Cybersecurity Glossary

Advanced persistent threat (APT) is a prolonged and targeted cyberattack in which an intruder gains access to a computer network and remains undetected for an extended period.

Adversary emulation is a proactive cybersecurity practice that replicates the tactics, techniques and procedures (TTPs) used by real-world threat actors. It plays a considerable role in identifying vulnerabilities, validating response capabilities and improving overall security posture.

Alert fatigue refers to a state where cybersecurity analysts become overwhelmed by the sheer volume of alerts, making it difficult to distinguish real threats from harmless noise.

Angler phishing is a social media-based phishing attack in which scammers pose as customer support agents. The attacker creates a fake profile (often using a company’s name, logo, and branding) on a platform like Twitter/X, Facebook or Instagram.

An attack model is a structured representation of how a cyber adversary could carry out an attack against a target system or network.

It maps out the steps, tactics and techniques an attacker might use, from initial reconnaissance to achieving their end goals, providing defenders with a blueprint of potential attack paths and methods.

Attack Path Analysis (APA) is a cybersecurity technique that helps security teams visualize and mitigate potential attack routes before adversaries can exploit them. It helps organizations by understanding how attackers navigate through networks to strengthen defenses, prioritize vulnerabilities, and reduce overall exposure to threats.

Attack Surface Management (ASM) emulates the adversary reconnaissance phase to oversee and secure all attack surfaces and exposed digital assets, whether internal or external. It encompasses threat discovery, threat investigation, analysis, and remediation prioritization.

Attack Surface Reduction (ASR) is the practice of minimizing potential entry points that attackers could exploit in an organization’s IT environment. In simple terms, it means reducing the number of ways an attacker can break in by limiting common initial access points and removing unnecessary exposure.

Attack vector refers to the method or pathway used by an attacker to gain unauthorized access to a computer system or network. Common attack vectors include phishing emails, malware, and exploiting software vulnerabilities.

Automated penetration testing simulates cyberattacks to identify security weaknesses efficiently, replacing repetitive manual tasks with automation. It accelerates testing, conserves resources, and enhances accuracy by continuously validating security controls.

Breach and Attack Simulation (BAS) technology acts as an attacker in order to simulate thousands of possible threats your organization may encounter on a daily or hourly basis.

A blue team is tasked with protecting an organization’s asset against threats through gathering data, performing risk assessments, and tightening security control.

BYOVD (Bring Your Own Vulnerable Driver) attacks are cyber security attacks that exploit vulnerabilities in drivers, leveraging new techniques that allow them to evade traditional protections and maximize disruption.

Clone phishing is a sophisticated email phishing attack that deceives recipients by replicating a legitimate email they previously received.

Cloud security is a cybersecurity discipline focused on the unique challenges presented by the cloud’s dynamic and distributed nature. It goes beyond perimeter security, focusing on securing workloads, data, and access within the cloud itself.

CSPM (Cloud Security Posture Management) is a set of automated tools and practices that continuously monitor cloud environments to identify and remediate security risks, misconfigurations, and compliance violations.

A Command and Control (C2) attack is a cyberattack where attackers establish a covert communication channel between a compromised system and an attacker-controlled server. This backdoor channel allows the attacker to send commands to the infected machine and receive data from it, effectively remotely controlling the victim system.

A CVE (Common Vulnerabilities and Exposures) is a standardized identifier assigned to a publicly known software or hardware vulnerability. Think of a CVE as a unique label (like a serial number) for a specific security flaw.

Continuous Automated Red Teaming (CART) is a technology that automates Red Teaming to expand its process’ depth and breadth, enable scaling, and permit conducting red teaming exercises on a continuous basis.

Continuous security testing is the practice of challenging, measuring, and optimizing the effectiveness of security controls on an ongoing basis using automated testing tools.

Continuous Threat Exposure Management (CTEM)  is a program designed to continuously manage a digital infrastructure’s exposure to external and internal threats in a cyclic fashion The Continuous Threat Exposure Management cycle consists of 5 phases that are divided into two stages: Diagnose ( Scoping, Discovery, and Prioritization) and Action ( Validation and Mobilization).

