Cybersecurity Cheat Sheet
Security terminology explained
464 terms
- 2FA Fatigue
- The frustration or desensitization users experience from repeated two-factor authentication prompts, which can lead them to approve push notifications without verifying legitimacy — a behavior actively exploited by attackers who spam MFA prompts until the target hits 'Approve' out of annoyance (also
- Account Takeover
- Account Takeover is an attack technique in which an adversary steals or reuses authentication material so an attacker can operate as a legitimate user account. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls su
- AI-Powered Security
- Security tooling or workflows that use machine learning or AI techniques for tasks such as anomaly detection, triage, or automated analysis. The phrase is common in vendor marketing, so the actual technical substance can vary widely.
- AI Red Team
- A team that deliberately tests an AI system for harmful outputs, misuse paths, jailbreaks, and other safety or security weaknesses.
- Algorithm Downgrade Attack
- Algorithm Downgrade Attack is an attack technique in which an adversary forces peers to negotiate weaker algorithms or protocol options than the secure default. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls s
- All-In-One Security
- A bundled security offering that claims to cover many functions such as detection, protection, logging, identity, and response from one platform. The appeal is simplification, though all-in-one security products often trade breadth against depth in some areas.
- Anti-Debugging
- Anti-Debugging is a defensive measure intended to resist or complicate debugging techniques used by attackers or analysts. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configurati
- Anti-Forensics
- Anti-Forensics is a defensive measure intended to resist or complicate forensics techniques used by attackers or analysts. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configurati
- Anti-Malware
- Anti-Malware is a defensive measure intended to resist or complicate malware techniques used by attackers or analysts. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration,
- Anti-Tamper
- Anti-Tamper is a defensive measure intended to resist or complicate tamper techniques used by attackers or analysts. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, li
- API Abuse
- API Abuse is an API-focused security concern involving how interfaces are authenticated, limited, or protected from misuse. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configurat
- API Key Rotation
- API Key Rotation is an API-focused security concern involving how interfaces are authenticated, limited, or protected from misuse. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct con
- API Key vs Token
- Two approaches to API authentication. API keys are long-lived, opaque strings tied to an account or project -- simple but risky if leaked (no expiration). Tokens (JWT, OAuth access tokens) are short-lived, carry claims (user, permissions, expiration), and are scoped to specific actions. Best practic
- Application Allowlisting
- Application Allowlisting is a security concept, control, or technique used to reduce risk and improve visibility across systems and data. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on corr
- Application Security
- Application Security is the practice of designing, building, testing, and operating software in ways that reduce exploitable weakness. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct
- Asymmetric Encryption
- Asymmetric Encryption is cryptographic protection for asymmetric data so unauthorized parties cannot read it easily. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, li
- Authentication
- Authentication is the process of verifying that a user, device, or system is genuinely who or what it claims to be, answering the question 'Who are you?' Methods range from simple username and password combinations to multi-factor authentication (MFA), which layers something you know (password), som
- Authentication Bypass
- Authentication Bypass is an attack technique in which an adversary circumvents the intended login or verification path and reaches protected functionality anyway. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls
- Backport
- Applying a fix or feature from a newer version of software to an older, still-supported version. Essential for security patches on LTS releases — users shouldn't have to upgrade to stay safe.
- Badware
- A colloquial term for software that is malicious, deceptive, dangerously insecure, or simply harmful to users through abusive behavior. It is broader and less formal than 'malware,' sometimes including adware, spyware, and scammy apps.
- Bare Metal Security
- Security controls and considerations for systems running directly on physical hardware rather than in virtualized multi-tenant environments. Bare metal security often emphasizes firmware integrity, physical access control, and hardware-rooted trust.
- Baseline Security
- The minimum acceptable set of security controls, settings, and practices required across systems or environments. Baseline security gives organizations a floor below which no system should fall, even before risk-specific extras are added.
- Behind the Firewall
- Describing software or data that stays inside an organization's internal network boundaries rather than being exposed publicly. In enterprise culture the phrase often signals stricter security expectations, legacy systems, or deployment constraints.
- Benevolent Hacker
- A security researcher or hacker who discovers vulnerabilities and responsibly discloses them to the affected vendor or organization rather than exploiting them for personal gain. Overlaps with the concept of a white-hat hacker, but emphasizes ethical motivation — often participating in bug bounty pr
- BGP hijacking
- An attack where a malicious or misconfigured network announces ownership of IP address blocks it does not control, causing internet traffic destined for those addresses to be rerouted. Because BGP relies on trust between operators, any autonomous system can claim any prefix, and the global routing s
- Binary Analysis
- Binary Analysis is the examination of binary artifacts or behavior to support security decisions and investigations. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, li
- Binary Patching
- Binary Patching is a security concept, control, or technique used to reduce risk and improve visibility across systems and data. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct confi
- Birthday Attack
- Birthday Attack is an attack technique in which an adversary uses the birthday paradox to make hash or signature collisions more likely than brute force intuition suggests. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layere
- Black Hat
- A hacker who exploits vulnerabilities for personal gain, malice, or criminal purposes — in contrast to white-hat (ethical) and grey-hat hackers. Also the name of a prominent annual cybersecurity conference (Black Hat USA/Europe/Asia) where researchers present cutting-edge vulnerability disclosures a
- Blind SQL Injection
- Blind SQL Injection is an attack technique in which an adversary sends database queries and infers true or false outcomes from timing, content, or error differences. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered contr
- Blockchain Security
- The protection of blockchain systems, smart contracts, wallets, consensus mechanisms, and surrounding infrastructure against theft, abuse, and protocol failure. It spans both classic software security and threats specific to decentralized systems.
- Bluetooth Sniffing
- Bluetooth Sniffing is an attack technique in which an adversary captures Bluetooth traffic to analyze pairing, metadata, or application content. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validatio
- BPF Security
- Security monitoring, enforcement, or isolation techniques built on Berkeley Packet Filter or extended BPF capabilities in the kernel. BPF security is powerful because it can observe or mediate low-level behavior with less overhead than older approaches.
- Bring Your Own Device
- A policy allowing employees to use personal laptops, phones, or tablets for work instead of only company-issued devices. Bring your own device policies trade convenience and cost savings against security and management complexity.
- Browser Security
- The collection of browser features and behaviors that isolate sites, enforce origin boundaries, manage permissions, and protect users from malicious web content. Browser security includes same-origin policy, sandboxing, CSP support, cookie rules, storage isolation, and many other mechanisms that web
- Brute Force Attack
- Brute Force Attack is an attack technique in which an adversary systematically guesses credentials or keys until the target accepts one. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, harde
- Bubblewrap
- A Linux sandboxing tool used to create restricted environments with limited filesystem and process access.
- Buffer Overflow Attack
- Buffer Overflow Attack is an attack technique in which an adversary writes beyond an allocated buffer and corrupts adjacent memory, control flow, or data structures. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered contr
- Business Email Compromise
- Business Email Compromise is an attack technique in which an adversary uses spoofing or account access to trick finance or operations staff into sending money or data. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered con
- BYOD Security
- The controls and policies used to protect organizational data and access when employees use personal devices for work. BYOD security usually involves device posture checks, MDM or MAM controls, and careful separation of personal and corporate data.
- CAPTCHA Bypass
- CAPTCHA Bypass is an attack technique in which an adversary evades human-verification controls with automation, relays, or weaknesses in challenge design. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as
- Card Skimming
- Card Skimming is an attack technique in which an adversary captures payment card data from compromised readers, overlays, or e-commerce skimmer code. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as vali
- Clean Desk Policy
- A workplace policy requiring desks to be cleared of sensitive documents, devices, or notes when not in use. In security-conscious environments it is meant to reduce accidental exposure of confidential information.
- Click Fraud
- Click Fraud is an attack technique in which an adversary generates fraudulent ad clicks or interactions to drain budgets or manipulate advertising metrics. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such a
- Clickjacking Attack
- Clickjacking Attack is an attack technique in which an adversary tricks a user into clicking hidden or disguised interface elements inside a malicious page. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such
- Client-Side Encryption
- Client-Side Encryption is cryptographic protection for client-side data so unauthorized parties cannot read it easily. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration,
- Cloud Access Security Broker
- Cloud Access Security Broker is a policy-enforcement layer that sits between users and cloud services to improve visibility and control. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on corre
- Cloud Security
- The protection of cloud-hosted data, workloads, identities, networks, and control planes through architecture, policy, monitoring, and operational controls. It includes both traditional security concerns and risks unique to highly dynamic shared environments.
- Cloud Security Posture Management
- Cloud Security Posture Management is continuous assessment of cloud resources against security baselines, identity risk, and configuration drift. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends
- CNI Security
- Security concerns and controls related to container networking interfaces, especially in orchestrated environments such as Kubernetes. CNI security affects segmentation, policy enforcement, visibility, and how workloads communicate on the network.
