (double extortion).
• Ransomware as a Service (RaaS) — Ransomware as a Service (RaaS) is a criminal business model in which a group develops and maintains a ransomware platform that it rents or licenses to affiliates in exchange for a cut of the ransom collected. This model lowers the technical barrier to launching ransomware attacks and has driven their proliferation.
• RASP (Runtime Application Self-Protection) — RASP (Runtime Application Self-Protection) is a technology embedded within a running application to detect and block attacks in real time (injections, insecure deserialization) by analyzing the process's own internal behavior, unlike a WAF, which inspects traffic from the outside.
• RAT (Remote Access Trojan) — A RAT (Remote Access Trojan) is malware that gives an attacker covert remote control over the infected machine, allowing them to execute commands, exfiltrate files, or activate the camera and microphone. It is typically delivered through phishing or vulnerability exploitation and persists without the victim noticing.
• Rate Limiting — Rate limiting is the technique of capping the number of requests a client can make to an API or service within a given time window, used as a security control against brute-force attacks, mass scraping and application-layer denial of service.
• RBAC (Role-Based Access Control) — RBAC assigns permissions to predefined roles (like "accountant" or "system administrator") instead of individual users, simplifying access management and reducing the risk of accumulated or forgotten permissions when someone changes roles.
• RCE (Remote Code Execution) — RCE is the most critical class of vulnerability there is: it lets an attacker execute arbitrary commands or code on a remote system without authorization, usually translating into full control over the affected server.
• Records of Processing Activities (ROPA) — Records of Processing Activities (ROPA) are the documentation the GDPR requires controllers and processors to maintain, inventorying what personal data they process, for what purpose, under which legal basis and with which security measures.
• Red Team — A Red Team is a covert, real-adversary simulation exercise: the offensive team pursues a concrete business objective combining technical, social and physical vectors, without the defensive team knowing, to measure its real detection and response capability.
• Red Teamer — A red teamer is part of a team that simulates a realistic, persistent adversary, combining offensive, physical and social engineering techniques to evaluate an organization's detection and response capabilities.
• ReDoS (Regular Expression Denial of Service) — ReDoS is a denial-of-service attack that exploits poorly designed regular expressions whose evaluation time grows exponentially for certain input strings. With a relatively short, specific input, an attacker can exhaust the server's CPU without needing a large volume of traffic.
• Reentrancy Attack — A reentrancy attack exploits a smart contract that makes an external call before updating its own internal state, allowing the called contract to repeatedly re-invoke the original function and drain funds before the balance is updated.
• Refresh Token — A refresh token is a long-lived credential that allows an application to obtain new, short-lived access tokens without requiring the user to authenticate again, keeping the session active securely.
• Remediation Retest — A remediation retest is the phase following a pentest in which reported vulnerabilities are verified as effectively fixed, confirming that the applied patches or changes actually close the identified risk without introducing new flaws.
• Researcher Reputation Score — A researcher's reputation score in bug bounty is a metric platforms calculate from the history of valid reports, their quality and adherence to program rules, influencing access to private programs.
• Responsible Disclosure Timeline — The responsible disclosure timeline is the period agreed between a researcher and the affected company to fix a vulnerability before its technical details are made public.
• Reverse Engineering — Reverse engineering is the process of analyzing software, a binary, or a device to understand its internal workings without access to the original source code, used in offensive security to identify vulnerabilities, analyze malware, or audit the robustness of protection mechanisms.
• Reverse Proxy — A reverse proxy is an intermediary server that receives client requests and forwards them to one or more backend servers, concealing their existence and adding functions such as load balancing, TLS termination or caching.
• RFID Security — RFID security focuses on protecting radio-frequency identification systems, such as access cards, inventory tags, or passports, against cloning, unauthorized reading, or replay attacks, which can allow an attacker to impersonate a physical credential without direct contact. Encrypting the communication and using mutual authentication are common mitigating controls.
