All resources Glossary
Resources · Glossary
Security operations glossary
Short, plain definitions of the terms security teams use every day: MITRE ATT&CK tactics and techniques with their IDs, the Unified Kill Chain, SOC vocabulary, AI security and post-quantum cryptography.
MITRE ATT&CK tactics and techniques
- MITRE ATT&CK ATT&CK
A public knowledge base of adversary tactics and techniques based on real-world observations, maintained by MITRE. Security teams use it as a common language to describe attacks, map detections and find coverage gaps.
- Reconnaissance TA0043
The adversary is gathering information to plan future operations, such as scanning exposed services, collecting employee names or probing public applications.
- Resource Development TA0042
The adversary is establishing resources to support the operation, such as acquiring infrastructure, registering domains, compromising accounts or preparing tools.
- Initial Access TA0001
The adversary is trying to get into the network, for example through phishing, an exploited public-facing application or valid stolen credentials.
- Execution TA0002
The adversary is trying to run malicious code on a local or remote system, often through scripting interpreters, scheduled tasks or management tools.
- Persistence TA0003
The adversary is trying to keep its foothold across restarts, changed credentials and other interruptions, for example with new accounts, services or scheduled tasks.
- Privilege Escalation TA0004
The adversary is trying to gain higher-level permissions, such as local administrator, root or domain administrator rights.
- Stealth TA0005
The adversary is trying to hide its actions and appear as normal behaviour, blending in with legitimate activity or reducing observable signals. In 2026 ATT&CK split the former Defense Evasion tactic into Stealth, which keeps TA0005, and Defense Impairment.
- Defense Impairment TA0112
The adversary is trying to degrade, disable or undermine security controls and monitoring, so defenders cannot see or trust what is happening.
- Credential Access TA0006
The adversary is trying to steal account names, passwords, tokens or keys, for example by dumping credentials or brute-forcing logins.
- Discovery TA0007
The adversary is trying to learn about the environment: systems, accounts, network layout and security tools, to decide what to do next.
- Lateral Movement TA0008
The adversary is trying to move through the environment from one system to another, often with remote services and valid accounts.
- Collection TA0009
The adversary is gathering data of interest to its goal, such as files, emails, screenshots or database contents, before taking it out.
- Command and Control TA0011
The adversary is trying to communicate with compromised systems to control them, usually by mimicking normal traffic to avoid detection.
- Exfiltration TA0010
The adversary is trying to steal data by moving it out of the network, for example over a command channel or a web service.
- Impact TA0040
The adversary is trying to manipulate, interrupt or destroy systems and data, for example by encrypting data for ransom or wiping disks.
- Command and Scripting Interpreter T1059
Abusing command and script interpreters such as PowerShell, the Windows command shell, Unix shells or Python to run commands and scripts. A tactic of Execution.
- Valid Accounts T1078
Using the credentials of existing accounts to gain access, persist, escalate privileges or stay hidden. Activity looks legitimate, so it is best judged against the account’s normal behaviour.
- Brute Force T1110
Guessing or systematically trying passwords to get into accounts, including password spraying and credential stuffing with passwords leaked elsewhere.
- Exploit Public-Facing Application T1190
Exploiting a weakness in an internet-facing application or service, such as a website, API or VPN appliance, to get initial access.
- OS Credential Dumping T1003
Extracting account credentials from the operating system, for example from LSASS memory, the SAM database or domain controller data.
- Remote Services T1021
Using valid accounts to log into services that accept remote connections, such as RDP, SMB, SSH or WinRM, to move laterally.
- Data Encrypted for Impact T1486
Encrypting data on target systems to make it unavailable, typically in ransomware attacks that demand payment for the key.
- Phishing T1566
Sending deceptive messages, with attachments, links or through third-party services, to trick people into giving access or running malicious code.
- Windows Management Instrumentation T1047
Abusing WMI to run commands and gather information on local or remote Windows systems, often blending in with normal administration.
- Scheduled Task/Job T1053
Abusing task scheduling features such as Windows Task Scheduler, cron or systemd timers to run code at set times, for execution or persistence.
- Application Layer Protocol T1071
Hiding command-and-control traffic in common application protocols such as HTTP(S), DNS or mail, so it blends in with normal traffic.
- Exfiltration Over Web Service T1567
Sending stolen data out through a legitimate web service, such as cloud storage or a code repository, instead of the adversary’s own server.
Unified Kill Chain
- Unified Kill Chain UKC
A model of attack phases published by Paul Pols in 2017 that combines the classic cyber kill chain with MITRE ATT&CK. It describes 18 phases grouped into three stages: In, Through and Out.
- In (initial foothold)
The first UKC stage, gaining a foothold: Reconnaissance, Weaponization, Delivery, Social Engineering, Exploitation, Persistence, Defense Evasion and Command & Control.
- Through (network propagation)
The second UKC stage, spreading through the network: Pivoting, Discovery, Privilege Escalation, Execution, Credential Access and Lateral Movement.
- Out (action on objectives)
The final UKC stage, achieving the goal: Collection, Exfiltration, Impact and Objectives.
- Weaponization
UKC phase in which the attacker prepares what the attack needs, such as infrastructure, exploits and payloads, before reaching the target.
- Delivery
UKC phase in which the weaponised object, such as a malicious file or link, is transmitted to the target environment.
- Exploitation
UKC phase of abusing a vulnerability or weakness to run code or gain access on the target system.
- Pivoting
UKC phase of routing traffic through a compromised system to reach systems that are not directly accessible to the attacker.
