AI Data Poisoning Protection is a category of security tools that detect and prevent malicious or corrupted data from entering AI training datasets and machine learning pipelines.
AI Governance is the set of policies, controls, and enforcement mechanisms that organizations use to manage risk, ensure compliance, and maintain accountability across AI systems and their users.
AI red teaming is the practice of running structured adversarial attacks against AI models, large language models (LLMs), and generative AI applications to find security, safety, and reliability failures before attackers do.
AI Security is the practice of protecting artificial intelligence systems, machine learning models, large language models, and AI-powered applications from cyber threats.
AI Security Posture Management (AI SPM) is a category of security tools that discover, inventory, and monitor AI assets and usage across an organization.
AI Threat Detection is a category of security operations software that uses machine learning and AI agents to identify malicious activity, correlate alerts into attack cases, and automate analyst triage workflows.
Advanced Persistent Threat Detection is the practice of identifying sophisticated, long-running intrusion campaigns that use stealthy techniques to maintain access to a target network over weeks, months, or years.
Agentic AI Security is the practice of securing autonomous AI agents, multi-agent systems, and the infrastructure they interact with, including model context protocol (MCP) servers and automated workflows.
Anti-phishing is a category of security tools that detect and block phishing emails, malicious links, and social engineering attacks before they reach or harm users.
Application Security Posture Management (ASPM) is a category of security tooling that aggregates, correlates, and prioritizes vulnerability findings across an organization's software portfolio.
Attack Path Analysis is the process of mapping how an attacker could chain together individual exposures, misconfigurations, or vulnerabilities to move from an entry point to a critical asset.
Automated Incident Response is the practice of executing containment, investigation, and remediation actions through policy-driven tooling, with or without analyst approval.
Automated Investigation is the process by which software triages a security alert, collects relevant context from across an environment, and produces a verdict or recommended action before a human analyst reviews the case.
BEC Protection is a category of email security tools designed to detect and block Business Email Compromise attacks, including CEO fraud, vendor impersonation, and wire transfer fraud.
BYOD Policy (BYOD) is a set of organizational rules that governs how employees use personal smartphones, tablets, and laptops to access company data and systems.
Backup as a Service (BaaS) is a cloud-delivered model in which a vendor manages the infrastructure, scheduling, and storage required to back up an organization's data.
Behavioral Analytics is a detection approach that identifies threats by comparing current activity against a learned baseline of normal behavior for users, devices, or other entities, rather than matching known attack signatures.
Brand Protection is the practice of detecting and removing unauthorized use of a company's brand assets, including trademark infringement, domain abuse, lookalike websites, fraudulent mobile apps, and impersonation across the web and social media.
Breach & Attack Simulation (BAS) is a category of security testing tools that automatically and continuously replay attacker techniques against an organization's live environment to verify whether security controls detect and block them.
Certificate Lifecycle Management (CLM) is the practice of automating and governing every stage of a digital certificate's life, from issuance and renewal to revocation and replacement.
Cloud Access Security Broker (CASB) is a security control point that sits between users and cloud services to enforce data security policies, provide visibility into cloud application usage, and detect threats.
Cloud Application Detection and Response (CADR) is a security category that monitors cloud-hosted and SaaS applications for active threats and automates or guides the response to those threats.
Cloud Infrastructure Entitlement Management (CIEM) is a security discipline that discovers, analyzes, and right-sizes permissions granted to human and non-human identities across cloud environments.
Cloud Investigation and Response Automation (CIRA) is a category of security tools that automatically investigate alerts, correlate threat evidence, and execute remediation actions across cloud infrastructure.
Cloud Misconfiguration is an insecure or incorrect setting in a cloud service, resource, or infrastructure component that exposes systems, data, or networks to unauthorized access or harm.
DCSync Attack is a credential-theft technique in which an attacker abuses Active Directory's domain replication protocol to request password hashes for any account, including domain administrators, without running code on a domain controller.
DDoS Mitigation is the practice of detecting and blocking distributed denial-of-service attacks before they exhaust a target's bandwidth, compute, or connection capacity.
Data Access Governance (DAG) is a set of controls and tooling that defines who can access which data, enforces those rules, and records what actually happened.
Data Exfiltration is the unauthorized transfer of data from an organization's systems to an external destination controlled by an attacker or malicious insider.