- Code Audit Culture
- A team culture in which code is regularly inspected for security, compliance, correctness, or maintainability rather than only trusted by default once merged. Strong code audit culture values evidence and review over heroic assumptions.
- CodeQL
- A code analysis engine and query language developed for finding security issues and other patterns by modeling source code semantically rather than just searching text. CodeQL lets teams write queries against code databases to detect data-flow problems, unsafe APIs, and project-specific patterns acr
- Code Review Security
- The practice of using code review not just for correctness and style but specifically to identify security flaws, insecure assumptions, and risky changes before deployment. Strong code review security depends on reviewer skill and secure defaults, not just checklists.
- Cold Boot Attack
- Cold Boot Attack is an attack technique in which an adversary retrieves residual data from memory shortly after power loss to recover secrets such as keys. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such a
- Collision Attack
- Collision Attack is an attack technique in which an adversary tries to find two different inputs that produce the same cryptographic digest or signature state. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls su
- Command and Control
- Command and Control is a security concept, control, or technique used to reduce risk and improve visibility across systems and data. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct c
- Command Injection
- Command Injection is an attack technique in which an adversary causes an application to execute attacker-controlled operating-system commands. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation,
- Container Security
- The set of practices and controls used to protect container images, runtimes, registries, orchestration platforms, and workload boundaries. It spans build-time integrity, runtime isolation, and operational visibility.
- Content Security Policy
- An HTTP response header that restricts which resources (scripts, styles, images, fonts) a browser is allowed to load for a page. A powerful defense against XSS attacks by whitelisting trusted sources and blocking inline scripts.
- Control Plane Security
- Security for the management layer that controls infrastructure, orchestration, identity, and policy decisions rather than the workloads themselves. Because the control plane can reconfigure or access everything, compromise here is often catastrophic.
- Cookie Poisoning
- Cookie Poisoning is an attack technique in which an adversary modifies cookie contents to tamper with state, privileges, or application logic. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation,
- Cookie Security
- The set of controls and attributes used to protect cookies, such as Secure, HttpOnly, SameSite, scope restrictions, and sound session design. Weak cookie security often turns otherwise small web flaws into account compromise.
- CORS Origin
- The scheme + hostname + port combination that identifies where a web request originates from. CORS (Cross-Origin Resource Sharing) checks prevent JavaScript on one origin from accessing resources on another unless the server explicitly allows it via Access-Control-Allow-Origin headers. Origin: https
- CORS Preflight
- An automatic OPTIONS request sent by the browser before a cross-origin request to check whether the server allows it. Triggered by non-simple methods (PUT, DELETE), custom headers, or non-standard content types. The server responds with allowed origins, methods, and headers.
- Credential
- A secret or proof of identity used to authenticate a user, service, or application, such as a password, token, certificate, or API key. Credentials must be stored, transmitted, and rotated carefully because misuse can grant unauthorized access.
- Credential Harvesting
- Credential Harvesting is an attack technique in which an adversary collects usernames, passwords, tokens, or secrets through phishing, malware, or fake portals. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls s
- Credential Provider
- A component or service that supplies credentials to an application, often by loading them from environment variables, metadata services, secret stores, or federated identity systems. Credential providers help centralize how software acquires and refreshes authentication material.
- Credential Replay
- Credential Replay is an attack technique in which an adversary reuses captured authentication material against another session, service, or time window. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as v
- Cross-Origin Resource Sharing Attack
- Cross-Origin Resource Sharing Attack is an attack technique in which an adversary abuses permissive cross-origin policies to read or send data across trust boundaries. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered con
- Cross-Site Request Forgery Attack
- Cross-Site Request Forgery Attack is an attack technique in which an adversary causes a victim browser to send an authenticated request the user did not intend. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls s
- Cross-Site Scripting Attack
- Cross-Site Scripting Attack is an attack technique in which an adversary injects script into trusted pages so code runs in another user's browser context. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as
- Cryptographic Algorithm
- A formal algorithm used for encryption, hashing, digital signatures, key agreement, or related cryptographic purposes. Security depends not only on choosing a sound cryptographic algorithm but also on using it correctly in a secure protocol and implementation.
- Cryptography
- The field of designing and analyzing methods for secure communication, authentication, integrity, and related protections using mathematical techniques. Modern cryptography underpins everything from TLS to secure messaging to code signing.
- Crypto Library
- A software library that implements cryptographic primitives and protocols such as hashing, signing, encryption, key exchange, or certificate handling. Crypto libraries must be used carefully because subtle misuse can undermine otherwise strong algorithms.
- Crypto Module
- A code module or hardware-backed component dedicated to cryptographic operations such as key management, encryption, decryption, signing, or verification. Separating a crypto module can make security reviews and compliance controls easier.
- crypto wallet
- Software or hardware that stores the cryptographic private keys needed to sign transactions on a blockchain. Despite the name, wallets don't actually hold cryptocurrency — they hold the keys that prove ownership of assets recorded on the distributed ledger.
- CSP
- Content Security Policy — an HTTP header that tells the browser which sources of content (scripts, styles, images, fonts) are allowed to load on a page. CSP is the most effective defense against XSS attacks, as it prevents inline scripts and restricts where code can be loaded from. Deploying a stric
- Cyber Security Culture
- The shared habits, expectations, and behaviors an organization has around security awareness, reporting, prevention, and response. Good cyber security culture means security is part of normal work instead of a separate annual slideshow nobody remembers.
- DAST
- Dynamic Application Security Testing — testing a running application by sending crafted requests to discover vulnerabilities from the outside (black-box testing). Finds issues that SAST misses: misconfigured headers, CORS issues, authentication bypasses, and runtime injection vulnerabilities. Tools
- Data at Rest Encryption
- Data at Rest Encryption is cryptographic protection for data at rest data so unauthorized parties cannot read it easily. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration
- Data Backup Security
- The protection of backup data and backup systems so they cannot be stolen, encrypted by attackers, silently corrupted, or misused during recovery. It includes encryption, access control, immutability, and regular restore testing.
- Database Security
- The set of controls used to protect database systems and the data inside them, including authentication, authorization, encryption, patching, monitoring, and backup discipline. It covers both the database engine and the surrounding operational model.
- Data Center Security
- The physical and logical safeguards used to protect servers, network equipment, power systems, and operational processes inside a data center. It covers access controls, surveillance, environmental protection, segmentation, and resilience planning.
- Data Exfiltration
- Data Exfiltration is an attack technique in which an adversary moves sensitive data out of an environment through approved or covert channels. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation,
- Data Governance Security
- The security controls embedded in data governance, including classification, access policy, retention, lineage, and accountability for sensitive data handling. It connects security requirements to the way data is owned and managed across the organization.
- Data in Transit Encryption
- Data in Transit Encryption is cryptographic protection for data in transit data so unauthorized parties cannot read it easily. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configu
- Data Lake Security
- The controls used to protect large centralized repositories of raw structured and unstructured data. Data lake security is difficult because these platforms aggregate sensitive datasets, broad analytics access, and complex permission models in one place.
- Data Poisoning
- Data Poisoning is an attack technique in which an adversary corrupts training or reference data so downstream analytics or models behave incorrectly. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as vali
- Data Security
- The protection of data against unauthorized access, alteration, destruction, or loss throughout its lifecycle. It includes controls for storage, transmission, processing, and disposal.
- Defense in Depth Culture
- A culture that assumes single safeguards will fail and therefore builds multiple layers of protection, review, and recovery. In security-minded teams, defense in depth becomes a habit of thinking rather than just a diagram in an architecture deck.
- Denial of Service
- Denial of Service is an attack technique in which an adversary exhausts a service so legitimate users cannot access it reliably. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardening, ra
- DependencyTrack
- An open source platform for tracking software component inventories, vulnerabilities, and supply chain risk, often using SBOM data. It is commonly used in security programs to monitor dependency exposure over time.
- Desktop Security
- The protection of employee or user desktop systems through controls such as patching, endpoint protection, disk encryption, configuration policy, and privilege restriction. Desktop security remains critical because user machines are common entry points for attackers.
- Dictionary Attack
- Dictionary Attack is an attack technique in which an adversary tries likely passwords, keys, or hashes from curated wordlists instead of random guesses. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as v
- Differential Privacy
- A mathematical framework that provides provable privacy guarantees by adding calibrated noise to query results or model training. Ensures that the output of an analysis is essentially the same whether or not any single individual's data is included. Used by Apple, Google, and the US Census Bureau.
- Digital Certificate Culture
- The habits and expectations an organization develops around using, managing, renewing, and trusting digital certificates. The phrase is useful when certificate handling is not just a technical detail but part of normal operational behavior.