- Objectives
The last UKC phase: the strategic goal the attack was meant to achieve, such as financial gain, espionage or disruption.
SOC terms
- Security Information and Event Management SIEM
A system that collects logs and events from across the environment, stores them, and runs detection rules and searches over them.
- Security Orchestration, Automation and Response SOAR
Tools that run predefined playbooks to automate security tasks across other tools, such as enrichment, ticketing and response steps.
- Endpoint Detection and Response EDR
Software on endpoints that records activity, detects threats and lets responders act, for example by isolating a host or killing a process.
- Extended Detection and Response XDR
Detection and response that extends beyond endpoints to correlate signals from network, identity, email and cloud in one place.
- User and Entity Behaviour Analytics UEBA
Analytics that learn the normal behaviour of users, hosts and other entities and flag activity that departs from it.
- Indicator of Compromise IOC
An observable artefact, such as an IP address, domain, file hash or URL, that suggests a system may have been compromised.
- Indicator of Attack IOA
A sign of attacker behaviour in progress, such as a sequence of actions, rather than a static artefact. IOAs focus on intent and technique.
- Tactics, Techniques and Procedures TTP
How an adversary operates: the goals it pursues (tactics), the methods it uses (techniques) and its specific implementations (procedures).
- Mean Time to Detect MTTD
The average time between the start of a security incident and its detection.
- Mean Time to Respond MTTR
The average time between detecting an incident and containing or resolving it. Some teams use it for mean time to recover or remediate.
- Triage
The first assessment of an alert: deciding whether it is real, how serious it is and what should happen next.
- True positive TP
An alert that correctly flags real malicious or policy-violating activity. A benign true positive is real activity that turns out to be authorised, such as an approved scan.
- False positive FP
An alert raised on activity that is not malicious. Too many false positives waste analyst time and hide the alerts that matter.
- Alert fatigue
The desensitisation that sets in when analysts face more alerts than they can handle, leading to slower responses and missed attacks.
- Threat hunting
Proactively searching data for signs of attacks that existing detections have not caught, usually starting from a hypothesis.
- Playbook
A documented or automated sequence of steps for handling a type of alert or incident.
- Cyber Threat Intelligence CTI
Evidence-based knowledge about threats and threat actors, such as indicators, techniques and campaigns, used to inform detection and response.
- Attack Surface Management ASM
Continuous discovery and monitoring of an organisation’s internet-facing assets, such as domains, services and exposed ports, and their weaknesses.
- Common Vulnerabilities and Exposures CVE
A public catalogue that gives each disclosed software vulnerability a unique identifier, such as CVE-2024-12345, maintained by the CVE Program.
- Known Exploited Vulnerabilities KEV
A catalogue maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities with evidence of active exploitation in the wild.
- Common Vulnerability Scoring System CVSS
An open standard, maintained by FIRST, that rates the severity of a vulnerability on a scale from 0 to 10.
- Exploit Prediction Scoring System EPSS
A model published by FIRST that estimates the probability that a vulnerability will be exploited in the wild in the next 30 days.
- Managed Security Service Provider MSSP
A company that monitors and manages security for other organisations, usually running a shared SOC for many customers.
- Managed Detection and Response MDR
A managed service that provides threat detection, investigation and response, typically around the customer’s endpoint or XDR tools.
- Data sovereignty
The principle that data is subject to the laws of the country where it is collected or stored, and that its owner controls where it goes.
- Air-gapped
Describes a system or network physically isolated from the internet and other untrusted networks.
- Zero trust
A security model that grants no implicit trust based on network location: every request is authenticated, authorised and checked continuously.
AI security
- Prompt injection
An attack that places instructions in the input of a language model application to make it ignore its intended instructions or leak data.
- Indirect prompt injection
Prompt injection hidden in content the model reads on the user’s behalf, such as a web page, an email, a document or a tool’s output.
- Jailbreak
An attempt to make a language model bypass its safety rules, for example through role play or crafted wording.
- Model Context Protocol MCP
An open protocol that lets AI applications and agents connect to external tools and data sources in a standard way.
- AI gateway
A proxy between applications and AI models or tools that enforces authentication, policy, data protection, rate limits and logging on every call.
- Model distillation
Training a smaller model to reproduce the outputs of a larger one on specific tasks, so it can run faster and on modest hardware.
Cryptography
- Post-quantum cryptography PQC
Cryptographic algorithms designed to stay secure against attacks by large quantum computers, which could break today’s RSA and elliptic-curve cryptography.
- ML-KEM FIPS 203
Module-Lattice-Based Key-Encapsulation Mechanism, the post-quantum key establishment standard published by NIST in 2024, derived from CRYSTALS-Kyber.
- ML-DSA FIPS 204
Module-Lattice-Based Digital Signature Algorithm, the post-quantum signature standard published by NIST in 2024, derived from CRYSTALS-Dilithium.
- Cryptography Bill of Materials CBOM
An inventory of the cryptographic algorithms, keys, certificates and libraries a system uses, used to plan a migration to post-quantum cryptography.
- Fully homomorphic encryption FHE
Encryption that allows computation directly on encrypted data, so a server can process values without ever seeing them in clear.
- Harvest now, decrypt later HNDL
Collecting encrypted data today in order to decrypt it once quantum computers can break the encryption. Long-lived secrets are most at risk.
- Crypto-agility
The ability to replace cryptographic algorithms and keys in a system without redesigning it, which makes post-quantum migration practical.
UKC phase of manipulating people into unsafe actions, such as opening an attachment, approving a login or revealing a password.