Glosario de ciberseguridad.
Definiciones en lenguaje claro de los términos por los que más nos preguntan nuestros clientes. Las escribe el equipo que ejecuta los encargos.
ABAC
Attribute based access control, or ABAC, is an authorisation model in which access decisions are computed at request time from attributes of the user, the resource, the action and the context, rather than read from a static role. The policy is a rule, and the answer can differ for the same person from one request to the next.
Access control
In security architecture, access control is the set of policies and mechanisms that decide who can read, modify or invoke a given resource. It is the control that most reports come back to, because almost every serious finding is ultimately a decision that was made in the wrong place or by the wrong component.
Account takeover
In application security, account takeover is the outcome where an attacker ends up in control of a legitimate user’s account. It is not a single technique but the result several techniques converge on, and it is the term a report uses when the business needs the impact rather than the mechanism.
Active attack
An active attack is one where the adversary acts on the system: writing, modifying, executing or interrupting. It stands against the passive attack, which only observes. The distinction is not academic: it changes how each one is detected, because an active attack leaves a trace and a passive one leaves almost none.
Active Directory
Active Directory is the directory service that holds the accounts, groups, computers and policies of most corporate Windows networks, and decides who may do what across all of them. In an intrusion it is the objective rather than a component: control of the directory is control of every machine that trusts it.
AD CS abuse
AD CS abuse is the exploitation of misconfigured Active Directory Certificate Services to obtain a certificate that authenticates as another account. Because the directory accepts certificate based logon, a certificate issued for a privileged user is equivalent to that user’s credentials, and it does not change when their password does.
Admission controller
An admission controller is a component that intercepts requests to the Kubernetes API server after authentication and authorisation but before the object is persisted, and can reject or modify them. It is the point where a cluster policy is actually enforced rather than merely documented.
Advance-fee fraud (419 scam)
Advance-fee fraud, also known as the 419 scam or the Nigerian letter, promises a large sum of money and then asks for a series of small payments to unlock it. It is pure social engineering with no technical component at all, which is why no antivirus will ever see it.
Advanced persistent threat (APT)
In threat intelligence, an advanced persistent threat is a well-resourced attacker that targets a specific entity and maintains access over long periods to meet an objective. The defining words are targeted and persistent: the adversary chose you, and is prepared to stay, which changes what defence has to achieve.
Adversarial example
An adversarial example is an input crafted with a small, deliberate perturbation that causes a machine learning model to produce a wrong output while looking unchanged to a person. It is the classical attack on classifiers, and it is still what matters wherever a model makes a security or safety decision.
Adversary emulation
In offensive security, adversary emulation is a red team exercise that reproduces the specific techniques of a known threat actor, mapped to a framework such as MITRE ATT&CK, rather than testing for vulnerabilities in general. The goal is to measure whether detection and response hold against the way a real adversary operates.
Adversary-in-the-middle (AiTM)
In phishing, an adversary-in-the-middle attack places a reverse proxy between the victim and the real site, relaying the whole login in real time and keeping the session cookie the site issues at the end. The victim authenticates successfully, second factor included, and the attacker walks away with the resulting session.
Adware
Adware is unwanted software whose purpose is to push advertising onto a device, usually arriving alongside something the user did mean to install.
AEPD
The AEPD, the Agencia Española de Protección de Datos, is Spain’s independent data protection supervisory authority. It is the body a Spanish organisation notifies after a personal data breach, the body that investigates and sanctions, and the source of the technical guidance most often cited in a Spanish security report.
AES (Advanced Encryption Standard)
AES is the symmetric encryption algorithm used almost everywhere to protect sensitive data, standardised by NIST in 2001 and still the default choice for confidentiality at rest and in transit.
AI agent security
AI agent security is the practice of securing software that decides its own next step and acts through tools, which makes it an autonomous actor inside your systems rather than a feature. It covers the agent’s own identity and credentials, what it may reach, the integrity of its memory and tools, and a record of everything it did.
AI supply chain
In AI security, the AI supply chain is the full set of external components a model-backed system depends on: downloaded model weights, third-party datasets, embedding stores, agent tools and the libraries around them. Treating these as a supply chain, and testing them as one, is the discipline almost no product glossary applies.