- Digital Security
- The protection of digital systems, identities, data, and communications from unauthorized access, disruption, or misuse. In culture discussions digital security includes not just tools but also habits, awareness, and institutional behavior.
- Directory Traversal
- Directory Traversal is an attack technique in which an adversary uses crafted path input to access files or directories outside the intended application scope. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls su
- Docker Security
- The set of practices and controls used to secure container images, runtimes, registries, and hosts in Docker-based environments. It includes image provenance, least-privilege execution, secret handling, and isolation between containers and the host.
- Document Security
- The protection of digital or physical documents against unauthorized access, leakage, tampering, or misuse. It often involves classification labels, access restrictions, watermarking, encryption, and monitoring of sharing behavior.
- DoS Amplification
- DoS Amplification is an attack technique in which an adversary reflects small requests into much larger responses from third-party services. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, h
- Double Free
- Double Free is an attack technique in which an adversary frees the same memory region twice and creates allocator corruption that can be exploitable. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as vali
- Drive-by Download
- Drive-by Download is an attack technique in which an adversary delivers malware when a user visits a compromised page without an obvious installer. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as valida
- Dynamic Application Security Testing
- Dynamic Application Security Testing is runtime testing of a running application by sending requests and observing behavior from the outside. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on
- Eavesdropping
- Eavesdropping is an attack technique in which an adversary intercepts communications or signals without authorization to collect information. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation,
- Edge Security
- The protection of systems and traffic at the network or application edge, where requests first meet services such as CDNs, reverse proxies, gateways, and edge compute nodes. It includes WAF rules, bot controls, TLS policy, abuse prevention, and secure configuration of distributed edge infrastructure
- Email Bombing
- Email Bombing is an attack technique in which an adversary floods a mailbox or mail system with high volumes of messages to disrupt operations. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation
- Email Security
- The set of controls used to protect email systems and users from spoofing, phishing, malware, account takeover, and data loss. It includes user training, mailbox hardening, DMARC/SPF/DKIM, filtering, and incident response around mail-based attacks.
- Embedded Device Security
- The protection of software, firmware, hardware interfaces, and update mechanisms in embedded systems such as routers, medical devices, and industrial controllers. Embedded device security is challenging because these devices often have long lifecycles and limited patchability.
- Embedded Security
- Embedded Security is the design and operation of security controls for firmware-driven or resource-constrained embedded systems. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct confi
- Endpoint Security
- Endpoint Security is the practice of protecting laptops, servers, and other endpoints through prevention, detection, and response controls. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on co
- Environment Variable
- A key-value pair set in the operating system's environment that configures application behavior without code changes. Used for secrets (API keys), feature toggles, and deployment-specific settings. The twelve-factor app methodology mandates storing config in environment variables.
- Environment Variable
- A dynamic value stored outside the application code that configures behavior at runtime — database URLs, API keys, feature flags. The answer to 'how do I store secrets without hardcoding them' and the reason .env files exist.
- Evil Maid Attack
- Evil Maid Attack is an attack technique in which an adversary uses brief physical access to tamper with a powered-off or unattended device. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, ha
- Evil Regex
- A regular expression so complex or poorly designed that it is unreadable, fragile, or prone to catastrophic backtracking and performance issues. The term often mixes humor with real fear.
- Evil Twin
- Evil Twin is an attack technique in which an adversary stands up a rogue wireless access point that imitates a trusted network name or portal. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation,
- Face ID Security
- The security properties and defenses of facial-recognition authentication systems such as Apple's Face ID, including liveness checks, infrared sensing, spoof resistance, and fallback controls. Discussions of Face ID security usually focus on how hard it is to unlock a device with a mask, photo, twin
- Facial Recognition Security
- The security of systems that identify or verify people by comparing facial features against stored templates. It includes model accuracy, liveness detection, presentation-attack resistance, template protection, and handling of false matches.
- Fail2ban
- A security tool that watches logs for suspicious behavior and automatically blocks abusive IP addresses.
- Falco
- A runtime security tool for detecting suspicious system and container behavior based on rules and system events.
- Filesystem Security
- The protection of files, directories, metadata, and mount behavior through permissions, ownership, encryption, auditing, and safe configuration. Filesystem security is fundamental because many higher-level controls fail if local file access is too permissive.
- Firewall Culture
- A culture strongly shaped by network boundaries, perimeter security assumptions, and the idea that being 'inside' carries special trust. The phrase is often used when older security habits persist even as architectures become more distributed and identity-driven.
- Firmware Security
- The protection of low-level software embedded in devices against tampering, malicious updates, extraction, and unsafe configuration. Firmware security often involves signing, verified boot, update integrity, debug interface control, and hardware trust anchors.
- Flipper Zero
- A portable multi-tool device used for experimenting with radio, RFID, NFC, infrared, and related hardware protocols, popular in hacker and security circles. It has strong gadget-culture visibility beyond its actual technical scope.
- Fork Bomb
- A denial-of-service pattern where processes recursively spawn more processes until the system exhausts its resources. The term is especially associated with Unix shell examples that demonstrate how quickly uncontrolled process creation can overwhelm a machine.
- Format String Attack
- Format String Attack is an attack technique in which an adversary passes crafted formatting input to unsafe functions and gains memory disclosure or writes. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such
- Geofencing Security
- Security controls that use geographic boundaries or location-based conditions to allow, restrict, or alert on access and activity. Geofencing security is common in fraud prevention and conditional access, though it depends on the reliability of IP or device location signals.
- Golden Ticket Attack
- Golden Ticket Attack is an attack technique in which an adversary forges Kerberos TGTs after stealing the KRBTGT secret and grants domain-level persistence. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such
- GOTO Fail
- A reference to Apple's infamous SSL bug caused by a duplicated `goto fail;` line, now used as shorthand for tiny coding mistakes with outsized security consequences.
- Hardware Security Module
- Hardware Security Module is a tamper-resistant device used to generate, store, and use cryptographic keys under strong controls. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct confi
- Hash Collision
- Hash Collision is a cryptographic mechanism or concept used to protect confidentiality, integrity, authenticity, or trust establishment. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on corre
- HashiCorp Vault
- A secrets-management system used to store, issue, and control access to credentials, keys, and other sensitive configuration.
- Hashing
- Hashing is the process of transforming input data of any size into a fixed-size output (called a hash, digest, or fingerprint) using a mathematical function called a hash function. Good hash functions are deterministic (same input always produces the same output), fast to compute, and produce output
- Health Check Security
- The practice of securing application or infrastructure health-check endpoints so they do not expose sensitive status data, bypass authentication, or become a path for abuse. Health checks are operationally useful, but careless implementations can leak internals or expand attack surface.
- High Availability Security
- The security and resilience measures used to keep critical services available even during attacks, failures, or maintenance events. It combines redundancy, failover, segmentation, DDoS readiness, and safe operational design so security incidents do not automatically become outages.
- Host Security
- The protection of an individual computer or server through configuration hardening, patching, endpoint controls, access restrictions, and monitoring. Host security complements network defenses by limiting compromise at the system level.
- Hot Standby Security
- The security considerations around hot-standby systems that remain synchronized and ready to take over immediately if the primary system fails. Because standby systems often hold live data and privileged connectivity, they must be secured and monitored as seriously as active systems.
- HSTS
- HTTP Strict Transport Security — a security header that tells browsers to only communicate with the server over HTTPS, refusing all HTTP connections. Once a browser sees an HSTS header, it will automatically upgrade any HTTP request to HTTPS for the specified duration, preventing SSL stripping attac
- HTTP Parameter Pollution
- HTTP Parameter Pollution is an attack technique in which an adversary adds duplicated or conflicting parameters so the server parses input unexpectedly. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as v
- HTTP Request Smuggling
- HTTP Request Smuggling is an attack technique in which an adversary desynchronizes front-end and back-end HTTP parsing to hide or splice requests. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validat
- HTTP Response Splitting
- HTTP Response Splitting is an attack technique in which an adversary injects header delimiters so one response becomes multiple attacker-influenced responses. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls suc
- HTTPS Stripping
- HTTPS Stripping is an attack technique in which an adversary forces a victim onto HTTP by interfering with secure upgrade or redirect behavior. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation
- HTTP Strict Transport Security
- HTTP Strict Transport Security is a response header policy that tells browsers to use HTTPS for a site and reject downgrade attempts. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct
- Hypervisor Security
- The protection of the virtualization layer that creates and manages virtual machines, including hardening, patching, access control, and monitoring of the hypervisor. Hypervisor security is crucial because compromise at that layer can affect many guest systems at once.