Data Masking & Synthetic Data is a set of techniques that replace or generate sensitive data so that the result looks realistic but cannot be traced back to a real person or record.
Email & Messaging Security is the set of tools and controls that protect email and messaging systems from threats such as phishing, business email compromise, malware, and domain spoofing.
Email Data Loss Prevention (Email DLP) is a category of security tools that scan outbound, and sometimes inbound, email traffic to detect and block the unauthorized transfer of sensitive data.
Email Security Platforms is a category of security products that combine anti-spam, anti-malware, email authentication, and advanced threat protection into a single system for defending organizational email.
Encryption at Rest is the practice of encrypting data while it is stored on disk, in a database, or in object storage, so that the raw bytes are unreadable without the correct decryption key.
File Integrity Monitoring (FIM) is a security control that continuously watches critical files, directories, system configurations, and registry keys for unauthorized or unexpected changes.
Firmware & Embedded Security is the practice of analyzing and protecting the low-level software baked into hardware devices, from IoT sensors and industrial controllers to automotive ECUs and network equipment.
General Data Protection Regulation (GDPR) is the European Union's primary data protection law, in force since May 2018, that sets rules for how organizations collect, store, process, and delete personal data of EU residents.
Governance Risk and Compliance Platforms is a category of integrated software that combines governance, risk management, and compliance functions into a single system.
Governance, Risk, and Compliance (GRC) is a discipline that combines policies, risk management processes, and regulatory compliance activities into a coordinated program.
HIPAA Security Rule (HIPAA) is a US federal regulation that sets minimum standards for protecting electronic protected health information (ePHI) held or transmitted by covered entities and their business associates.
Hardware Security Module (HSM) is a dedicated physical device that stores cryptographic keys and performs encryption, decryption, and signing operations inside tamper-resistant hardware.
Honeypots & Deception is a security operations discipline that deploys fake systems, credentials, and network assets to attract attackers, detect intrusions early, and collect intelligence on attacker behavior.
Human Risk Management (HRM) is a security discipline that measures the security-related behaviors of individual employees, scores their risk level, and delivers targeted interventions to reduce that risk.
ISO 27001 (ISO 27001) is the international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System.
IT Risk Management (ITRM) is the practice of identifying, measuring, and tracking technology and cyber risks in financial and operational terms so that organizations can make informed decisions about where to invest in controls.
IT/OT Convergence is the integration of information technology (IT) networks with operational technology (OT) systems such as industrial controllers, sensors, and physical machinery.
Identity Governance and Administration (IGA) is a framework of policies and software that controls who has access to what across an organization, and proves that access is appropriate.
Identity Threat Detection and Response (ITDR) is a security discipline that monitors identity systems, detects attacks targeting accounts and credentials, and triggers automated or guided responses to stop identity-based threats.
Identity verification is the process of confirming that a person is who they claim to be by checking government-issued documents, biometric data, or other signals against trusted sources.
Identity and Access Management (IAM) is the discipline of defining and controlling who can access which resources, under what conditions, and with what level of privilege.
Just-in-Time Access (JIT access) is a security practice that grants elevated or privileged access only when a user requests it, for a defined and limited period, then automatically revokes that access when the window expires.
Kerberoasting is an Active Directory attack technique in which an attacker requests Kerberos service tickets for accounts with registered Service Principal Names, then cracks those tickets offline to recover plaintext service account passwords.
LLM Guardrails is a category of runtime security controls that sit between users and large language model applications to detect and block prompt injection attacks, jailbreaks, data leakage, and harmful outputs.
Large Language Model Security (LLM security) is the practice of protecting LLM-based applications from attacks and failures such as prompt injection, jailbreaks, sensitive data leakage, and unsafe model actions.
Lateral Movement is a set of techniques attackers use to move from one compromised system to other systems inside a network after gaining initial access.
Least Privilege is a security principle that says every user, process, or system should have only the permissions required to complete its task, and no more.
MFA & Passwordless is the category of authentication technologies that verify user identity using two or more factors, or eliminate passwords entirely.
MFA Fatigue Attack is a social engineering technique where an attacker who already has a victim's password sends repeated push notification approval requests until the user accepts one out of frustration or confusion.
Machine Learning Threat Detection is the practice of training statistical models on security data so they can classify activity as malicious, benign, or suspicious, including threats that have no known signature.