Anomaly detection
Anomaly detection identifies unusual patterns and behaviour on systems and networks: instead of describing what is bad, it describes what is normal and alerts on what departs from it.
Antispyware
Antispyware is software built specifically to detect, prevent and remove spyware: programs that install without consent and quietly collect information, monitor behaviour or send data to somebody else.
Antivirus
Antivirus software detects, blocks and removes malicious software on a device, deciding whether a file is dangerous and stopping it before it runs.
Antivirus signature
An antivirus signature is the pattern an antivirus uses to recognise a malicious file somebody has already analysed: a byte sequence, a hash, or a rule about how the file is built. It recognises the known extremely well and, by definition, does not recognise what nobody has seen yet.
Argon2id
Argon2id is a password hashing function, specified in RFC 9106, designed to be expensive in memory as well as in time. It is the current default recommendation for storing passwords, because making an attacker’s hardware buy memory is what removes the advantage that fast parallel cracking rigs otherwise have.
AS-REP roasting
AS-REP roasting is an Active Directory attack against accounts that have Kerberos pre-authentication disabled. The domain controller will return an authentication response containing material encrypted with the account’s password key to anyone who asks for it, and that material is then cracked offline.
Asset inventory
An asset inventory is an authoritative and current list of the systems, services, accounts and data an organisation owns. In security it is the control everything else depends on, because scope, patching, monitoring and incident response all resolve against it: you cannot defend what is not on the list.
Assumed breach
Assumed breach is a scoping decision in which an engagement starts from a position an attacker would have to earn: a standard user account, a workstation, or a foothold in a network segment. It is a way of spending the budget on what happens after entry rather than on proving that entry is possible.
Attack path
In internal and cloud testing, an attack path is the concrete sequence of steps that connects a position an attacker can reach to a position that matters, such as an ordinary domain account to domain administrator. It is a route through relationships that already exist, not a list of vulnerabilities.
Attack surface
In security, the attack surface of an organisation is the complete set of points where someone outside it can interact with something inside it: domains, exposed services, APIs, client applications, third-party integrations and people. It is not a list of vulnerabilities. It is the list of places a vulnerability would count, and it changes daily.
Attack surface management (ASM)
In security operations, attack surface management (ASM) is the continuous discovery and assessment of external-facing assets and their exposures, from an attacker’s outside-in perspective. Its output is an inventory that is found rather than declared: the hosts, names, certificates and services that answer from the internet, whether or not anyone remembers creating them.
Authentication
In access control, authentication is the step that establishes who or what is making a request, using something the subject knows, has or is. It answers only that question. What the subject is then allowed to do is authorisation, a separate decision, and confusing the two is the reason many access control flaws exist.
Authorisation
In identity and access, authorisation is deciding what an already-authenticated identity is allowed to do. It runs after authentication has established who the caller is, and it is a per-request question rather than a per-session one, because the answer depends on the specific object and operation being requested.
Availability
Availability is one of the three pillars of information security, alongside confidentiality and integrity: the system and the data are there when the people entitled to use them need them. It is the pillar that gets the least attention at design time and the first one the business notices when it fails.
B2B (business to business)
B2B describes commercial relationships and transactions between companies. In security terms it is where one organisation’s controls stop being sufficient, because the data and the access are now shared with somebody else’s estate.
B2C (business to consumer)
B2C describes selling directly to individuals through digital channels. From a security point of view it is the model where consumer data, payment flows and account takeover become the defining risks.
Backdoor
In offensive and defensive security, a backdoor is covert access to a system that bypasses its normal authentication. It may be planted by an attacker after compromise, shipped inside a dependency or a build system, or left in place by a vendor. What defines it is the bypass, not how long it survives.
Backup
In resilience and incident recovery, a backup is a separate copy of data and configuration held so that a known-good state can be restored after loss, corruption or ransomware. What makes a copy useful is not that it exists but that it is isolated from the thing that broke and that somebody has restored from it.
Backup site
A backup site is the secondary facility an organisation can move its critical systems and data to when the primary one is unavailable, whether because of a disaster, a hardware failure or an attack.