- ICMP Tunneling
- ICMP Tunneling is an attack technique in which an adversary uses ICMP packets as a covert path for data transfer or command traffic. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardening
- ICS Security
- The protection of industrial control systems such as PLCs, SCADA environments, HMIs, and related networks that operate physical processes. ICS security differs from ordinary IT security because safety, uptime, legacy protocols, and physical consequences heavily shape the tradeoffs.
- IDS Evasion
- IDS Evasion is an attack technique in which an adversary modifies traffic or payloads so detection logic misses malicious behavior. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardening,
- Information Security
- Information Security is the discipline of protecting confidentiality, integrity, and availability across information systems and data. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct
- Infrastructure Security
- Infrastructure Security is the practice of securing networks, hosts, cloud resources, and foundational services that support applications. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on cor
- Injection Attack
- Injection Attack is an attack technique in which an adversary places untrusted data into an interpreter or execution context so it is treated as code or commands. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls
- Inline Security
- Security controls that sit directly in the traffic or execution path so they can inspect, modify, allow, or block activity in real time. Inline security can stop threats immediately, but it also introduces latency, availability dependencies, and tuning challenges.
- Integer Overflow
- Integer Overflow is an attack technique in which an adversary causes arithmetic wraparound that breaks bounds checks, allocations, or logic. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, h
- Internet Security
- The protection of systems, communications, and users against threats that operate across the internet, including exploitation, phishing, bot abuse, malware delivery, and interception. It spans protocols, browsers, remote services, and the broader public-network threat model.
- IoT Security
- IoT Security is the protection of connected devices, their firmware, telemetry, identities, and update channels. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, lifecy
- IT Security
- The protection of information technology systems, networks, devices, and services against unauthorized access, disruption, misuse, and data loss. The term often refers to the operational side of security applied across enterprise infrastructure.
- Jailbreak
- Jailbreak is an attack technique in which an adversary removes or bypasses platform restrictions that are meant to limit code execution or policy. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validat
- Jailbreak AI
- An attempt to bypass an AI system's intended safeguards, restrictions, or instruction boundaries through adversarial prompting or workflow manipulation. Jailbreak attempts are a major concern in public-facing AI systems because they can expose unsafe or disallowed behavior.
- KeePass
- A password manager known for local encrypted vaults and straightforward credential storage.
- Kerberoasting
- Kerberoasting is an attack technique in which an adversary requests service tickets and cracks their encrypted material offline to recover service account passwords. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered contr
- Kevin Mitnick
- A famous and controversial hacker figure often referenced in discussions of social engineering, computer-intrusion history, and hacker mythology.
- Knowledge Base Security
- The protection of internal or shared knowledge bases against unauthorized access, leakage, tampering, and oversharing of sensitive operational details. Security concerns grow when documentation includes credentials, architecture diagrams, incident procedures, or proprietary implementation notes.
- Known Plaintext Attack
- Known Plaintext Attack is an attack technique in which an adversary uses access to both plaintext and ciphertext samples to infer keys or weaknesses. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as vali
- Kubernetes Security
- Kubernetes Security is the protection of cluster components, workloads, identities, network policies, and supply-chain paths in Kubernetes. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on co
- LDAP Injection
- LDAP Injection is an attack technique in which an adversary alters directory queries by inserting untrusted input into LDAP filters or attributes. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validat
- Legacy System Security
- The protection of old or unsupported systems that cannot easily be patched, upgraded, or replaced but still perform important business functions. Legacy system security often depends on isolation, strict access limits, monitoring, and compensating controls rather than ideal remediation.
- LLM Security
- The security discipline around large language model systems, including prompt injection defenses, data protection, access control, abuse prevention, and safe tool integration. LLM security extends beyond ordinary API security because model behavior itself can be influenced adversarially.
- Log Forging
- Log Forging is an attack technique in which an adversary creates misleading log entries that obscure what really happened. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardening, rate lim
- Log Tampering
- Log Tampering is an attack technique in which an adversary deletes, edits, or disables logging to hide attacker actions. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardening, rate limit
- Lynis
- A security auditing and hardening tool for Unix-like systems that checks system configuration against common best practices.
- MAC Address Spoofing
- MAC Address Spoofing is an attack technique in which an adversary changes a device MAC identifier to impersonate another client or avoid controls. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validat
- MAC Flooding
- MAC Flooding is an attack technique in which an adversary overwhelms a switch CAM table so frames are broadcast more broadly. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardening, rate
- Macro Security
- The controls, settings, and policy decisions used to prevent harmful document macros from executing or being abused for malware delivery. Macro security typically involves disabling unsigned macros, restricting trusted locations, warning users, and monitoring Office process behavior.
- Macro Virus
- Macro Virus is an attack technique in which an adversary embeds malicious logic in document macros so code runs when the file is opened or trusted. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as valida
- Mail Exchange Security
- The protection of the infrastructure and configuration involved in routing email between domains, including MX records, mail gateways, TLS settings, anti-spoofing controls, and relay policies. Weak mail exchange security can enable interception, spoofing, open relay abuse, or delivery manipulation.
- Maintenance Window Security
- The security planning and controls applied during approved maintenance windows when systems are intentionally changed, restarted, or exposed to elevated admin activity. Attackers may try to blend into these periods because unusual actions are more likely to be overlooked.
- Malicious Insider
- Malicious Insider is an attack technique in which an adversary misuses legitimate access to steal, sabotage, or expose organizational assets. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation,
- Managed Security
- Security capabilities delivered by an external provider on behalf of an organization, such as monitoring, device management, vulnerability handling, or incident support. Managed security is broader than a single product because it includes people, processes, and service-level responsibilities.
- Managed Security Service
- A contracted security offering in which a provider runs specific defensive functions such as log monitoring, firewall management, endpoint oversight, or alert handling for a customer. Managed security services vary widely in depth, from basic monitoring to active response and engineering support.
- Management Plane Security
- The protection of the interfaces, APIs, consoles, and protocols used to administer infrastructure, cloud services, and network devices. Management plane security is critical because whoever controls the management layer can often reconfigure or disable everything underneath it.
- Man-in-the-Browser
- Man-in-the-Browser is an attack technique in which an adversary modifies a browser session locally to alter transactions and observe content in real time. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as
- Man-in-the-Middle
- Man-in-the-Middle is an attack technique in which an adversary interposes between communicating parties to observe, modify, or relay traffic. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation,
- MAPI Security
- The protection of Microsoft Messaging Application Programming Interface access, which is used by Outlook and related clients to interact with Exchange mailboxes and messaging data. MAPI security matters because mailbox access can expose email, calendars, contacts, and delegated privileges if authent
- Mass Assignment
- Mass Assignment is an attack technique in which an adversary binds unexpected client-supplied fields to privileged server-side object properties. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validati
- Memory Zeroing
- The practice of overwriting memory contents with zeros before freeing or reusing it, preventing sensitive data (passwords, keys, plaintext) from lingering in deallocated memory where it could be read by other processes or via memory dumps. Requires volatile writes or special APIs to prevent compiler
- Minimum Security Baseline
- The lowest acceptable set of security controls, settings, and practices that systems or environments must meet before they are considered compliant or trusted. Minimum baselines are used to standardize expectations across fleets, vendors, and business units.
- Mitmproxy
- An interactive proxy used to inspect, modify, and debug HTTP and related traffic in transit.
- Mobile App Security
- The protection of mobile applications against reverse engineering, insecure storage, weak authentication, API abuse, malicious tampering, and unsafe platform interactions. Mobile app security spans both the app code and the backend services and device features it depends on.
- Mobile Security
- Mobile Security is the protection of mobile devices, applications, data, identities, and wireless communications. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configuration, lifec
- Modbus Security
- The protection of systems using the Modbus industrial communication protocol, which was not designed with modern authentication or encryption by default. Modbus security usually depends on segmentation, gateway controls, monitoring, and compensating protections around inherently weak protocol behavi
- Multi-Cloud Security
- The protection of workloads, identities, networks, and data spread across more than one cloud provider. Multi-cloud security is difficult because each platform has different identity models, logging formats, policy controls, and misconfiguration patterns.
- Multi-Factor Authentication
- Authentication requiring two or more independent verification factors: something you know (password), something you have (phone/key), something you are (biometric). The generalized form of 2FA.