• Right to Be Forgotten — The right to be forgotten is the right recognized under the GDPR that allows a person to request the erasure of their personal data when it is no longer necessary, consent is withdrawn or the processing is unlawful.
• Right to Data Portability — The right to data portability, recognized under the GDPR, allows a person to receive their personal data in a structured, commonly used format, or to request that it be transmitted directly to another data controller.
• Risk Appetite — Risk appetite is the level of risk an organization is willing to accept in pursuit of its business objectives, defined by senior management and used as a reference for security decisions.
• Risk Matrix — A risk matrix is a visual tool that plots an organization's risks by crossing their likelihood of occurrence with their potential impact, helping prioritize which threats require immediate treatment.
• Risk Treatment — Risk treatment is the phase of the risk management process in which an organization decides how to respond to each identified risk: mitigate, transfer, avoid or accept it, according to its risk appetite.
• Rootkit — A rootkit is malware designed to hide its own presence and that of other malicious processes on a compromised system, often operating at kernel level to evade antivirus and conventional detection tools.
• RSA — RSA is an asymmetric encryption algorithm based on the difficulty of factoring the product of two large prime numbers, used both to encrypt data and to generate digital signatures and establish secure connections such as TLS.
• RTO and RPO — RTO (Recovery Time Objective) is the maximum acceptable time to restore a system after an incident, while RPO (Recovery Point Objective) is the maximum amount of data an organization can afford to lose, measured as time since the last backup.
• Rug Pull — A rug pull is a fraud in which the creators of a crypto project or token suddenly withdraw the liquidity or funds contributed by investors, leaving the token worthless — it can be carried out through an exit planned from the start or via a hidden function in the smart contract.
• Rules of Engagement — Rules of Engagement is the document agreed upon before a pentest or red team exercise that defines the authorized scope, the systems and techniques allowed or excluded, the testing windows, and the emergency communication channels during the exercise.
• Safe Harbor Clause — A safe harbor clause is a company's explicit legal commitment not to pursue legal action against a researcher who reports a vulnerability in good faith and within the scope defined by its bug bounty or VDP program.
• Salt (password hashing) — A salt is a unique random value added to a password before applying a hash function, in order to prevent two identical passwords from producing the same hash and to hinder attacks based on precomputed tables such as rainbow tables.
• SAML — SAML (Security Assertion Markup Language) is an open, XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider, enabling single sign-on (SSO) across different applications.
• Sandbox Evasion — Sandbox evasion refers to techniques malware uses to detect whether it is running in a virtualized or isolated analysis environment rather than on a real machine, and if so, to withhold malicious behavior to avoid detection. It includes checks for virtual hardware, execution timing, or user interaction.
• SASE — SASE (Secure Access Service Edge) is an architectural model that converges networking functions (such as SD-WAN) and security functions (such as firewall, CASB or zero trust access) into a single cloud-delivered service, aimed at distributed users and devices.
• SAST (Static Application Security Testing) — SAST (Static Application Security Testing) analyzes an application's source code, bytecode or binary without executing it, to detect vulnerability patterns (injections, unsafe API usage, hardcoded secrets) early in development.
• SBOM (Software Bill of Materials) — An SBOM (Software Bill of Materials) is a formal inventory of every component, library and dependency that makes up a piece of software, used to respond quickly when a critical vulnerability is disclosed in one of those components.
• SCA (Software Composition Analysis) — SCA (Software Composition Analysis) examines an application's third-party dependencies and open-source libraries to identify components with known vulnerabilities (CVEs) or incompatible licenses.
• SCADA — SCADA (Supervisory Control and Data Acquisition) is an industrial control system that monitors and controls distributed physical processes, such as power grids, water treatment plants, or transportation infrastructure, by collecting data from remote sensors and sending commands to actuators. As it increasingly connects to IT networks, it has become a priority target for attacks on critical infrastructure.