Credential compromise happens when hackers gain unauthorized access to authentication credentials. These include usernames, passwords, API keys, and other login details.

Credential dumping is an attack technique in which adversaries extract authentication data (usernames, password hashes, Kerberos tickets, etc.) from a system’s memory or storage. In practice, attackers often target Windows systems’ Local Security Authority (LSASS) process or related stores (SAM database, registry) to harvest credentials in cleartext or hashed form.

Cyber Asset Attack Surface Management (CAASM) involves identifying, monitoring, and managing an organization’s digital assets to understand and reduce the potential unsecure points of entry that attackers can exploit. It aims to gain full visibility into all assets, including shadow IT and unmanaged devices, to mitigate risks and enhance the overall cybersecurity posture.

Developed by Lockheed Martin, the cyber kill chain is a series of steps that trace stages of a cyberattack from the early reconnaissance stages to the exfiltration of data.

A cybersecurity risk assessment identifies the various information assets that could be affected by a cyber attack.

Cyber risk quantification (CRQ) is the process of measuring and assigning numerical values to cybersecurity risks. It often translates technical risks into financial terms. This helps organizations understand how cyber threats could impact business operations.

Cyber threat management is the continuous process of identifying, assessing, prioritizing and mitigating cyber threats to minimize risk exposure and prevent breaches.

Data drift is a shift in the patterns or distributions of data over time, causing discrepancies between training and real-world data, which can reduce machine learning model performance.

Data Security Posture Management (DSPM) is a proactive approach to protecting sensitive data. It helps organizations identify risks, enforce security policies, and maintain compliance.

Detection engineering is a specialized cybersecurity discipline focused on the structured process of designing, implementing, testing and maintaining detection logic that identifies malicious activity in an environment.

A digital footprint is the trail of data created when someone interacts online, including active inputs like social media posts and passive data like browsing history. Managing a digital footprint helps protect privacy, enhance security, and mitigate risks associated with personal or organizational data exposure.

An Endpoint Protection Platform (EPP) is a security solution that protects devices like computers, mobile phones, and servers from cyber threats. It detects, prevents, and responds to attacks before they cause harm.

Enumeration is fundamentally changing security dynamics by making information gathering more accessible and efficient for both attackers and defenders.

External Attack Surface Management (EASM) is a cybersecurity practice of continuously discovering, monitoring and securing an organization’s internet-facing assets to reduce exposure to external threats.

A Golden Ticket attack is a type of cyber attack that targets the access control of a Windows environment where the Active Directory is being used. The attacker forges Kerberos Ticket Granting Tickets (TGTs), granting them unauthorized access to any service or resource in a Windows domain, often with full administrative privileges.

Hybrid cloud security is the practice of protecting data, applications, and infrastructure in environments that combine private and public cloud resources. It involves securing data flow, managing access through tools like IAM, ensuring compliance with regulations, and implementing measures such as encryption, threat detection, and automation.

Initial Access Brokers (IABs) are specialized cybercriminals who break into corporate networks and then sell that unauthorized entry to other attackers. In effect, they act as “high-value middlemen” providing “access-as-a-service,” monetizing the breach while avoiding the risk of executing the final attack.

Input validation ensures data entered into systems, such as web forms or applications, meets predefined criteria like format, type and range.

Kerberoasting is a cyberattack technique that targets the Kerberos authentication protocol within Active Directory environments. This method is commonly used for privilege escalation and identity theft in enterprise networks.

The techniques in which an attacker moves further through a network in search of valuable and secured information. The Cymulate Lateral Movement vector simulates a compromised workstation inside the organization and exposes the risk posed by a potential cyberattack or threat.