Basic authentication
Basic authentication is the simplest way of proving who you are: a username and a password sent to a service that compares them with what it holds. In HTTP it is the Basic scheme of RFC 7617, and the name collides with something else that matters more.
Beacon
A beacon is the periodic check-in traffic sent from a compromised host to attacker infrastructure to collect commands. In red team operations the timing is the tradecraft: the interval, the random variation applied to it and the periods of silence are what decide whether the pattern is visible to a defender.
BGP hijacking
BGP hijacking is the announcement of an IP prefix by a network that has no authority over it, causing traffic destined for the legitimate holder to be routed elsewhere. It is a failure of trust in the routing system rather than a software vulnerability: routers accept the announcement because the protocol was built to.
Biometrics
Biometrics is the use of unique physical or behavioural characteristics to authenticate somebody: a fingerprint, a face, an iris, a voice. It is convenient, it is hard to forget, and it is the one credential that cannot be changed after a breach.
Blended attack
A blended attack is one where the attacker coordinates several methods and vectors at once, technical, human and sometimes physical, so that defences designed to stop any one of them are not enough.
Blue team
In security operations, the blue team is the defending side: the people and tooling focused on detecting, responding to and recovering from attacks. The term only means something in relation to an attacking side, which is why it belongs to exercise vocabulary rather than to organisational charts.
Bluetooth Low Energy (BLE) security
In device security, Bluetooth Low Energy (BLE) security concerns how a device pairs, encrypts and authenticates over the short-range radio that most connected devices carry. It matters because a weak pairing method breaks without expensive equipment, and because BLE is one of the most common wireless surfaces on the devices an IoT assessment covers.
Botnet
A botnet is a network of computing devices that have been compromised and are controlled remotely by a single operator.
Broken function level authorisation (BFLA)
In API security, broken function level authorisation is a flaw where the API checks that a caller is authenticated but not that their role is permitted to invoke that particular operation. The endpoint exists, the token is valid, and an ordinary user reaches an administrative function simply by calling it.
Broken object level authorisation (BOLA)
In API security, broken object level authorisation (BOLA) is the failure to verify that the caller is entitled to the specific object their request names. It is the first entry in the OWASP API Security Top 10 and, in an API test, the flaw that most often exposes another tenant’s records.
Brute force
In credential attacks, brute force is trying values until one works. Exhaustive search is the textbook definition and almost nobody does it: real attacks use wordlists, mutation rules and leaked material, so the practical question is never the size of the keyspace but how fast a guess can be tested.
Buffer overflow
A buffer overflow happens when a program writes more data into a temporary memory area than that area can hold, overwriting whatever sits next to it. It is one of the oldest ways to make a machine run somebody else’s instructions.
Business email compromise (BEC)
In offensive security, business email compromise (BEC) is a fraud in which an attacker uses a genuine or spoofed business email account to redirect a payment or extract sensitive data, usually with no malware at all. It is the attack with the most direct financial impact, and the one a management committee understands without translation.
Business impact analysis (BIA)
A business impact analysis (BIA) answers one question with a great many consequences: how much it hurts, and from what hour, when each business process stops working. Out of it come the order in which things have to be recovered and the deadlines that order has to meet.
Business logic flaw
In application security, a business logic flaw is a defect in what the application permits rather than in how it is coded. Every request is well formed and every technical control works; the attacker simply uses the workflow in an order, quantity or combination the designers never considered, and the application agrees.
BYOD (bring your own device)
BYOD is the practice of letting employees use their own phones, tablets and laptops for work and to reach corporate resources.
Bypass
In security, a bypass is a technique that gets around a control rather than breaking it: the control is still there and still working, and the attacker simply takes a route the control does not watch. It rarely comes from a flaw in the product. It comes from where the control sits and what it assumes.
CAPTCHA
A CAPTCHA is a test designed to tell whether the thing on the other side of a form is a person or an automated program.
CCN-STIC guides
The CCN-STIC guides are the security guidance series published by Spain’s Centro Criptológico Nacional. They are the reference an ENS audit works from, and the 800 series in particular sets out how the national security scheme is interpreted, implemented and evidenced in practice.