• Schrems II Ruling — The Schrems II ruling (2020) by the Court of Justice of the EU invalidated the Privacy Shield as a mechanism for transferring personal data to the United States, requiring companies to reinforce additional safeguards in their international transfers.
• SCIM — SCIM (System for Cross-domain Identity Management) is a standard that automates the provisioning and deprovisioning of identities between an identity management system and the applications that consume those users, keeping additions, removals, and changes in sync.
• Script Kiddie — A script kiddie is an attacker with limited technical knowledge who uses tools or scripts developed by others to launch attacks without a deep understanding of how they work.
• SD-WAN — SD-WAN (Software-Defined Wide Area Network) is a technology that manages a wide area network through software, dynamically routing traffic across different connections (MPLS, broadband, LTE) based on policy and performance instead of relying on dedicated hardware per link.
• Secrets Management — Secrets management is the set of practices and tools (Vault, AWS Secrets Manager, KMS) for securely storing, rotating and distributing credentials, API keys and certificates, preventing them from being hardcoded in code or configuration files.
• Secure Boot — Secure Boot is a firmware mechanism that verifies the digital signature of each component loaded during a device's startup, preventing the execution of unauthorized or tampered code.
• Secure Data Destruction — Secure data destruction is the irreversible removal of information stored on devices using techniques such as cryptographic erasure, degaussing or physical destruction of the storage medium.
• Security Architect — A security architect designs an organization's security infrastructure and controls, ensuring systems are built following defense-in-depth principles from their conception.
• Security Audit — A security audit is the systematic, independent evaluation of an organization's security controls, policies and processes to verify compliance with regulations or standards and detect weaknesses.
• Security Awareness Training — Security awareness training is an ongoing program aimed at helping an organization's employees recognize and correctly react to threats such as phishing, social engineering or credential manipulation. It is considered a control that complements technical measures, since the human factor remains one of the most commonly used entry vectors.
• Security Baseline — A security baseline is the minimum set of configurations and controls a system, application or device must meet before going into production, defined in a standardized way across the whole organization. It serves as a reference for detecting deviations and as an objective criterion during audits.
• Security Champion — A security champion is a member of a development team who acts as a liaison with the security team, promoting good practices and flagging risks from the early stages of the software lifecycle.
• Security Runbook — A security runbook is a detailed operational document that describes the exact technical steps to execute a recurring security task, such as isolating a compromised endpoint or rotating a leaked credential. Unlike a playbook, which covers the response strategy for a type of incident, a runbook focuses on the concrete technical execution.
• Security Through Obscurity — Security through obscurity is the practice of basing a system's protection on keeping its design or internal workings secret, rather than on verifiable security controls. It is considered insufficient on its own, since protection disappears as soon as an attacker discovers those details.
• Self-Signed Certificate — A self-signed certificate is a digital certificate signed by the same entity that issues it rather than by a recognized certificate authority (CA), so it is not automatically trusted by browsers and is typically reserved for test environments or internal communications.
• Sensitive Data Exposure — Sensitive data exposure occurs when confidential information, such as credentials or personal and financial data, becomes accessible without adequate protection, for example unencrypted, in public repositories or in poorly controlled API responses. It is one of the most cited risk categories in standards such as the OWASP Top 10.
• Sensitive Information Disclosure (LLM) — Sensitive information disclosure in LLMs is the unintended exposure of confidential data — credentials, personal data, or proprietary information — present in training data, conversation context, or connected systems, revealed through the model's responses.
• Sensitive Information in Logs — Sensitive information in logs is the generally unintentional practice of recording passwords, tokens, personal data or card numbers in an application's log files. Because logs typically have looser access controls than the primary database, this information ends up exposed to a wider set of people and systems.
• Server-Side Template Injection (SSTI) — Server-Side Template Injection (SSTI) is a vulnerability that arises when user-controlled data is embedded unsanitized into a template rendered by the server, allowing an attacker to inject syntax native to the templating engine. In the most severe cases it leads to remote code execution on the server.