- Multi-Factor Authentication Bypass
- Multi-Factor Authentication Bypass is an attack technique in which an adversary defeats a second factor through workflow abuse, phishing proxies, or weak recovery controls. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layere
- Multi-Tenancy Security
- The controls and architecture used to keep different customers, business units, or tenants isolated from one another while sharing the same application or infrastructure platform. Multi-tenancy security depends on strong authorization boundaries, data partitioning, logging, and resistance to cross-t
- National Security
- The protection of a nation's people, institutions, critical infrastructure, and strategic interests against threats including cyber operations, espionage, sabotage, and disruption. In cybersecurity discussions, the term often arises when attacks affect defense, elections, energy, telecom, or other n
- NAT Security
- The security implications and controls associated with network address translation, including how internal addresses are hidden, how sessions are tracked, and what exposure still exists through translated services. NAT can reduce casual visibility of internal hosts, but it is not a substitute for fi
- NDA Security
- The confidentiality protections and handling expectations associated with sharing information under a nondisclosure agreement. NDA security is not a technical control by itself, but it shapes who may see sensitive material, how it must be handled, and what consequences follow improper disclosure.
- Near Field Communication Security
- The protection of systems that use short-range near field communication for payments, device pairing, badge emulation, or data exchange. NFC security concerns include relay attacks, unauthorized reads, cloning of poorly designed tags, and misuse of trusted tap workflows.
- Network Perimeter Security
- The controls placed at network boundaries to monitor, filter, or restrict traffic entering and leaving an environment, such as firewalls, gateways, DDoS protections, and VPN concentrators. It remains important, but modern architectures recognize that the perimeter is no longer the only trust boundar
- NoSQL Injection
- NoSQL Injection is an attack technique in which an adversary injects operators or structured values into a NoSQL query parser. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validation, hardening, rate
- NTP Security
- The protection of network time synchronization against spoofing, tampering, misuse, or dependency failures. NTP security matters because bad time can break logs, certificates, authentication, distributed systems, and forensic timelines across an environment.
- Null Byte Injection
- Null Byte Injection is an attack technique in which an adversary uses a null terminator to truncate or alter how input is processed by lower-level code. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as v
- OAuth Token Theft
- OAuth Token Theft is an attack technique in which an adversary steals bearer tokens and reuses them to call protected APIs or impersonate sessions. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as valida
- Object Storage Security
- The protection of object storage systems such as S3-compatible buckets through access policy, encryption, logging, lifecycle controls, and exposure management. Object storage security failures are common because a single misconfiguration can expose large volumes of sensitive data publicly.
- Observability Security
- The protection of logs, traces, metrics, dashboards, and observability pipelines so they do not leak secrets, accept tampered data, or become a high-value attack path. Observability platforms often contain rich operational details, making them both useful and sensitive.
- Offensive Security
- Offensive Security is the practice of simulating attacker behavior to identify, validate, and communicate security weaknesses. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct configu
- On-Path Attack
- On-Path Attack is an attack technique in which an adversary places an attacker on the network path where traffic can be inspected or influenced. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as validatio
- OpenBSD
- A Unix-like open source operating system from the BSD family, known for prioritizing code correctness, security auditing, and conservative design. It has a strong reputation in security-conscious systems circles.
- Open Policy Agent
- A general-purpose policy engine used to enforce declarative rules across infrastructure, APIs, and software systems.
- Open Redirect
- Open Redirect is an attack technique in which an adversary abuses redirect logic so a trusted site sends users to an attacker-controlled destination. Defenders analyze it to understand prerequisites, affected trust boundaries, and likely telemetry, then reduce risk with layered controls such as vali
- Open Source Security
- The set of security practices, risks, and governance concerns specific to open source software, including maintainer trust, dependency hygiene, signing, disclosure, and supply chain integrity. The phrase often covers both defending open source projects and using them safely in larger systems.
- Open Source Supply Chain
- The web of dependencies, maintainers, build systems, registries, and release processes through which open source software moves from author to downstream users. It is a major focus area in software security because compromise can propagate widely.
- OpenSSL Security
- The security posture of systems that rely on the OpenSSL cryptographic library, including patch level, supported ciphers, certificate handling, and vulnerability exposure. OpenSSL security matters widely because the library underpins TLS and cryptographic functions in many servers, appliances, and e
- Operational Security
- Operational Security is the practice of protecting sensitive activities, plans, and capabilities from observation or inference. Security teams use it to enforce trust, reduce exposure, improve detection, or standardize secure operations in production environments. Its value depends on correct config
- Operator Security
- The protection of administrators, responders, or other operators who have sensitive access, along with the systems and procedures they use. Operator security includes workstation hardening, privileged session controls, safe handling practices, and protections against targeted phishing or coercion.
- OPNsense
- An open-source firewall and routing platform used for network security and gateway management.
- osquery
- An operating-system instrumentation framework that exposes system state through a SQL-like interface for security and operations use cases.
- OTP
- One-Time Password — a dynamically generated code valid for a single login session or transaction. TOTP (time-based) and HOTP (counter-based) are the two main flavors, commonly delivered via authenticator apps or SMS.
- OT Security
- The protection of operational technology environments such as industrial controllers, building systems, utilities, and manufacturing equipment that interact with physical processes. OT security emphasizes safety, uptime, legacy constraints, and real-world consequences in ways that differ from standa
- Out-of-Band Verification
- A verification step that uses an independent communication channel to confirm a request or identity claim. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- PAC File Security
- The protection of proxy auto-configuration files and the trust model around how browsers or systems retrieve and execute them. PAC file security matters because a malicious or tampered configuration can silently redirect traffic, weaken inspection, or enable credential theft through proxy manipulati
- Package Security
- The practices and risks involved in securing distributed software packages, including signature verification, provenance, dependency vetting, tamper resistance, and vulnerability monitoring. It is a major concern in language registries and OS package repositories alike.
- Packet Capture
- A network or infrastructure security concept involving packet capture and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect advers
- Packet Sniffing
- A network or infrastructure security concept involving packet sniffing and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adver
- Password Cracking
- A security concept covering password cracking and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Password Hashing
- The practice of transforming a plaintext password into an irreversible, fixed-length digest using a deliberately slow, salted algorithm — such as bcrypt, scrypt, or Argon2 — so that stored credentials cannot be easily reversed if the database is compromised.
- Password Manager
- A security concept covering password manager and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Password Policy
- A security concept covering password policy and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier
- Password Spraying
- A security concept covering password spraying and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Patch Management
- A governance or operations concept focused on patch management as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Patch Tuesday
- A security concept covering patch tuesday and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Patch Tuesday Culture
- The organizational habit of orienting patching, testing, and risk review around Microsoft's regular Patch Tuesday release cadence. More broadly, the phrase can describe disciplined but reactive update routines built around vendor schedules.
- Payload Delivery
- A security concept covering payload delivery and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Penetration Testing Methodology
- A defensive security practice involving penetration testing methodology to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, de
- Permission
- A rule or attribute that grants or denies a subject (user, role, or process) the ability to perform a specific action on a resource. In Unix, file permissions are expressed as read/write/execute bits for owner, group, and others; in applications, permissions are often managed through RBAC or ACL sys
- Permission Boundary
- An identity or access control concept centered on permission boundary and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- Personal Data
- A security concept covering personal data and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Personal Security
- The practices and protections an individual uses to secure their accounts, devices, data, and physical safety against digital threats such as phishing, account takeover, stalking, or data leakage. In professional settings, personal security for high-risk staff can become an organizational concern as
- Pharming
- A security attack or exploit technique associated with pharming in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or def
- Phishing Kit
- A security concept covering phishing kit and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Physical Security
- A security concept covering physical security and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Piggybacking
- A security concept covering piggybacking and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Plaintext
- A cryptographic concept related to plaintext, secure communication, key handling, or trust establishment. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Platform Security
- A security concept covering platform security and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Plausible Deniability
- A security concept covering plausible deniability and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity e
- Point of Presence Security
- A security concept covering point of presence security and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activ
- Pop3 Security
- The protection of email retrieval using the POP3 protocol, including encrypted transport, authentication controls, and the risks of legacy client behavior. POP3 security is often weaker than modern alternatives when old clients use plaintext auth or lack strong session protections.
- Portable Security
- The practices and controls used to protect laptops, removable media, portable workstations, and other mobile equipment from theft, tampering, loss, or misuse. Portable security matters because devices that leave controlled offices face much higher physical and network exposure.
- Portal Security
- The security of a web portal or user-access interface, including authentication, authorization, session handling, input validation, and exposure of sensitive data or functionality. Portal security is especially important for customer, vendor, and admin portals that aggregate high-value workflows in
- Port Security
- Security controls applied to switch ports or similar connection points to restrict which devices can connect and how they may behave. Port security commonly includes MAC limits, sticky addresses, shutdown on violation, and protections against unauthorized physical network access.