Managed Detection and Response (MDR) is an outsourced security service in which a provider's analysts monitor an organization's environment around the clock, investigate alerts, and contain or remediate threats on the customer's behalf.
NIS2 Directive (NIS2) is a European Union law that sets mandatory cybersecurity and incident-reporting obligations for organizations operating in critical sectors across EU member states.
NIST Cybersecurity Framework (NIST CSF) is a voluntary framework published by the National Institute of Standards and Technology that organizes cybersecurity activities into six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Network Access Control (NAC) is a network security discipline that decides which devices and users are allowed to connect to a network and under what conditions.
Network Detection and Response (NDR) is a security technology category that monitors network traffic to detect threats, investigate incidents, and trigger automated or analyst-driven responses.
Network Sandboxing is a security technique that executes suspicious files and URLs inside isolated virtual environments to observe their behavior and detect malware before it reaches production systems.
Next-Generation Firewall (NGFW) is a network security device that inspects traffic beyond port and protocol, adding application identification, user-based policy enforcement, and deep packet inspection to traditional firewall controls.
OT Asset Discovery is the process of automatically identifying, cataloging, and profiling operational technology devices on industrial and cyber-physical networks.
OT Network Segmentation is the practice of dividing operational technology networks into isolated zones to prevent unauthorized traffic from moving between OT systems, IT networks, and external connections.
OT Vulnerability Management (OT VM) is the practice of identifying, prioritizing, and remediating security weaknesses in operational technology environments, including industrial control systems, SCADA systems, and IIoT devices.
PCI DSS (PCI DSS) is a global security standard that defines how organizations must protect payment card data during storage, processing, and transmission.
Pass-the-Hash is a credential theft technique in which an attacker uses a stolen NTLM or LM password hash to authenticate to a remote system without knowing the plaintext password.
Password Management is the practice and tooling used to securely store, generate, share, and rotate passwords and other credentials across individuals and organizations.
Password Spraying is an attack technique where an adversary tries a small number of commonly used passwords against a large number of accounts, cycling slowly enough to avoid triggering account lockout policies.
Penetration Testing (Pentest) is a structured, authorized attempt to exploit vulnerabilities in systems, networks, or applications before attackers do.
Penetration Testing is an authorized, simulated attack against a system, network, or application carried out to find exploitable weaknesses before real attackers do.
Quantum Key Distribution (QKD) is a method of exchanging cryptographic keys over optical links using individual photons, where any eavesdropping attempt disturbs the quantum states and is physically detectable.
Ransomware is malware that encrypts a victim's files or threatens to publish stolen data, then demands payment in exchange for a decryption key or silence.
Real-Time Threat Intelligence is the continuous delivery of threat indicators and contextual data with low enough latency to feed automated detection and blocking systems before an attack progresses.
Recovery Time Objective (RTO) is the maximum amount of time an organization can tolerate a system, application, or process being unavailable after a disruption before the impact becomes unacceptable.
Red-Team & Adversary Emulation is a category of offensive security tools that simulate real attacker tactics, techniques, and procedures against an organization's own environment.
Remote Browser Isolation (RBI) is a security technique that runs web browsing activity on a remote server or cloud environment instead of on the user's device.
Risk assessment is the structured process of identifying, analyzing, and prioritizing cybersecurity risks to an organization's systems, data, and operations.
SCADA Security is the practice of protecting supervisory control and data acquisition systems from cyber attacks, unauthorized access, and operational disruption.
SD-WAN (SD-WAN) is a software-defined approach to managing wide area networks that steers traffic across multiple links, such as broadband, MPLS, or LTE, based on policy rather than static routing.
SOC 2 (SOC 2) is an audit report issued by an independent CPA firm that evaluates whether a service organization's controls meet the AICPA's Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy.
SaaS Security Posture Management (SSPM) is a category of security tools that continuously assess and remediate misconfigurations, excessive permissions, and policy drift across an organization's SaaS application portfolio.
Secrets Detection is the practice of automatically scanning source code, repositories, CI/CD pipelines, and infrastructure for hardcoded credentials, API keys, tokens, and other sensitive values that should not be exposed.
Secrets Management is the practice of storing, rotating, and brokering non-human credentials, such as API keys, tokens, certificates, and database passwords, so that applications and automated pipelines can retrieve them securely at runtime.