CDN
A CDN, or content delivery network, fronts an origin server, caches assets close to users and absorbs traffic spikes. In security terms it is a proxy layer, and the protection it provides is conditional: it holds only while the origin cannot be reached directly, which on most estates is not the case.
CERT (Computer Emergency Response Team)
A CERT, or Computer Emergency Response Team, is a specialist unit whose job is to respond to and manage information security incidents, and to coordinate that response with others.
Certificate authority (CA)
A certificate authority is the trusted entity that issues and manages digital certificates, binding an identity to a public key so that everyone relying on that certificate can believe the key belongs to who it claims.
Certificate pinning
In mobile security, certificate pinning is a defence in which an app accepts only a specific server certificate or public key, rejecting any other even if it is otherwise valid. It is the first control an assessor must get past to inspect an app’s traffic, and the honest account of it comes from someone who has bypassed it.
Chain of custody
In cybersecurity, chain of custody is the documented, controlled process that keeps digital evidence intact and provable from the moment it is collected until it is presented in a legal setting.
CIEM
Cloud infrastructure entitlement management, or CIEM, is the analysis of who and what can do what in a cloud estate: resolving granted permissions into effective permissions, and comparing those with the permissions actually used. It is the identity side of cloud security posture, and in most estates it is where the exploitable risk sits.
CIS benchmarks
CIS Benchmarks are consensus configuration baselines, published by the Center for Internet Security, for hardening operating systems, cloud services, containers and applications. Each benchmark is a numbered list of settings with a rationale, an audit procedure and a remediation step, grouped into profiles by how much operational disruption they cause.
CISA KEV
The CISA KEV catalogue is a public list, maintained by the United States Cybersecurity and Infrastructure Security Agency, of vulnerabilities with reliable evidence of exploitation in the wild. In vulnerability management it is used as a factual signal that something is being exploited now, rather than as a prediction that it might be.
CISO (chief information security officer)
In security governance, the CISO is the person an organisation holds accountable for its information security: they decide which risks are accepted, in what order the rest are treated, and they answer for it to whoever governs the company. It is a decision-making role rather than a technical one, and most of the confusion follows from that.
Clickjacking
Clickjacking is an attack in which a page the victim trusts is loaded invisibly inside a page the attacker controls, so a click aimed at the visible page is delivered to the hidden one. The victim performs a real, authenticated action without knowing which application received it.
Cloud attack path
In cloud security, a cloud attack path is the chain of permissions and identity relationships that leads from an attacker’s starting position to the data or control they want, one grant at a time. Presenting the result of a cloud test as this chain, rather than a list of scanner alerts, is what distinguishes it from a posture tool.
Cloud misconfiguration
In cloud security, a cloud misconfiguration is a permissive or mistaken setting that exposes resources or grants more access than intended: over-broad roles, unrestricted trust between accounts, mis-scoped identity federation and exposed storage. It is a leading cause of public-cloud compromise, and one a scanner finds long before an attacker needs an exploit.
Cloud security posture management (CSPM)
In cloud security, CSPM (cloud security posture management) is tooling that continuously checks a cloud estate for misconfigurations and policy violations against a baseline. It sits in a crowded acronym space next to CNAPP and CIEM, which vendors themselves often blur, and it is the tool whose output a client brings us to validate.
CMDB
A configuration management database, or CMDB, is the record of an organisation’s configuration items and, more importantly, the relationships between them. In security work it is what turns a list of hosts into a map: which service depends on which database, which application a certificate belongs to, and who owns the result.
CNAPP
A cloud native application protection platform, or CNAPP, is a product category that combines posture management, workload protection, entitlement analysis and infrastructure as code scanning in one console. The term describes a packaging decision by vendors rather than a new technique, and its value is correlation across those views.
Command and control (C2)
In offensive operations, command and control is the channel an attacker uses to operate inside a compromised network and issue instructions to their implants. It is the part of an intrusion that has to keep talking, which makes it the most reliable thing for a defender to look for and the thing an operator works hardest to hide.