- POS Security
- The protection of point-of-sale terminals, payment flows, attached devices, and backend systems against card theft, malware, tampering, and fraud. POS security combines physical protection, network isolation, device management, payment encryption, and monitoring because retail systems are popular ta
- Post-Exploitation
- A security attack or exploit technique associated with post-exploitation in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Pre-Authentication
- An identity or access control concept centered on pre-authentication and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity e
- Predictive Security
- The use of historical data, threat intelligence, behavioral patterns, and models to estimate where attacks or failures are likely to occur before they happen. Predictive security can improve prioritization, but it depends heavily on data quality and should not be confused with certainty about future
- Pretexting
- A security concept covering pretexting and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Principal
- An identity or access control concept centered on principal and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Privacy by Design
- A security concept covering privacy by design and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Privacy Impact Assessment
- A defensive security practice involving privacy impact assessment to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect a
- Private Cloud Security
- The protection of cloud-like infrastructure operated for a single organization, whether on-premises or in a dedicated hosted environment. Private cloud security covers identity, hypervisors, management planes, workloads, segmentation, and the operational controls needed when the provider is not hand
- Privilege Boundary
- An identity or access control concept centered on privilege boundary and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity e
- Privilege Creep
- A security concept covering privilege creep and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier
- Privileged Access Management
- An identity or access control concept centered on privileged access management and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- Process Hollowing
- A security concept covering process hollowing and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Process Injection
- A security concept covering process injection and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Process Security
- The protection built into business and technical processes so they cannot be abused, bypassed, or manipulated to create security failures. Process security includes approvals, separation of duties, safe defaults, auditability, and controls that make risky actions harder to perform invisibly.
- Procurement Security
- The security review and risk controls applied when acquiring software, hardware, cloud services, or vendors. Procurement security aims to catch risky suppliers, unsafe contractual terms, unsupported products, and supply-chain issues before new technology is introduced into the environment.
- Production Security
- The controls, practices, and protections applied specifically to live production environments where real customers, data, and business operations are at stake. Production security typically involves stronger access restrictions, monitoring, change control, and separation from development or test sys
- Program Security
- The overall security of a defined program, initiative, or managed set of activities, including its governance, staffing, controls, objectives, and measurement. It can refer to the security of a business program or to the quality of an organization's broader security program itself.
- Prompt Attack
- An adversarial attempt to manipulate an AI system through crafted input so it ignores instructions, reveals restricted information, or behaves in unintended ways. Prompt attacks are especially important in systems that mix user input with hidden instructions or tool access.
- Prompt Injection
- An attack where malicious instructions are embedded in user input to override an LLM's system prompt or instructions. Direct injection modifies the prompt directly; indirect injection hides instructions in retrieved content (websites, emails, documents). The 'SQL injection of LLMs' — no complete def
- Prompt Leaking
- The exposure of hidden system prompts, private instructions, or internal context through model output or prompt-injection attacks.
- Proof of Knowledge
- A security concept covering proof of knowledge and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earl
- Protocol Downgrade
- A security concept covering protocol downgrade and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earl
- Protocol Security
- The security properties and protections of a communication protocol, including authentication, confidentiality, integrity, replay resistance, and downgrade safety. Protocol security depends on design, implementation, configuration, and how the protocol is used within a larger system.
- Provisioning Security
- The protection of account, device, certificate, and system provisioning processes so new resources are created with correct permissions, trusted configuration, and verified identity. Weak provisioning security can introduce long-lived errors at the very start of an asset's lifecycle.
- Proxy Chain
- A network or infrastructure security concept involving proxy chain and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- Proxy Security
- The security of proxy infrastructure and the controls proxies provide, including authentication, filtering, logging, certificate handling, and resistance to bypass or misuse. Because proxies often sit in sensitive traffic paths, their compromise or misconfiguration can have broad impact.
- Proxy Server
- A server that acts as an intermediary for network requests between clients and destination servers. A forward proxy acts on behalf of clients (hiding their identity or filtering content), while a reverse proxy (like Nginx or HAProxy) sits in front of backend servers to handle load balancing, SSL ter
- Pseudo-Random Number Generator
- A security concept covering pseudo-random number generator and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary a
- Public Cloud Security
- The protection of workloads, data, identities, and control planes running on shared cloud platforms operated by third-party providers. Public cloud security depends heavily on correct identity design, configuration, logging, and understanding the provider's shared-responsibility boundaries.
- Race Condition Exploit
- A security attack or exploit technique associated with race condition exploit in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity e
- Rainbow Table
- A security concept covering rainbow table and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Random Number Generator
- A security concept covering random number generator and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- Ransomware Attack
- A security attack or exploit technique associated with ransomware attack in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Rate Limiter
- A mechanism that controls the rate of requests a client can make to a service within a time window. Common algorithms include token bucket, sliding window, and leaky bucket. Essential for protecting APIs from abuse and ensuring fair usage.
- Rate Limiting Algorithm
- Algorithms for controlling request rates: Token Bucket (tokens accumulate at fixed rate, each request costs a token — allows bursts), Leaky Bucket (requests processed at fixed rate, excess queued — smooth output), Sliding Window (count requests in recent time window), and Fixed Window (count per tim
- Rate Limiting Security
- A security concept covering rate limiting security and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- RCE Bounty
- A bug bounty payout or reward category for finding a remote code execution vulnerability, one of the highest-impact classes of software security flaws. In security culture, the phrase implies both high severity and potentially high payout.
- RDP Security
- The hardening, monitoring, and access control practices used to protect Remote Desktop Protocol services and sessions. RDP security typically involves network restriction, MFA, patching, gateway use, account lockout controls, and careful logging because exposed RDP is a common intrusion path.
- Real-Time Threat Detection
- A defensive security practice involving real-time threat detection to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect
- Reclassification
- A security concept covering reclassification and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Recording Security
- The protection of recorded security-relevant material such as session captures, call recordings, screen recordings, or surveillance footage so it cannot be accessed, altered, or leaked improperly. Recording security matters because these artifacts often contain highly sensitive operational and perso
- Red Team AI
- The practice of adversarially testing AI systems to uncover unsafe behavior, security weaknesses, misuse pathways, or policy failures before deployment. Red teaming is a common safety practice for high-risk AI features.
- Red Team Exercise
- A defensive security practice involving red team exercise to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- Red Teaming AI
- Actively probing an AI system for unsafe behavior, jailbreaks, policy failures, or harmful outputs by simulating adversarial use.
- Redundancy Security
- The security and reliability considerations around redundant systems, links, or components designed to keep services running during failures or attacks. Redundant infrastructure improves availability only if backup paths are also hardened, monitored, and protected from shared points of failure.
- Reflected XSS
- A security concept covering reflected xss and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Registry Security
- The protection of Windows registry settings and related permissions against unauthorized modification, persistence abuse, and unsafe configuration. Registry security matters because the registry influences startup behavior, policies, credentials, and many system trust decisions.
- Regression Testing Security
- A defensive security practice involving regression testing security to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect
- Release Security
- The protections applied to the software release process, including build integrity, artifact signing, approval controls, provenance, and safe deployment practices. Release security is critical because compromise in the release pipeline can affect every downstream customer or environment.
- Remediation
- A governance or operations concept focused on remediation as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or defin
- Remote Access Trojan
- A security attack or exploit technique associated with remote access trojan in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ear
- Remote Code Execution
- A security concept covering remote code execution and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity e
- Replay Attack
- A security attack or exploit technique associated with replay attack in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Reproducible Build
- A build process that produces bit-for-bit identical output given the same source code, build environment, and dependencies. Enables independent verification that a binary wasn't tampered with. Challenges include timestamps, randomized compilation, and non-deterministic dependency resolution. Require
- Responsible AI Security
- The combination of security, safety, privacy, and governance controls used to build and deploy AI systems in ways that reduce misuse, harm, and unintended impact. It includes model abuse prevention, data protection, evaluation, access controls, and accountability around high-risk AI behavior.
- REST API Security
- The protection of RESTful APIs against authentication flaws, authorization bypass, injection, excessive data exposure, abuse, and misuse of tokens or request semantics. REST API security depends on more than HTTPS; it requires careful design of identity, validation, rate limits, and object-level acc
- Return Oriented Programming
- A security concept covering return oriented programming and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary acti
- Revenue Security
- The protection of systems, workflows, and data that directly affect an organization's ability to earn, collect, or preserve revenue. Revenue security often includes anti-fraud controls, payment integrity, subscription abuse prevention, and safeguards around billing or monetization logic.
- Reverse Engineering
- A security concept covering reverse engineering and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ear
- Reverse Proxy Security
- The security of a reverse proxy layer that sits in front of backend services, handling tasks such as TLS termination, routing, authentication integration, filtering, and header management. Reverse proxy security matters because mistakes there can expose internal apps, break trust boundaries, or crea
- Revocation List
- A security concept covering revocation list and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier
- Risk Assessment
- A defensive security practice involving risk assessment to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary a
- Risk Matrix
- A governance or operations concept focused on risk matrix as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or defin
- Risk Register
- A governance or operations concept focused on risk register as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or def
- Root Access
- Administrative access with full control over a Unix-like system, allowing unrestricted changes to files, processes, and configuration. In practice it implies both power and risk.