• Serverless Security — Serverless security addresses the risks specific to ephemeral cloud functions (AWS Lambda, Azure Functions) — excessive per-function IAM permissions, injection through input events, vulnerable dependencies — where there is no persistent server to secure, but an attack surface distributed across many small functions instead.
• Service Account — A service account is a non-human identity used by applications, scripts, or automated processes to authenticate and access resources; it requires specific controls because its credentials are often hard to rotate and its compromise can go unnoticed.
• Service Mesh — A service mesh is an infrastructure layer (Istio, Linkerd) that manages communication between microservices, and from a security standpoint allows mTLS encryption, authorization policies and internal traffic observability to be enforced without modifying each service's code.
• Session Cookie Theft — Session cookie theft involves obtaining the cookie that identifies an authenticated session (via XSS, malware, or traffic interception) in order to reuse it and impersonate the user within the application without needing their credentials.
• Session Hijacking — Session hijacking is an attack in which a third party takes control of a legitimate user's active web session, typically by stealing or predicting the session identifier, to act within the application with that user's privileges without knowing their password.
• Session Management — Session management covers the set of mechanisms an application uses to securely create, maintain, renew, and end an authenticated user's session, including generating unpredictable session identifiers, expiring sessions after inactivity, and invalidating them on logout.
• Shadow AI — Shadow AI is employees' use of AI tools (ChatGPT, Copilot, AI plugins) without security team approval or oversight, risking confidential company data ending up in third-party services outside its control.
• Shadow API — A shadow API is an endpoint that exists and is live in production but isn't listed in the organization's documentation, inventory, or known to its security team — typically an old, test, or informally created version that never went through formal review.
• Shadow Data — Shadow data is corporate information that exists outside the organization's official systems and security controls, such as copies in unsanctioned SaaS tools, forgotten test environments or exports to personal spreadsheets. Because it is not inventoried, it receives neither the protection nor the monitoring applied to the rest of the data.
• Shadow IT — Shadow IT is any system, application or automation used within an organization without the IT/security team's knowledge or approval — a growing risk with low-code tools like Power Automate or browser extensions.
• Shared Responsibility Model — The shared responsibility model defines which security aspects fall to the cloud provider (physical security, hypervisor, infrastructure) and which fall to the customer (access configuration, data encryption, identity management) — most cloud breaches occur on the customer's side of that line.
• Shift-Left Security — Shift-left security is the principle of moving security testing and controls to the earliest possible stages of the development lifecycle (design, coding, pull request) instead of concentrating them right before deployment, reducing the cost and time of fixing a vulnerability.
• Shoulder Surfing — Shoulder surfing involves covertly observing a person's screen, keyboard or documents to obtain sensitive information such as passwords or confidential data.
• Side-Channel Attack — A side-channel attack exploits information leaked by the physical implementation of a cryptographic system, such as execution time, power consumption or electromagnetic emissions, rather than attacking the underlying mathematical algorithm itself.
• SIEM — A SIEM (Security Information and Event Management) centralizes and correlates security event logs across the whole infrastructure to detect attack patterns that would be invisible looking at each system separately.
• Sigma Rules — Sigma rules are an open, standardized format for describing log-based detection logic, independent of the specific SIEM where they will run. They let security teams share and reuse detections without rewriting them for each platform.
• Silver Ticket Attack — A Silver Ticket is an attack against Kerberos in which the attacker forges a service ticket using the password hash of a service account, gaining direct access to that specific service without going through the domain controller or leaving the same trace as a Golden Ticket.
• SIM Swapping — SIM swapping is a social engineering attack in which the attacker convinces a mobile carrier to port the victim's phone number to a SIM card under their control, in order to intercept SMS verification codes and take over crypto or financial accounts protected by that second factor.