Secrets Sprawl is the uncontrolled accumulation of credentials, API keys, tokens, and certificates across codebases, CI/CD pipelines, chat logs, and cloud environments.
TLS Inspection is the process of decrypting encrypted TLS traffic at a security control, examining the plaintext content, and re-encrypting it before forwarding it to its destination.
Tabletop Exercise (TTX) is a discussion-based rehearsal in which key decision makers talk through their responses to a simulated incident scenario without activating real systems or defenses.
Third-Party Risk Management (TPRM) is the practice of identifying, assessing, and monitoring the cybersecurity and operational risks that vendors, suppliers, and other external partners introduce to an organization.
Threat & Vulnerability Management (TVM) is the discipline of continuously finding, prioritizing, and remediating security weaknesses before attackers can exploit them.
Threat hunting is the practice of proactively searching an organization's environment for attackers or malicious activity that has evaded automated defenses.
Threat Intel Feeds is a category of data services that deliver structured, continuously updated information about known and emerging threats, such as malicious IP addresses, domains, file hashes, CVEs, and attacker tactics.
User and Entity Behavior Analytics (UEBA) is a security technology that builds baseline behavioral profiles for users, devices, and other entities, then alerts on statistically significant deviations from those baselines.
Virtual Patching is a security technique that blocks exploitation of a known vulnerability at the network or application layer without modifying the vulnerable system itself.
Virtual Private Network (VPN) is a technology that creates an encrypted tunnel between a device and a destination network over a public or untrusted connection.
Vishing is a social engineering attack that uses phone calls or voicemails to trick people into revealing sensitive information, transferring money, or granting system access.
Vulnerability Assessment (VA) is the process of scanning systems, networks, applications, and cloud assets to identify, classify, and prioritize security weaknesses before attackers can exploit them.
Vulnerability Scanning is the automated process of probing systems, networks, and applications against a database of known weaknesses to identify security flaws before attackers can exploit them.
Web Application Firewall (WAF) is a security control that sits in front of a web application and inspects incoming HTTP and HTTPS traffic, blocking requests that match known attack patterns.
Workload Identity is a cryptographically verifiable identity assigned to a software workload, such as a container, microservice, or AI agent, so it can authenticate to other systems without embedding static secrets like passwords or API keys in code or configuration.
Workload Protection is a category of host-agent security software that hardens, monitors, and defends servers and workloads running on Windows or Linux, whether on-premises or in hosted environments.
Zero Standing Privilege (ZSP) is a security principle that eliminates permanently assigned elevated accounts, requiring all privileged access to be granted on demand and revoked when the task is complete.
Zero Trust Architecture (ZTA) is a security design principle that removes implicit trust from any network location, user, or device, and instead requires continuous verification, least-privilege access, and an assumed-breach posture for every request.
Zero Trust Network Access (ZTNA) is a network security model that grants users and devices access only to the specific applications and resources they are authorized for, verified continuously on every request.
Zero-Day Vulnerability is a security flaw in software or hardware that is unknown to the vendor and therefore has no official patch at the time it is discovered or exploited.
Bug Bounty is a crowdsourced security model in which organizations invite independent security researchers to find and report vulnerabilities in exchange for monetary rewards.
Business Continuity Planning (BCP) is the process of identifying threats to operations and creating documented plans to keep critical business functions running during and after a disruption.
Cloud Security is the set of tools, practices, and controls that protect cloud infrastructure, workloads, applications, and data from misconfiguration, unauthorized access, and active threats.
Cloud Security Posture Management (CSPM) is a category of security tools that continuously scan cloud environments for misconfigurations, policy violations, and compliance gaps across providers such as AWS, Azure, and GCP.
Cloud storage security is the practice of scanning and protecting files stored in cloud object storage services such as AWS S3, Azure Blob, Google Cloud Storage, and EFS.
Cloud Web Application and API Protection (WAAP) is a category of cloud-delivered security services that protect web applications and APIs from attacks such as SQL injection, cross-site scripting, DDoS floods, and malicious bot traffic.
Cloud Workload Protection Platform (CWPP) is a security tool that protects cloud workloads, including virtual machines, containers, and serverless functions, at runtime across AWS, Azure, and GCP.
Cloud-Native Application Protection Platform (CNAPP) is a unified security platform that combines multiple cloud security disciplines into a single product to protect cloud-native applications from development through runtime.