Living off the Land (LOTL) is a stealthy cyberattack technique where adversaries exploit legitimate, native tools and processes already present in a target system or network to carry out malicious actions

Managed Detection and Response (MDR) is a cybersecurity service that combines advanced threat detection technology with human expertise to continuously monitor an organization’s IT environment, hunt for threats and respond to incidents in real time

An Managed Security Service Provider (MSSP) is a service provider that provisions remote software/hardware-based information or network security services to an organization.

Mean time to detect (MTTD) is the average time it takes for an organization to identify a security threat or incident. It measures how quickly a team can spot potential breaches, vulnerabilities, or attacks.

Mean Time to Remediate (MTTR) is a key cybersecurity metric that measures how quickly an organization can identify, contain and fix a security issue after it’s detected.

The MITRE ATT&CK Framework is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

MITRE D3FEND is a structured knowledge base of defensive cybersecurity techniques that complements the ATT&CK framework by cataloging countermeasures to adversary tactics.

Network penetration testing is a proactive cybersecurity method that simulates real-world attacks to uncover and assess exploitable vulnerabilities in an organization’s network infrastructure

A Pass-the-Ticket (PtT) attack is a credential theft technique where an attacker steals a valid Kerberos ticket – typically a Ticket Granting Ticket (TGT) – and uses it to impersonate a user without needing their password.

A payload is malware that the threat actor intends to deliver to the victim. Payloads can remain undetected for months prior to being triggered.

A global standard that establishes a baseline of technical and operational standards for protecting account data. Payment Card Industry Data Security Standard (PCI DSS) latest available version is PCI DSS v4.0.

Penetration testing is a cyber security assessment technique where simulated cyberattacks are conducted on a system or network to identify and exploit vulnerabilities.

Phishing is a type of social engineering scam in which cybercriminals send an email that appears to come from a legit source but is intended to gain access to personal information such as passwords, login credentials, banking details, and credit cards.

Privilege Escalation occurs when a security flaw or vulnerability has been exploited to gain access to an individual’s secured account.

Proactive security focuses on incident prevention—identifying vulnerabilities, enforcing security policies, and using advanced threat detection.

Purple Teaming is a testing exercise combining the capabilities of both the red team and the blue team.. Purple Teaming promotes inter teams collaboration, expands the validation scope, and accelerates mitigation.

The Pyramid of Pain is used as a framework to illustrate the increasing difficulty for adversaries when different types of indicators of compromise (IOCs) are detected and mitigated. It ranges from simple indicators like hash values, which are easy for attackers to change, to more complex ones like Tactics, Techniques, and Procedures (TTPs), which are harder to alter and thus more painful for adversaries to circumvent.

Ransomware is a form of malicious software that encrypts a victim’s files and demands a ransom from the victim to restore access.

Reconnaissance (Recon) is considered the foothold or planning phase of an attack. Recon is the primary and most crucial stage of an attack where hackers conduct in-depth research and exploit any vulnerabilities to their advantage.

Red teams are white-hat or ethical hackers that carry out attacks in order to test the organization’s defenses – more commonly referred to as pen–testing. Blue teams complement them by acting out the defense part of the simulation.

Risk-Based Vulnerability Management (RBVM) is a strategy prioritizing software vulnerabilities remediation according to the risk they pose to the organization.

Cyber risk exposure is the sum of the vulnerabilities and risks associated with your organization’s digital footprint, including on-premises and cloud systems, applications, data, networks, and remote devices. It represents the potential for loss or damage resulting from cyber threats (including data breaches, system failures, and ransomware attacks).

A cybersecurity risk rating provides an objective, data-driven measurement of an organization’s cybersecurity posture, condensing technical security performance into a single score or grade. These cybersecurity ratings act as a “credit score” for cyber risk, enabling stakeholders to quickly grasp exposure levels.

Runtime security is the practice of protecting applications, containers, and cloud workloads while they are running by continuously monitoring their behavior and intervening in real time to stop threats.

Security Control Validation is the process of making sure that an organization’s cyber security controls are effective and functional. It validates that the implemented measures can detect, prevent, and respond to cyber threats, maintaining the desired security posture.