• Smart Building Security — Smart building security protects the systems that automate a building climate control, lighting, access, and video surveillance against attacks that could let an intruder manipulate locks, disable cameras, or reach internal networks through poorly secured IoT devices. Integrating multiple vendors and protocols increases the attack surface.
• Smart Contract — A smart contract is a program that executes autonomously on a blockchain (typically Ethereum) when predefined conditions are met, and whose code, once deployed, is effectively immutable — any logic or security flaw remains permanently exposed.
• Smart Contract Audit — A smart contract audit is a manual and automated review of a contract's code before production deployment, focused on detecting vulnerabilities such as reentrancy, arithmetic overflow, weak access control or exploitable business logic — since fixing a flaw after deployment can be impossible.
• SOAR (Security Orchestration, Automation and Response) — SOAR automates the response to repetitive security alerts through predefined playbooks (like automatically isolating an endpoint or blocking an IP), cutting response time and freeing the SOC from low-value manual work.
• SOC (Security Operations Center) — A SOC is the team (in-house or outsourced) responsible for continuously monitoring, detecting and responding to security incidents, usually backed by a SIEM and incident response playbooks.
• SOC 1 — SOC 1 is an audit report, based on the SSAE 18 standard, that evaluates a service provider's internal controls relevant to its clients' financial reporting, commonly used by external auditors as part of financial statement audits.
• SOC 2 — SOC 2 is an AICPA audit standard widely required by US B2B and SaaS customers, certifying that an organization manages customer data according to five criteria: security, availability, processing integrity, confidentiality and privacy.
• SOC Analyst — A SOC (Security Operations Center) analyst monitors security alerts in real time, investigates suspicious events and escalates confirmed incidents according to the organization's response procedures.
• SOX (Sarbanes-Oxley Act) — SOX (Sarbanes-Oxley Act) is the 2002 US law requiring publicly traded companies to maintain robust internal controls over financial reporting, including IT controls that ensure the integrity of accounting systems.
• Spear phishing — Spear phishing is targeted, personalized phishing against a specific person or organization, using real information about the victim (their role, contacts, current projects) to dramatically increase success rates over generic mass phishing.
• Spyware — Spyware is malware designed to collect information about a user or system, such as keystrokes, credentials, or browsing history, without their knowledge, and send it to a third party. It is often bundled with legitimate software or delivered through social engineering.
• SQL Injection (SQLi) — A SQL injection occurs when an application inserts user input directly into a database query without sanitizing it, letting an attacker read, modify or delete data — or in severe cases, take control of the database server.
• SSO (Single Sign-On) — Single Sign-On lets a user authenticate once and access multiple applications with that same session without re-entering credentials, centralizing authentication in a single identity provider.
• SSRF (Server-Side Request Forgery) — SSRF lets an attacker force an application's server to make HTTP requests to internal destinations it shouldn't be able to reach (internal databases, cloud metadata endpoints, admin services), bypassing the network perimeter.
• Standard Contractual Clauses (SCC) — Standard Contractual Clauses (SCC) are model contract terms approved by the European Commission that provide adequate safeguards for transferring personal data outside the European Economic Area in compliance with the GDPR.
• Statement of Applicability (SoA) — The Statement of Applicability (SoA) is the document required by ISO 27001 that details which Annex A controls apply to the organization, which are excluded and the justification for each decision.
• Steganography — Steganography is the technique of hiding information inside another seemingly innocuous file or message, such as an image or audio file, so that its existence goes unnoticed, unlike encryption, which protects content but does not conceal that a communication exists.
• Step-Up Authentication — Step-up authentication requires an additional verification factor when an already-authenticated user attempts a higher-risk or more sensitive action, such as changing their password or authorizing a transfer, without needing to fully log in again.
• STRIDE Threat Model — STRIDE is a threat modeling methodology that classifies a system's risks into six categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. It is used as a checklist during design to ensure no relevant threat category is overlooked.