Cloud-Native SIEM is a security information and event management architecture built entirely on cloud storage and compute, replacing physical or virtual appliances with elastic, pay-as-you-go infrastructure.
Communications Archiving & Compliance is a category of tools that capture, store, and supervise digital communications, including email, chat, and social media, to meet regulatory retention and review requirements.
Compliance Management is the practice of identifying applicable regulatory and security frameworks, implementing controls to meet their requirements, and maintaining evidence that those controls work.
Conditional Access is a security model that evaluates a set of policy conditions, such as user identity, device health, network location, and real-time risk signals, before granting or denying access to a resource.
Confidential Computing is a hardware-based security approach that protects data while it is actively being processed, not just when it is stored or in transit.
Container security is the practice of protecting containerized workloads, including Docker images, Kubernetes clusters, and the pipelines that build and deploy them.
Content Disarm & Reconstruction (CDR) is a file sanitization technique that strips every element from a document or file, discards anything that cannot be verified as safe, and rebuilds a clean version for the end user.
Continuous Controls Monitoring (CCM) is the automated, ongoing testing of security and compliance controls to verify they are configured correctly and working as intended.
Credential Stuffing is an automated attack in which stolen username and password pairs from one data breach are tested against other websites and applications.
Customer Identity and Access Management (CIAM) is a category of identity software that handles registration, authentication, and authorization for external users such as customers and partners.
Cyber Asset Attack Surface Management (CAASM) is a security practice and product category that gives organizations a unified, continuously updated inventory of all cyber assets and the security gaps associated with them.
Cyber Kill Chain is a seven-stage model that describes how an attacker moves from initial reconnaissance through to achieving their objective inside a target environment.
Cyber Range Training is a category of platforms and simulation environments that let security practitioners practice attack and defense techniques in isolated, realistic lab settings.
Cyber-physical security is the practice of protecting systems where digital controls directly operate physical processes, including operational technology (OT), industrial control systems, IoT devices, embedded hardware, and critical infrastructure.
Cyber-Physical Systems Protection (CPS Protection) is a security discipline that covers the identification, monitoring, and defense of networked systems where digital components directly control or interact with physical processes.
Data Privacy Management is the practice of governing how an organization collects, stores, processes, and deletes personal data to meet legal obligations and protect individual rights.
Data Protection is the set of technologies and practices that prevent unauthorized access, loss, or misuse of sensitive data across an organization's systems, endpoints, and cloud environments.
Data Security Posture Management (DSPM) is a category of security tools that discover, classify, and assess the risk of sensitive data across cloud and on-premises environments.
Database security is the set of tools, controls, and practices that protect SQL and NoSQL databases from unauthorized access, data breaches, and misuse.
Decentralized Identity (DCI) is an approach to digital identity in which individuals and organizations hold and present their own cryptographically signed credentials, without relying on a central identity provider to store or validate them.
Deepfake detection is software that identifies synthetic or manipulated media, including AI-generated faces, voices, and video, to protect organizations from impersonation and media-authenticity attacks.
Detection engineering is the practice of systematically authoring, testing, managing, and deploying detection logic, such as SIEM correlation rules, Sigma rules, YARA signatures, and Suricata rules, to identify threats across a security operations environment.
Digital forensics is the discipline of collecting, preserving, and analyzing electronic evidence from devices, networks, and storage media in a way that maintains its integrity for investigation or legal proceedings.
Digital Risk Protection (DRP) is a category of security tools that monitor the open internet, dark web, and criminal forums for external threats targeting an organization.
Dynamic Application Security Testing (DAST) is a method of finding security vulnerabilities in a running web application or API by sending attack traffic and observing how the application responds.
Endpoint Detection and Response (EDR) is a category of security software that continuously monitors endpoint activity, records behavioral telemetry, detects threats in real time, and gives security teams the tools to investigate and contain incidents on laptops, servers, and other devices.
Endpoint Encryption is the practice of encrypting data stored on laptops, desktops, and mobile devices so that the data is unreadable without the correct credentials or key.
Endpoint Protection Platform (EPP) is a security product installed on user endpoints, such as laptops and desktops, to prevent malware, ransomware, and other threats before they execute.
Endpoint Security is the practice of protecting desktops, laptops, mobile devices, and server workloads from malware, unauthorized access, and other cyber threats.