- Root Access Security
- The controls and practices used to protect root-level administrative access on Unix-like systems, including MFA, bastions, logging, least privilege, and careful handling of direct root use. Because root can bypass most local controls, weak root access security often turns small incidents into full c
- Rootkit Detection
- A defensive security practice involving rootkit detection to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- Router Security
- The protection of routers and their control planes, management interfaces, firmware, routing protocols, and configuration against compromise or abuse. Router security matters because routers influence traffic flow, segmentation, visibility, and resilience across entire networks.
- Row-Level Security
- A database feature (notably in PostgreSQL) that enforces access policies on individual rows within a table, so different users or roles only see and modify the rows they are authorized to access. Policies are defined as SQL expressions evaluated on each row during SELECT, INSERT, UPDATE, or DELETE o
- Run Book Security
- The protection of operational runbooks so sensitive procedures, credentials, escalation paths, or infrastructure details are available to the right people without becoming an easy source of abuse or leakage. Run book security matters because documentation often reveals exactly how critical systems a
- Runtime Application Self-Protection
- A security concept covering runtime application self-protection and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect advers
- Runtime Security
- The monitoring and protection of applications, containers, hosts, or serverless workloads during execution. Runtime security focuses on what is actually happening live, such as process behavior, system calls, network connections, and policy violations, rather than only on predeployment risk.
- Salt
- A random value appended or prepended to a password before hashing, ensuring that identical passwords produce different hash outputs. Salts defeat precomputed attacks like rainbow tables and are stored alongside the hash in the database, typically as a per-user unique value.
- Sandbox Escape
- A security concept covering sandbox escape and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Script Kiddie
- A person who uses pre-written hacking tools and scripts without understanding how they work. The term is deeply derogatory in hacker culture, implying a lack of genuine technical knowledge or creative ability.
- Secret
- A sensitive credential — such as an API key, database password, TLS certificate private key, or OAuth token — that must be protected from unauthorized access and kept out of source control, typically managed via vaults like HashiCorp Vault, AWS Secrets Manager, or environment variables.
- Secrets Management
- A governance or operations concept focused on secrets management as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Secrets Vault
- A security concept covering secrets vault and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Secure Boot
- A security concept covering secure boot and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Secure Coding
- A security concept covering secure coding and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Secure Enclave
- A security concept covering secure enclave and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Secure Multi-Party Computation
- A security concept covering secure multi-party computation and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary a
- Secure Random
- A random number generator that draws from a cryptographically secure entropy source (such as `/dev/urandom` or the OS CSPRNG), producing output that is computationally infeasible to predict — required for generating tokens, keys, nonces, and session IDs.
- Secure Shell
- A security concept covering secure shell and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Secure Software Development Lifecycle
- A security concept covering secure software development lifecycle and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adve
- Security Advisory
- A formal notice describing a security issue, its impact, affected versions, and mitigation or upgrade guidance. In responsible disclosure culture, a good security advisory helps users act quickly without forcing them to reverse-engineer the problem from rumors.
- Security Assertion Markup Language
- A security concept covering security assertion markup language and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversa
- Security Audit
- A defensive security practice involving security audit to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary ac
- Security Awareness Training
- A defensive security practice involving security awareness training to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect
- Security by Obscurity
- A security concept covering security by obscurity and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity e
- Security Champion
- A security concept covering security champion and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Security Control
- A security concept covering security control and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Security Fix
- A code or configuration change intended to remove or mitigate a security weakness. In software maintenance culture, security fixes often require both code changes and clear communication about upgrade urgency.
- Security Group
- A security concept covering security group and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Security Headers
- HTTP response headers that instruct browsers to enable security features. Key headers: Content-Security-Policy (XSS prevention), Strict-Transport-Security (force HTTPS), X-Frame-Options (clickjacking), X-Content-Type-Options (MIME sniffing), and Referrer-Policy (data leakage). Check your score at se
- Security Information and Event Management
- A platform that collects, normalizes, correlates, and searches security logs for detection and investigation. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Security Key
- A cryptographic concept related to security key, secure communication, key handling, or trust establishment. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Security Monitoring
- A defensive security practice involving security monitoring to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversa
- Security Operations Center
- A security concept covering security operations center and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activ
- Security Orchestration
- A security concept covering security orchestration and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- Security Patch
- A patch released specifically to address a security vulnerability or harden a system against known attack paths. In operations culture, security patches are often prioritized differently from feature releases because delay directly increases risk.
- Security Policy
- A documented policy describing how security issues should be reported, handled, and disclosed for a project or organization. In open-source governance, a visible security policy lowers confusion for both researchers and maintainers during incidents.
- Security Posture
- A governance or operations concept focused on security posture as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Security Release
- A software release whose primary purpose is to deliver one or more security-related fixes. In maintenance culture, security releases are usually communicated with more urgency and less marketing language than ordinary feature releases.
- Security Token
- An identity or access control concept centered on security token and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Sensitive Data Exposure
- A security concept covering sensitive data exposure and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- Serialization Attack
- A security attack or exploit technique associated with serialization attack in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ear
- Server-Side Request Forgery
- A security concept covering server-side request forgery and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary acti
- Service Account
- A non-human identity used by applications, services, or automation to authenticate and interact with APIs and cloud resources. Unlike user accounts, service accounts use API keys, tokens, or certificates instead of passwords and don't have interactive login capabilities.
- Service Principal
- An identity or access control concept centered on service principal and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ea
- Session Fixation
- A security concept covering session fixation and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Session Hijacking
- A security attack or exploit technique associated with session hijacking in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Session Management
- A governance or operations concept focused on session management as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Session Replay
- A security concept covering session replay and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Shadow IT
- A security concept covering shadow it and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or d
- Shift Left Security
- A security concept covering shift left security and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ear
- Side-Channel Attack
- A security attack or exploit technique associated with side-channel attack in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earl
- Signal Intelligence
- A security concept covering signal intelligence and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ear
- Signature-Based Detection
- A defensive security practice involving signature-based detection to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect a
- Single Sign-On Security
- A security concept covering single sign-on security and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- Smash the Stack
- A phrase from classic exploitation culture referring to corrupting the call stack, especially through stack-based buffer overflows, to hijack execution. It also echoes the famous security text with the same wording.
- Smishing
- A security concept covering smishing and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or de
- Social Engineering Attack
- A security attack or exploit technique associated with social engineering attack in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activit
- Software Bill of Materials
- A security concept covering software bill of materials and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activ
- Software Composition Analysis
- A defensive security practice involving software composition analysis to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, dete
- Software Supply Chain
- A security concept covering software supply chain and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity e
- Spectre
- A class of hardware vulnerabilities (disclosed January 2018) that exploit speculative execution in modern CPUs to trick a process into leaking data from its own or other processes' memory through timing side channels. Unlike Meltdown, Spectre affects nearly all modern processors (Intel, AMD, ARM) an
- Spyware
- A security attack or exploit technique associated with spyware in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or defi
- Stack Smashing
- A security concept covering stack smashing and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Static Analysis Tool
- A tool that examines source code, bytecode, or binaries without executing the program, looking for bugs, security issues, style violations, or risky patterns. Static analysis tools are commonly integrated into CI and review workflows.
- Static Application Security Testing
- A code analysis approach that finds security flaws in source or bytecode before the application runs. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or d
- Steganography Detection
- A defensive security practice involving steganography detection to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adv
- Stored XSS
- A security concept covering stored xss and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Subdomain Takeover
- A security attack or exploit technique associated with subdomain takeover in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- subresource integrity
- A browser security feature that verifies external resources (scripts, stylesheets) haven't been tampered with by comparing their content against a cryptographic hash specified in the HTML tag's integrity attribute. SRI protects against CDN compromises and supply chain attacks — if the file's hash do
- Supply Chain Compromise
- A security concept covering supply chain compromise and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- Supply Chain Nightmare
- A dependency situation so tangled or risky that any compromise, update, or provenance question becomes alarming. In engineering slang, supply chain nightmare describes the feeling of losing confidence in what your software is built from.
- Supply Chain Security
- Protecting the integrity of software by securing every component in the supply chain — source code, build systems, dependencies, CI/CD pipelines, and artifact registries. High-profile attacks (SolarWinds, Codecov, ua-parser-js) showed that compromising a single dependency can breach thousands of dow
- Suricata
- An open-source intrusion detection and network security monitoring engine.
- SYN Flood
- A security attack or exploit technique associated with syn flood in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or de
- System Hardening
- A governance or operations concept focused on system hardening as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- System Prompt Extraction
- An attack or testing technique aimed at getting a model to reveal its hidden system prompt or internal instructions.