• Subdomain Takeover — A subdomain takeover happens when a subdomain points (via CNAME) to an external service that has been deactivated or never claimed, letting an attacker register that resource and serve their own content under the victim's trusted domain.
• Supply chain attack — A supply chain attack compromises a vendor, software library or third-party dependency to reach, through it, organizations that trust that component — without attacking them directly.
• SWIFT Customer Security Programme (CSCF) — The SWIFT Customer Security Programme (CSCF) is the mandatory framework of controls that SWIFT requires from financial institutions connected to its network to protect local messaging infrastructure against fraud and cyberattacks, with annual self-assessment and attestation.
• Symmetric Encryption — Symmetric encryption is a cryptographic method that uses the same key for both encrypting and decrypting information, making it faster than asymmetric encryption but requiring a secure mechanism to share that key between the parties involved.
• Tabletop Exercise — A tabletop exercise is a security-incident simulation run as a discussion, without touching real systems, where technical and leadership teams rehearse their roles and decisions against a hypothetical attack scenario.
• Tailgating — Tailgating is a physical social engineering technique in which an attacker gains access to a restricted area by closely following an authorized person, relying on that person holding the door open or not verifying their identity.
• TCP/IP Stack — The TCP/IP stack is the set of protocols that governs communication on the Internet, organized into four layers (network access, Internet, transport and application), where TCP ensures reliable data delivery and IP handles packet addressing and routing.
• Third-Party AI Model Risk — Third-party AI model risk refers to the security vulnerabilities, biases, or dependencies an organization inherits by integrating AI models, APIs, or components developed by external vendors without auditing their provenance or behavior.
• Third-Party Risk Management — Third-party risk management is the process of identifying, assessing and mitigating the security and compliance risks introduced by vendors, contractors and other partners with access to an organization's systems or data.
• Threat Hunter — A threat hunter proactively searches a network for signs of compromise or hidden malicious activity, rather than waiting for an alerting system to detect it automatically.
• Threat Hunting — Threat hunting is the proactive search for threats that have already evaded automated defenses, starting from a hypothesis about attacker behavior instead of waiting for an alert to fire.
• Threat Intelligence (CTI) — Cyber Threat Intelligence is the analysis of data about real threat actors, campaigns and attack techniques to anticipate risks specific to a sector or organization, instead of defending generically.
• Threat Modeling — Threat modeling is a structured process for identifying, before or during a system's development, the assets to protect, the potential attackers and the ways they could compromise the system. It allows security controls to be prioritized at the design stage, when fixing issues is cheaper.
• TISAX — TISAX (Trusted Information Security Assessment Exchange) is the information security assessment standard for the European automotive industry, allowing manufacturers and suppliers to share audit results through a common platform.
• TLPT (Threat-Led Penetration Testing) — TLPT is a Red Team exercise based on real threat intelligence, run under the TIBER-EU framework, that the DORA Regulation requires every 3 years from financial entities designated as critical in the EU.
• TLS/SSL — TLS (Transport Layer Security), the successor to SSL (Secure Sockets Layer), is a cryptographic protocol that encrypts communications between client and server, ensuring confidentiality, integrity and server authentication through digital certificates.
• Token Impersonation — Token impersonation is a technique on Windows systems that involves stealing or reusing another process's or user's access token to execute actions with their privileges, enabling privilege escalation or lateral movement without knowing their password.
• TPM (Trusted Platform Module) — The TPM (Trusted Platform Module) is a hardware-embedded security chip that stores cryptographic keys in isolation and allows verification of a device's boot integrity.
• Training Data Leakage — Training data leakage is the exposure of information contained in the dataset used to train an AI model, which may be reproduced verbatim or inferred from its responses, compromising the confidentiality of personal or proprietary data.
• Trojan — A Trojan is malware disguised as legitimate software to trick the user into running it, after which it can steal data, install backdoors, or hand remote control to the attacker. Unlike a virus or worm, it does not self-replicate.