Exact Data Matching (EDM) is a data loss prevention technique that creates cryptographic fingerprints of specific records, such as names, Social Security numbers, or account numbers, so that a DLP engine can detect those exact values in motion, at rest, or in use.
Exposure management is a continuous security practice for identifying, prioritizing, and remediating risks across an organization's entire attack surface.
Extended Detection and Response (XDR) is a security architecture that collects and correlates telemetry from endpoints, networks, cloud workloads, and identity systems into a single platform to detect and respond to threats across all of those domains.
External Attack Surface Management (EASM) is the continuous process of discovering, inventorying, and monitoring an organization's internet-facing assets to identify and reduce exposure to attack.
Immutable Backup is a backup copy that cannot be modified, encrypted, or deleted for a defined retention period, even by administrators or privileged accounts.
Incident Response Retainer is a pre-paid contractual agreement between an organization and a specialized IR firm that guarantees access to expert responders within a defined response time when a security incident occurs.
Indicators of Attack (IOA) is a concept in threat detection that describes behavioral patterns signaling an attack is actively in progress, regardless of the specific malware or tools used.
Indicators of Compromise (IOC) is a piece of forensic evidence, such as a file hash, IP address, domain name, or registry key, that signals a system has been breached or targeted.
Industrial Control System Security (ICS Security) is the practice of protecting programmable logic controllers, distributed control systems, and industrial automation networks from cyber threats.
Insider threat detection is the practice of monitoring user activity inside an organization to identify employees, contractors, or partners who may be stealing data, abusing access, or causing harm, whether intentionally or by accident.
Interactive Application Security Testing (IAST) is a method of finding security vulnerabilities in applications by instrumenting the running application and observing its behavior during execution.
Intrusion Detection and Prevention Systems (IDPS) is a category of network security tools that monitor traffic for signs of malicious activity and can automatically block or alert on threats in real time.
IoT Security is the practice of protecting Internet of Things devices, their firmware, and their network communications from unauthorized access, tampering, and exploitation.
(MFT)
Managed File Transfer (MFT) is a platform that automates, secures, and audits the movement of files between organizations, systems, and trading partners.
Mean Time to Detect (MTTD) is the average time that passes between the start of a security incident and the moment the security team becomes aware of it.
Medical Device Security is the practice of identifying, monitoring, and protecting networked clinical devices such as infusion pumps, imaging systems, and patient monitors from cyber threats.
Microsegmentation is a network security technique that divides a network into small, isolated zones and enforces access controls between individual workloads.
Mobile App Security is the practice and tooling used to protect iOS and Android applications from reverse engineering, tampering, data theft, and runtime attacks.
Mobile Data Protection is a set of technologies that prevent unauthorized access to corporate data stored on or transmitted through smartphones and tablets.
Mobile Device Management (MDM) is a category of software that lets IT and security teams centrally enroll, configure, and enforce policies on smartphones, tablets, laptops, and other endpoints.
Non-Human Identity (NHI) is the set of digital identities assigned to machines, services, workloads, APIs, and AI agents rather than to people.
Phishing is a social engineering attack in which a threat actor sends fraudulent messages, usually by email, to trick recipients into revealing credentials, transferring money, or running malware.
Phishing Simulation is a controlled security testing practice in which a platform sends fake phishing emails, and sometimes other social engineering messages, to employees to measure how many click, submit credentials, or report the attempt.
Policy management is the practice of creating, versioning, distributing, and tracking organizational security policies and procedures in a structured system.
Privilege Escalation is the act of gaining permissions beyond what was originally granted, by exploiting a vulnerability, misconfiguration, or design flaw in a system.
Privileged Access Management (PAM) is a security discipline that controls, monitors, and audits access to accounts with elevated permissions, such as system administrators, root accounts, and service accounts.
Prompt Injection is an attack technique in which malicious instructions are embedded in text that an LLM application reads, causing the model to ignore its original instructions and follow the attacker's instead.
Public-Key Cryptography (PKC) is a mathematical system that uses a paired public key and private key to encrypt data, verify identities, and sign content without requiring two parties to share a secret in advance.
Purdue Model is a reference architecture that divides industrial control system networks into a hierarchy of numbered levels, from physical field devices at Level 0 up to enterprise IT systems at Level 5.