Security controls refer to any measure an organization puts in place to reduce the risk of breaches to information, systems, data and other infrastructure. It can be anything from physical controls such as access cards to an office environment to cyber security controls such as email and web gateways, firewalls, intrusion prevention, and data loss prevention.

Security Posture Assessment is a cyber security assessment program that is designed to give you an overall scope of your security risks and vulnerabilities. The management of the assessment is a holistic approach that combines end-to-end security validation techniques – including BAS, ASM, CART, and advanced purple teaming exercises.

Shadow IT refers to the use of software, hardware, cloud services or other IT tools within an organization without the IT department’s approval or oversight.

The term “shift left” originated in software development to denote moving tasks earlier in the Software Development Lifecycle (SDLC). In testing, it meant running quality and validation checks during development rather than at the end

SIEM correlation rules are the logic that ties together separate security events to spot threats. A correlation rule defines a pattern or sequence of events that, when observed together, indicate malicious activity.

SIEM logging is the process of collecting, normalizing, and correlating log data from across the IT environment into a centralized platform.

YAML has written textual signatures are designed to identify suspicious activity potentially related to cyber threats anomalies in log events. Sigma rules’ standardized format permits writing the rule once and applying it across various SIEM products.

The SLAM method is a phishing prevention technique that helps users identify suspicious emails by examining the Sender, Links, Attachments, and Message for potential red flags.

Snort rules are customizable pattern-matching instructions that help detect malicious network activity. Used in IDS/IPS systems, they define traffic conditions to trigger alerts or actions, inspecting packet headers and contents. Each rule includes a header and options, enabling real-time threat detection like malware, exploits, and policy violations.

Spear phishing is a targeted form of cyber attack that involves customizing fraudulent emails, messages, or requests for information in order to deceive specific individuals or organizations.

Tactics, Techniques, and Procedures (TTP) are the patterns of activities or methods associated with a specific threat actor or group of threat actors.

TPRM is the practice of identifying and mitigating risks stemming from external business partners, suppliers, service providers and other third parties.

VAPT is the security evaluation process designed to identify, assess and mitigate potential vulnerabilities in your organization’s environment. VAPT combines two distinct but complementary practices: vulnerability assessments and penetration tests.

Vulnerability Management Lifecycle (VM) is a continuous process of identifying, assessing, prioritizing, and mitigating security vulnerabilities in an organization’s digital sphere. It includes stages such as discovery, reporting, prioritization, remediation, and verification to ensure that weaknesses in the systems are effectively managed and risks are minimized.

Vulnerability prioritization is the process of sorting through detected vulnerabilities, pinpointing those that pose the highest risk, and creating a prioritized patching list designed to minimize exposure.

Vulnerability scanning is the automated process of identifying, analyzing and assessing security weaknesses in computer systems, networks, and applications. The goal of conducting a vulnerability scan is to proactively detect security flaws and weaknesses before they can be exploited by a threat actor.

A watering hole attack is a strategy where attackers compromise a website or service frequently visited by a specific target group. The attackers infect the website with malware to gain access to the visitors’ systems, such as their employer network or a service.

A web application firewall or WAF offers protection for web servers. The Cymulate Web Application Firewall (WAF) vector challenges your WAF security resilience to web payloads and assists in protecting your web apps from future attacks.

A secured Web Gateway prevents unsecured traffic from entering an internal network of an organization and helps ensure that both company and regulatory compliance policies are met. The Cymulate Web Gateway vector is designed to test your HTTP/HTTPS outbound exposure to malicious or compromised websites.

YARA rules are a powerful way of identifying and classifying malware (or other files). The rules can be customized to specific threats and attacks that a certain environment is prone to. YARA rules consist of textual descriptions and conditions that specify what to look for in files or processes to detect malicious activity.

Zero-Day vulnerabilities are flaws in a software, firmware or hardware that are unknown to the vendor at the time of the attack. The term “zero-day” refers to the fact that developers have had zero days to address and patch the flaw before it is exploited by malicious actors. An attempt to exploit a zero-day vulnerability is known as a zero-day attack.