• TTPs (Tactics, Techniques and Procedures) — TTPs describe a threat actor's behavior at three levels: the tactic (the goal, e.g. lateral movement), the technique (the method used) and the procedure (that specific actor's specific implementation of the technique).
• Typosquatting — Typosquatting registers domains with typos closely resembling a legitimate brand (one swapped letter, an added hyphen) to capture mistaken traffic or run phishing campaigns with a trustworthy appearance.
• UEBA (User and Entity Behavior Analytics) — UEBA is a security technology that establishes a baseline of normal behavior for users and entities, such as servers or devices, and raises alerts when it detects significant deviations, such as logins at unusual hours or atypical download volumes. It complements signature-based tools by detecting insider threats and compromised credentials.
• USB Drop Attack — A USB drop attack involves leaving infected USB devices in strategic locations, hoping an employee will plug one into a corporate machine and unintentionally execute malware.
• Use-After-Free — Use-after-free is a memory management vulnerability in which a program continues using a pointer after the memory it refers to has been freed, which an attacker can exploit to corrupt data, cause crashes, or execute arbitrary code.
• VDP (Vulnerability Disclosure Program) — A VDP is a formal responsible disclosure channel: it defines how and where researchers can report security flaws and what to expect in return, without offering monetary rewards like a bug bounty.
• Vector Database Security — Vector database security covers the access controls, encryption, and isolation applied to the stores holding embeddings used by AI and RAG systems, preventing leaks of the original information they represent or manipulations that alter the model's responses.
• Vector Embedding Security — Vector embedding security addresses the risks tied to the numerical representations of text, images, or other data used in AI systems, including the possibility of reconstructing the original sensitive information through embedding inversion.
• Virtual Patching — Virtual patching consists of deploying a rule on a security device, such as a WAF or an IPS, that blocks the exploitation of a known vulnerability without modifying the affected code or system. It is used as a temporary measure when applying the vendor's official patch requires additional time or testing.
• Vishing and Smishing — Vishing is voice-call phishing and smishing is SMS phishing — both pursue the same goal as email phishing (obtaining credentials or data) but through channels that raise less suspicion for some users.
• VLAN — A VLAN (Virtual Local Area Network) is a logical network that groups devices into the same broadcast domain regardless of their physical location, allowing traffic segmentation within the same switching infrastructure without additional cabling.
• Voice Cloning Fraud — Voice cloning fraud uses artificial intelligence to replicate a real person's voice from audio samples, deployed in social engineering attacks — such as CEO fraud — to impersonate executives or family members and deceive the victim over the phone.
• VPN — A VPN (Virtual Private Network) creates an encrypted tunnel between a device and a remote network over a public network such as the Internet, protecting traffic confidentiality and allowing access to internal resources as if the user were connected locally.
• Vulnerability Chaining — Vulnerability chaining consists of combining several security flaws, each of limited impact on its own, to achieve a full system compromise. It is a common technique in both penetration testing and real-world attacks, since many individual vulnerabilities are mistakenly dismissed due to their low severity in isolation.
• Vulnerability Management — Vulnerability management is the continuous process of discovering, prioritizing, remediating and verifying an organization's security weaknesses over time, unlike a one-off pentest, which is a snapshot of a single moment.
• Vulnerability triage — Triage is the process of validating, prioritizing and discarding incoming vulnerability reports (from bug bounty, VDP or internal channels) before they reach the development team, separating real, critical findings from noise and false positives.
• Vulnerable Container Image — A vulnerable container image is a Docker or OCI image that includes operating system packages, libraries or dependencies with known vulnerabilities, typically inherited from an outdated base image or from dependencies left unreviewed before the build.
• Vulnerable/Outdated Dependency — A vulnerable or outdated dependency is a third-party library, framework or component that remains in use even though newer versions exist that fix known vulnerabilities. Exploitation is common because the flaws are often publicly documented and proof-of-concept exploits are readily available.