Purple Teaming is a collaborative security practice in which offensive (red) and defensive (blue) teams work together in real time to test attacks, observe how defenses respond, and immediately improve detection and response capabilities.
Risk-Based Detection is a security approach that assigns numeric risk scores to users, devices, and sessions, then promotes only those that exceed a defined threshold into incidents for analyst review.
Role-Based Access Control (RBAC) is an access control model that assigns permissions to roles rather than to individual users, so that a user's access is determined by the role or roles they hold.
Runtime Application Self-Protection (RASP) is a security technology embedded directly inside an application that detects and blocks attacks while the application is running.
Secure Access Service Edge (SASE) is a network architecture that combines wide-area networking (SD-WAN) with a suite of cloud-delivered security services in a single platform.
Secure Collaboration & Messaging is a category of security and compliance tools that protect instant messaging, voice, video, and file-sharing activity across enterprise collaboration platforms.
Secure Enterprise Browsers is a category of hardened, IT-managed web browsers designed to enforce security controls directly at the point of web and SaaS access on employee devices.
Secure file sharing is the controlled exchange of files between users and external parties using encryption and access permissions to prevent unauthorized access.
Secure Web Gateway (SWG) is an inline security checkpoint that inspects outbound and inbound web traffic and enforces policy before connections complete.
Security Awareness Training (SAT) is a structured program that teaches employees to recognize and respond to cyber threats such as phishing, social engineering, and credential theft.
Security Incident is an event that compromises, or credibly threatens to compromise, the confidentiality, integrity, or availability of an organization's information or systems.
Security Information and Event Management (SIEM) is a platform that collects, normalizes, and correlates log and event data from across an organization's IT environment to detect threats, generate alerts, and produce compliance reports.
Security Operations is the discipline of continuously monitoring, detecting, investigating, and responding to threats across an organization's IT environment.
Security Operations Center (SOC) is the combination of people, processes, and technology that an organization uses to monitor its environment, detect threats, and respond to security incidents.
Security Orchestration Automation and Response (SOAR) is a category of platforms that connect security tools, automate repetitive analyst tasks, and execute incident response playbooks without manual intervention.
Security Scanning is the automated process of probing web applications, networks, DNS configurations, and infrastructure to detect vulnerabilities, misconfigurations, and malicious content before attackers can exploit them.
Security Service Edge (SSE) is a cloud-delivered security architecture that bundles web gateway, cloud access, and private application access controls into a single platform.
Sensitivity Labels is a data classification mechanism that attaches persistent, human-readable tags to documents, emails, and other files to indicate how sensitive the content is.
Serverless Security is the practice and tooling of protecting function-as-a-service (FaaS) workloads, such as AWS Lambda and Azure Functions, from vulnerabilities, misconfigurations, and runtime attacks.
Session Hijacking is an attack in which an adversary steals a valid session token to impersonate an authenticated user without knowing their password or satisfying MFA.
Shadow Data is sensitive information that exists in data stores outside the awareness or control of the security and data governance teams responsible for protecting it.
Shadow IT Discovery is the process of identifying cloud services, SaaS applications, AI tools, and other IT assets that employees use without formal approval or IT oversight.
Smishing is a social engineering attack that uses SMS text messages or mobile messaging apps to trick recipients into clicking malicious links, revealing credentials, or transferring money.
Software Bill of Materials (SBOM) is a machine-readable inventory that lists every component, library, and dependency included in a piece of software, along with version numbers and licensing information.
Software Composition Analysis (SCA) is a category of application security tooling that scans codebases to identify open source and third-party dependencies, flag known vulnerabilities in those dependencies, and report on license obligations.
Software Supply Chain Security is the practice of protecting every stage where code is built, tested, packaged, and delivered, from source repositories and open-source dependencies through CI/CD pipelines to the final artifact.
Spear phishing is a targeted social engineering attack in which an attacker researches a specific person or organization and crafts a deceptive message designed to trick that individual into revealing credentials, transferring funds, or installing malware.
Static Application Security Testing (SAST) is a method of analyzing source code, bytecode, or binary files for security vulnerabilities without executing the program.
Supply Chain Attack is a cyberattack that targets a vendor, open-source package, or build system to compromise the downstream customers or users who depend on it.
Threat Modeling is a structured process for identifying security risks, attack vectors, and design flaws in a system or application before code is written or deployed.