Command injection
In application security, command injection is a flaw where user-controlled input reaches a system shell and is interpreted as part of the command line rather than as data. The attacker appends their own instructions to one the application intended to run, and the operating system executes both.
Computer virus
In security, a computer virus is malicious code that reproduces by inserting a copy of itself into another program, document or boot sector, so it needs a host and needs something or someone to run it. It is one category of malware rather than a synonym for it, because most of today’s attacks do not spread that way.
Conditional access
In cloud identity, conditional access is policy that evaluates the circumstances of a sign-in and decides what to require or refuse. Rather than a single yes or no at the password, it asks which user, from what device, in which location, to reach which application, at what assessed risk, and applies a control that fits the answer.
Container escape
In cloud security, a container escape is the act of breaking out of a container to gain access to the host it runs on. It is the finding that turns a compromised container into a compromised node, and it is what decides the severity of a Kubernetes assessment: contained application bug, or foothold on the underlying host.
Container image scanning
Container image scanning is the analysis of a built image against vulnerability data, to identify the known flaws in the operating system packages and application dependencies inside it. It describes the contents of the artefact at rest and tells you nothing about how that container behaves once it is running.
Content Security Policy (CSP)
In web security, Content Security Policy (CSP) is a response header that tells the browser which sources of script, style, frames and other resources a page is allowed to use. It is a containment control: it does not stop an injection happening, it limits what the injected content is permitted to do.
Cookie security attributes
Cookie security attributes are the flags a server sets alongside a cookie to constrain how the browser stores and sends it. In application security the ones that matter are Secure, HttpOnly and SameSite, plus the Domain and Path scope and the __Host- and __Secure- name prefixes that make the scope enforceable.
CORS misconfiguration
In API and web security, a CORS misconfiguration is a set of cross-origin resource sharing headers that grants a hostile website permission to read authenticated responses from your service. CORS relaxes the same-origin policy; configured wrongly it removes the boundary that keeps one site’s script out of another site’s data.
Credential dumping
In intrusion operations, credential dumping is the extraction of authentication material from a system an attacker already controls: password hashes, plaintext passwords, tickets and tokens. It is the step that converts control of one machine into access to others, and it is the most frequently reported technique in our internal engagements.
Credential stuffing
Credential stuffing is an attack in which someone replays username and password pairs stolen from other services against your login, betting that people reuse passwords. Nothing is guessed and nothing is cracked: every attempt uses a credential that was correct somewhere else, which is why the success rate is low and the volume enormous.
Cross-account trust
Cross-account trust is a configuration in which a role in one cloud account permits identities from another account to assume it. It is the intended way to separate environments and to grant a supplier access, and it is also the relationship that turns a compromise of one account into a compromise of several.
Cross-site request forgery (CSRF)
In web application security, cross-site request forgery (CSRF) is an attack that makes a logged-in user’s browser send a state-changing request to a site that trusts their session cookie. The user does not have to click anything on the target site: the request rides on credentials the browser attaches automatically.
Cross-site scripting (XSS)
In web application security, cross-site scripting (XSS) is a flaw that lets an attacker run their own JavaScript in another user’s browser, inside the trust boundary of your site. The browser cannot tell the injected script from yours, so the script inherits that user’s session, their cookies and everything the application lets them do.
Cryptojacking
Cryptojacking is the unauthorised use of someone else’s computing resources to mine cryptocurrency. In cloud environments it is usually the visible symptom of a compromised credential rather than the objective itself, which makes an unexplained rise in compute spend a cheap and reliable intrusion sensor.
CSP (cloud service provider)
A cloud service provider is the company that supplies computing resources as a service, from raw infrastructure to fully managed applications. Where its responsibility ends and yours begins is the first question of any cloud project.
CVE
In vulnerability management, a CVE is a public identifier assigned to a specific vulnerability in a product, so that everybody discussing it is discussing the same thing. It is a name, not a measurement: the identifier says a flaw was catalogued, and says nothing at all about how much it matters to you.
CVSS
In vulnerability management, CVSS is the Common Vulnerability Scoring System, an open framework for describing the characteristics and severity of a vulnerability as a number. It is a starting point for prioritisation and not a measure of your risk, because the score is a property of the flaw and risk is a property of your environment.