• WAF (Web Application Firewall) — A WAF filters and monitors HTTP traffic to a web application to block known attack patterns (SQLi, XSS), though it doesn't replace a pentest: it doesn't catch business logic flaws or application-specific vulnerabilities.
• WAF Bypass — WAF bypass encompasses the techniques used to evade the rules of a Web Application Firewall, such as obfuscating payloads, splitting the payload across multiple requests, or exploiting interpretation differences between the WAF and the actual application.
• Wallet Drainer — A wallet drainer is a malicious script or service, usually distributed through a phishing site impersonating a legitimate dApp or airdrop, designed to trick the victim into signing a transaction or approval that automatically transfers all assets from their wallet to the attacker.
• Watering Hole Attack — A watering hole attack involves compromising a website known to be frequently visited by the target group, such as employees of a specific industry, in order to infect its visitors instead of attacking them directly. It is a common technique in campaigns targeting specific organizations.
• Web Cache Poisoning — Web cache poisoning involves manipulating a request's headers or parameters so that a caching server stores a malicious or altered response, which is then served to other legitimate users requesting the same resource.
• Whaling — Whaling is a phishing variant that specifically targets senior executives or high-level decision-makers within an organization, using personalized messages that impersonate partners, vendors, or authorities to obtain money transfers, credentials, or confidential information.
• White Hat, Black Hat and Grey Hat — White hat, black hat and grey hat classify hackers by intent: a white hat acts with authorization for defensive purposes, a black hat acts maliciously without permission, and a grey hat operates in a middle ground, often without authorization but without harmful intent.
• Wiper Malware — A wiper is malware designed not to steal data or extort payment, but to destroy or render unrecoverable the information on infected systems, typically by overwriting or corrupting disk contents. It is used mainly in attacks aimed at sabotage or disruption.
• Worm — A worm is self-replicating malware that spreads autonomously across systems and networks by exploiting vulnerabilities or misconfigured services, without requiring the user to run any file. Its automatic propagation makes it particularly effective at infecting large numbers of machines quickly.
• WPA3 — WPA3 (Wi-Fi Protected Access 3) is the most recent security standard for Wi-Fi networks, replacing WPA2 and incorporating a key exchange protocol (SAE) resistant to offline dictionary attacks, along with individualized traffic encryption on open networks.
• XDR (Extended Detection and Response) — XDR extends the EDR model by correlating telemetry from multiple sources — endpoints, network, email, identity, cloud — into a single platform, to detect attacks only visible when signals from several layers are cross-referenced.
• XSS (Cross-Site Scripting) — XSS is a vulnerability that lets an attacker inject malicious JavaScript into a web page viewed by other users, potentially stealing sessions, credentials, or performing actions on their behalf.
• XXE (XML External Entity) — XXE is a flaw in misconfigured XML parsers that lets an attacker define external entities to read server files, trigger SSRF requests, or cause a denial of service.
• YARA Rules — YARA rules are patterns defined to identify and classify malware samples based on text strings, binary sequences or a file's structural characteristics. They are used both in forensic analysis and in detection tools to locate variants of the same malware family.
• Zero Trust — Zero Trust is a security model built on "never trust, always verify": no user, device or service is trusted just for being inside the corporate network, and every access is explicitly authenticated and authorized with the minimum privilege required.
• Zero-Click Vulnerability — A zero-click vulnerability is a security flaw that can be exploited without any interaction from the victim, for example when a message or call is automatically processed by the target application. The lack of visible indicators makes these flaws especially valued in targeted and espionage attacks.
• Zero-day — A zero-day vulnerability is a security flaw unknown to the software vendor at the time it is discovered or exploited, meaning no patch exists yet.
• Zip Bomb — A zip bomb is a compressed file designed to expand to a disproportionately large size when decompressed, aiming to exhaust the disk space, memory, or CPU of the system or antivirus engine attempting to process it.