- Tabletop Exercise
- A defensive security practice involving tabletop exercise to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- Tailgating
- A security concept covering tailgating and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Tarpit
- A system, design, or environment that is easy to enter but difficult to escape because of hidden complexity, lock-in, or endless edge cases. In security, a tarpit can also refer to a defensive mechanism that deliberately slows hostile activity.
- TCP Reset Attack
- A security attack or exploit technique associated with tcp reset attack in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier
- Telemetry Security
- A network or infrastructure security concept involving telemetry security and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect ad
- Threat Detection
- A defensive security practice involving threat detection to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- Threat Feed
- A security concept covering threat feed and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Threat Hunting
- A defensive security practice involving threat hunting to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary ac
- Threat Intelligence Platform
- A security concept covering threat intelligence platform and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary act
- Threat Landscape
- A governance or operations concept focused on threat landscape as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Threat Modeling
- A structured process for identifying security threats, attack vectors, and mitigations during the design phase — before code is written. Common frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege), DREAD (risk scoring), and attack trees. Much che
- Threat Surface
- A governance or operations concept focused on threat surface as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or de
- Tiger Team
- A small, focused group assembled to solve a high-priority problem such as an incident, security issue, launch blocker, or strategic technical challenge. The term implies elite concentration of expertise and temporary mission-oriented authority.
- TLS handshake
- The multi-step negotiation process that establishes an encrypted connection between a client and server. During the handshake, the parties agree on a TLS version, select cipher suites, authenticate the server's certificate, and derive shared session keys. TLS 1.3 reduced this from two round-trips to
- TOFU
- Short for Trust On First Use, a security model where a key or identity is accepted the first time it is seen and treated as trusted afterward unless it changes. It is common in tools like SSH and illustrates a pragmatic compromise between usability and stronger verification.
- Tor Project
- The open-source project and organization behind Tor, which routes internet traffic through relays to improve privacy and anonymity.
- Traffic Analysis
- A defensive security practice involving traffic analysis to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- Transport Layer Security
- The cryptographic protocol family used to secure network sessions such as HTTPS, SMTP, and VPN traffic. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Trapdoor
- A security concept covering trapdoor and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or de
- Trivy
- A security scanner for container images, filesystems, repositories, and related software artifacts.
- Trojan Horse
- A security attack or exploit technique associated with trojan horse in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Trust Anchor
- A security concept covering trust anchor and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Trust Boundary
- An identity or access control concept centered on trust boundary and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Trust but Verify
- A principle that accepts cooperation or assumptions provisionally but still requires evidence, checks, or monitoring before relying on them completely. Engineers use it in code review, security, integrations, and operational readiness.
- Trusted Computing
- A security concept covering trusted computing and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earli
- Trusted Execution Environment
- A security concept covering trusted execution environment and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary ac
- Trust Store
- A security concept covering trust store and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- Two-Factor Fatigue
- The exhaustion or desensitization caused by frequent two-factor authentication prompts, which can make users careless or more susceptible to prompt-bombing attacks. The phrase connects security design with real human limits.
- Two-Person Integrity
- A security concept covering two-person integrity and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ea
- Type Confusion
- A security concept covering type confusion and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- UAC Bypass
- A security attack or exploit technique associated with uac bypass in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or d
- Unauthorized Access
- An identity or access control concept centered on unauthorized access and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- URL Filtering
- A security concept covering url filtering and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- URL Parser
- A component that decomposes a URL string into its constituent parts — scheme, authority (host and port), path, query parameters, and fragment — according to RFC 3986 or the WHATWG URL Standard. Inconsistencies between parsers are a known source of SSRF and open-redirect vulnerabilities.
- Use After Free
- A security concept covering use after free and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- User Provisioning
- An identity or access control concept centered on user provisioning and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ea
- Validation
- The process of checking that data conforms to expected rules — such as type, format, range, and business constraints — before it is accepted for processing or storage. Validation should occur at system boundaries (API inputs, form submissions, file uploads) and is a first line of defense against inj
- Vaultwarden
- A lightweight self-hosted password-manager server compatible with the Bitwarden ecosystem.
- VLAN
- Virtual Local Area Network — a method of creating logically separate networks on the same physical switch infrastructure by tagging Ethernet frames with a VLAN ID. VLANs isolate broadcast domains, improve security by segmenting traffic, and allow network topology to be reconfigured in software witho
- VPC Peering
- A networking connection between two Virtual Private Clouds that enables private IP communication without traversing the public internet. Traffic stays on the cloud provider's backbone network. Non-transitive by default — if VPC-A peers with VPC-B and VPC-B peers with VPC-C, A cannot reach C.
- VPN Split Tunneling
- A network or infrastructure security concept involving vpn split tunneling and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect a
- VPN Tunnel
- A network or infrastructure security concept involving vpn tunnel and the protection or inspection of traffic and services. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- Vulnerability
- A security concept covering vulnerability and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Vulnerability Assessment
- A defensive security practice involving vulnerability assessment to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect ad
- Vulnerability Chaining
- A security concept covering vulnerability chaining and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity
- Vulnerability Disclosure
- A security concept covering vulnerability disclosure and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activit
- Vulnerability Fix
- A change that removes or mitigates a specific vulnerability in software or infrastructure. In security operations, vulnerability fixes need clear mapping to affected versions so teams know whether they are still exposed.
- Vulnerability Management
- A governance or operations concept focused on vulnerability management as part of ongoing security management. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earl
- Vulnerability Patch
- A patch issued to correct a known vulnerability or reduce the risk from it. In practical security work, vulnerability patches are judged not only by technical correctness but by how quickly and clearly they can be deployed.
- Vulnerability Report
- A security disclosure submitted to a project or vendor describing a flaw, its impact, reproduction details, and often mitigation suggestions. Good vulnerability reports enable faster validation, coordinated disclosure, and safer remediation.
- Vulnerability Scanning
- A defensive security practice involving vulnerability scanning to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adve
- WAF Bypass
- A security attack or exploit technique associated with waf bypass in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or d
- War Dial
- A security term, sometimes used slangily, for systematically calling or probing many targets to find responsive ones. In engineering talk, it also appears metaphorically for broad indiscriminate scanning behavior.
- Watering Hole
- A security concept covering watering hole and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier,
- Web Cache Poisoning
- A security concept covering web cache poisoning and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity ear
- Web Crypto API
- A browser-native JavaScript API (window.crypto.subtle) that exposes cryptographic primitives — hashing (SHA-256/384/512), HMAC, symmetric encryption (AES-GCM/CBC/CTR), asymmetric key operations (RSA, ECDSA, ECDH), and key derivation (PBKDF2, HKDF) — all running in constant-time native code rather th
- Web Shell
- A security concept covering web shell and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or d
- WebSocket Hijacking
- A security attack or exploit technique associated with websocket hijacking in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earl
- White Box Testing
- A defensive security practice involving white box testing to measure exposure, improve controls, or find malicious activity. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary
- White Hat
- A security researcher or hacker who works with authorization or with an explicitly defensive intent, such as improving systems through testing, audits, or responsible disclosure. The term contrasts with black hat and gray hat categories.
- Whitelisting
- A security concept covering whitelisting and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, o
- Wide Open
- Completely exposed, unrestricted, or lacking meaningful controls. In engineering slang, a system left wide open is practically inviting trouble.
- Wi-Fi Deauthentication
- An identity or access control concept centered on wi-fi deauthentication and how systems verify or authorize actions. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activi
- Windows Defender
- A security concept covering windows defender and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Wire Fraud
- A security concept covering wire fraud and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or
- WireGuard
- A modern VPN protocol and implementation known for simplicity, performance, and strong cryptographic design.
- Wireshark Filter
- A security concept covering wireshark filter and its role in protecting systems, users, data, or operations. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlie
- Worm Virus
- A security attack or exploit technique associated with worm virus in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or d
- Yubikey Manager OSS
- The open-source tooling used to manage and configure YubiKey hardware security keys and related settings.
- Zero Day Exploit Culture
- The norms, incentives, and prestige structures around discovering, trading, discussing, or mythologizing zero-day vulnerabilities and exploits. It spans security research, bug bounties, exploit brokers, state actors, and media fascination with rare offensive capability.
- Zero-Day Patch
- A patch released in response to a zero-day vulnerability, often under urgent conditions because active exploitation is possible or already happening. The term implies both the seriousness of the flaw and the speed required from maintainers and operators.
- Zip Bomb
- A security attack or exploit technique associated with zip bomb in real-world systems and networks. It shows up in application security, identity, infrastructure, or incident response work depending on the environment. Teams use the concept to prevent abuse, detect adversary activity earlier, or def