Cyber kill chain
In offensive security, the cyber kill chain is a model that breaks an intrusion into ordered stages, from reconnaissance through to actions on the objective. Introduced by Lockheed Martin, it is a planning and defence aid, and it is routinely confused with MITRE ATT&CK, which is a different kind of model.
Cyber Resilience Act
In EU regulation, the Cyber Resilience Act (CRA) sets security requirements for products with digital elements sold in the European market, covering their whole lifecycle. It reaches every manufacturer of connected products, which is exactly the client of an IoT assessment, and it links the world of devices to the world of compliance.
Dark web
The dark web is the part of the internet that is only reachable through an anonymising network such as Tor, where both the visitor and the server can stay unidentified. For a security team it matters as a marketplace: it is where stolen credentials, network access and data taken from organisations are traded and published.
DAST
In application security, DAST is dynamic application security testing: probing a running application from the outside with crafted requests and judging the responses. It has no view of the source code, so it finds what is genuinely reachable, which is both its advantage and its limit.
Data classification
In data security, data classification is the labelling of data by sensitivity so that policies about handling, storage and access can be applied. Classification enables policy; it does not apply it. Automatic enforcement depends on tools that act on the labels, and in most organisations the labelling itself is manual and ages over time.
Data leak
A data leak is an incident in which confidential, sensitive or protected information is exposed, disclosed or made reachable to people who were not authorised to see it.
Data protection impact assessment (DPIA)
In EU data protection, a data protection impact assessment (DPIA) is the analysis the GDPR requires before processing that is likely to result in a high risk to people’s rights. It is the deliverable a supervisory authority expects, and the place where a technical firm contributes the real risk picture. In Spain it is known as an EIPD.
Data protection officer (DPO)
A data protection officer is the person an organisation designates to inform, advise and monitor compliance with data protection law, and to act as the contact point for the supervisory authority and for data subjects. The role is independent by design: they report to the highest level of management and cannot be instructed on how to do the job.
DDoS
In network security, a DDoS (distributed denial-of-service) attack overwhelms a target with traffic from many sources at once, so that legitimate users cannot reach the service. The distribution across many hosts is what makes it hard to block by address and hard to absorb without dedicated capacity.
Decryption
Decryption is the process of turning encrypted data back into its original readable form. It is the half of cryptography where key management decides whether any of it worked.
Deep link hijacking
Deep link hijacking is the interception of a link intended for one mobile application by another application that has registered the same handler. Where the link carries an authorisation code or a token, the interceptor receives it, which is how an account is taken over on a device without any flaw in the server.
Deepfake
In social engineering, a deepfake is synthetic audio, video or imagery generated to impersonate a specific real person convincingly. For security purposes the important case is not the fabricated video: it is cloned voice on a telephone call, because that is the channel most organisations still treat as proof of identity.
Defacement
Defacement is the unauthorised modification of a website’s content, usually its home page, to carry a message, damage a reputation or simply demonstrate that the site could be broken into.
Defence in depth
Defence in depth is the practice of layering independent controls so that the failure of any single layer does not lead to compromise. In security architecture the operative word is independent: two controls that share an assumption, a credential or a management plane are one control drawn twice.
Degaussing
Degaussing erases magnetic media by applying a field strong enough to scramble the information it holds. It is used when retiring mechanical hard drives, tapes and magnetic stripes: done properly the data cannot be recovered, and done to a solid state drive it erases nothing at all.
Detection engineering
In defensive operations, detection engineering is the discipline of building, testing and maintaining the logic that turns telemetry into alerts, treated as software rather than as configuration. Rules have requirements, versions, tests and owners, and a rule nobody has tested against real activity is an untested assumption.
Digital forensics
In incident work, digital forensics is the collection, preservation and analysis of evidence from affected systems in order to reconstruct what happened, in what order, and by whom. Its discipline is not the analysis but the preservation: evidence that cannot be shown to be unaltered answers questions in a technical meeting and nowhere else.
