Glossary
Botnet
A network of compromised devices, infected with malware and controlled remotely without their owners' knowledge, often used to conduct large-scale attacks such as DDoS or credential stuffing.
Business Email Compromise (BEC)
A scam in which an attacker compromises or spoofs a business email account — often impersonating an executive or vendor — to trick employees into making fraudulent payments or revealing sensitive information.
Credential Stuffing
An automated attack that tests username/password pairs leaked from one breach against many other unrelated services, exploiting the common habit of password reuse to gain unauthorized access.
DDoS (Distributed Denial-of-Service)
An attack that overwhelms a system, service, or network with a flood of traffic from many sources simultaneously, making it unavailable to legitimate users.
Data Breach
An incident in which sensitive, protected, or confidential data is accessed, disclosed, or stolen without authorization.
Digital Footprint
The trail of data a person leaves behind through online activity — social media posts, public records, metadata, account registrations — that can be pieced together to build a profile of them.
Doxxing
The act of publicly revealing someone's private or identifying information — home address, workplace, phone number — without their consent, typically intended to harass, intimidate, or expose the target.
EDR (Endpoint Detection and Response)
Security software that monitors individual devices (endpoints) for suspicious behavior in real time, and provides tools to investigate and respond to threats detected on them.
Encryption
The process of converting readable data into an unreadable format that can only be reversed with the correct key, protecting data from being read by anyone who doesn't hold that key — whether it's intercepted in transit or accessed while stored.
Exploit
A piece of code, technique, or sequence of actions that takes advantage of a specific vulnerability to cause unintended behavior — such as gaining unauthorized access or executing malicious code.
Firewall
A security system — hardware, software, or both — that monitors and controls incoming and outgoing network traffic based on defined rules, acting as a barrier between a trusted network and untrusted external traffic.
Hash Function
A mathematical function that converts data of any size into a fixed-length string (a 'hash'). Identical input always produces an identical hash, which makes hashes useful for verifying that a file or piece of evidence hasn't been altered.
IOC (Indicator of Compromise)
Forensic evidence suggesting a system has been compromised — a malicious IP address, file hash, domain, or unusual network pattern that defenders use to detect and investigate intrusions.
MITRE ATT&CK
A publicly maintained, industry-standard knowledge base cataloging real-world attacker tactics and techniques, used by defenders to describe, detect, and compare attacker behavior using a shared vocabulary.
Malware
Short for 'malicious software' — any program designed to damage, disrupt, gain unauthorized access to, or otherwise harm a system or its data. Ransomware, spyware, and trojans are all categories of malware.
Man-in-the-Middle Attack
An attack in which a threat actor secretly intercepts and potentially alters communication between two parties who believe they're communicating directly with each other.
OSINT
Open-source intelligence — the practice of collecting and analyzing information from publicly available sources (social media, public records, news, archived web content) without unauthorized access to private systems or accounts.
Patch Management
The process of identifying, testing, and applying software updates that fix known vulnerabilities, on a defined and consistent schedule rather than an ad hoc basis.
Penetration Testing
An authorized, simulated attack against a system or network conducted to identify exploitable vulnerabilities before a real attacker does.
Personally Identifiable Information (PII)
Any data that can be used, alone or combined with other information, to identify a specific individual — names, addresses, government ID numbers, and biometric data are all common examples.
Phishing
A social engineering attack that impersonates a trusted sender (a colleague, a bank, a known service) to trick a target into revealing credentials, clicking a malicious link, or taking a harmful action.
Ransomware
Malware that encrypts a victim's files or systems and demands payment — typically in cryptocurrency — in exchange for restoring access. Modern ransomware operators frequently also steal data before encrypting it, threatening to leak it as additional leverage.
SIEM (Security Information and Event Management)
A system that aggregates and analyzes log and event data from across an organization's infrastructure in real time, helping security teams detect and respond to suspicious activity.
SOC (Security Operations Center)
A centralized team (or function) responsible for continuously monitoring, detecting, and responding to security incidents across an organization's systems.
Social Engineering
Manipulating a person, rather than a technical system, into taking an action that compromises security — revealing a password, approving a fraudulent payment, or granting unauthorized access.
Threat Actor
An individual or group responsible for, or capable of, carrying out an attack against a system, network, or organization — a neutral term used regardless of the attacker's motive or sophistication.
Two-Factor Authentication (2FA)
An authentication method requiring two separate forms of verification — typically something you know (a password) and something you have (an authenticator app or hardware key) — so a stolen password alone isn't enough to access an account.
VPN (Virtual Private Network)
A service that encrypts your internet traffic and routes it through a separate server, masking your real IP address and protecting data from being intercepted on untrusted networks.
Vulnerability
A weakness in a system, application, or process that could be exploited by a threat actor to gain unauthorized access or cause harm.
Zero Trust
A security model built on the principle of never automatically trusting a request based on network location alone — every access request is verified on its own merits, regardless of whether it originates 'inside' or 'outside' a traditional network perimeter.