Digital risk protection
In external security, digital risk protection is the monitoring of channels outside your perimeter for threats that use your name or your data: impersonation, lookalike domains, leaked credentials, exposed documents and stolen data offered for sale. Nothing it finds is on your network, which is exactly why nothing else finds it.
Digital signature
In cryptography, a digital signature proves that a message was produced by the holder of a private key and was not altered afterwards. It is the correct, valuable use of a hash function, and it underpins code signing, DNSSEC, document signing and the schemes behind qualified electronic signatures in the EU.
DLP
In data security, DLP (data loss prevention) classifies, monitors and blocks sensitive data as it leaves an organisation. The channels have moved on: alongside email and removable media, data now leaves through SaaS, browsers, personal storage, code repositories and, above all, pasting into AI assistants. It is bought inside a wider SSE or endpoint platform.
DMARC
In email security, DMARC is a policy that tells receiving mail servers what to do with a message that fails authentication and lets a domain owner collect reports on who is sending as their domain. It is the control that decides whether a spoofed phishing email is delivered, and the first thing checked on any external assessment.
DMZ (demilitarised zone)
A DMZ is a network segment that sits between an organisation’s internal network and an external one, usually the internet, so that what has to be published is not sitting next to what has to stay private.
DNS cache poisoning
In network security, DNS cache poisoning is the insertion of a forged answer into a resolver’s cache, so everyone who asks that resolver for a name is sent to an address the attacker chose. The domain’s own records are untouched and so is its registrar account: what is corrupted is the copy of the answer the resolver keeps and serves.
DNS hijacking
In network security, DNS hijacking is the redirection of traffic by tampering with how a domain resolves, at the registrar, the resolver or the record level. Because DNS is the first lookup almost every connection makes, controlling it lets an attacker send users and services to infrastructure they control.
DNS over HTTPS (DoH)
DNS over HTTPS, specified in RFC 8484, carries DNS queries inside ordinary HTTPS requests so that resolution is encrypted and indistinguishable from web traffic. It provides confidentiality for the query and says nothing about whether the answer is genuine, which is a different problem with a different solution.
DNS tunnelling
In offensive security, DNS tunnelling encodes data inside DNS queries and responses to create a covert channel for exfiltration or command and control. Because DNS is almost always allowed out, it survives egress filtering that blocks everything else, which is why a red team reaches for it when the other routes are closed.
DNSSEC
In network security, DNSSEC is a set of extensions that let a validating resolver confirm a DNS answer came from the zone’s owner and was not altered in transit. It gives authenticity and integrity, not confidentiality: the query and answer still travel in clear text. Encrypting the lookup itself is the job of DoH, DoT or DoQ.
DORA
DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, applicable since January 2025. Being a regulation it binds directly, without national transposition, and it is the only European framework that obliges some entities to undergo threat-led penetration testing on a fixed cycle.
Dropper and downloader
A dropper and a downloader are the two ways malware gets delivered onto a machine: the dropper carries the payload inside itself and writes it to disk, while the downloader carries nothing and fetches it from a server the moment it runs. Neither of them is the damage, both are the road it arrives on.
e-Government
e-Government is the delivery of administrative and public services through digital channels. It makes public services faster to reach, and it concentrates citizen data and identity in systems that have to hold.
EDR
EDR, or endpoint detection and response, is an agent installed on servers and workstations that records what processes do, flags behaviour that matches known attacker techniques, and gives a responder the ability to investigate and isolate the machine. It records first and blocks second, which is what separates it from antivirus.
EDR evasion
In offensive security, EDR evasion is the set of techniques a red team uses to run on a host without an endpoint detection and response product raising an alert. It matters because the presence of EDR is not the same as coverage, and demonstrating the gap is something no EDR vendor will write in its own glossary.
Egress filtering
Egress filtering is the control of outbound traffic leaving a network, permitting only the destinations, ports and protocols a system actually needs. Most estates enforce inbound rules carefully and allow outbound traffic freely, which is why it is the control that most often breaks an intrusion in a real exercise.
Encryption algorithms
An encryption algorithm is the set of mathematical rules used to turn readable information into ciphertext and back again, so that only the holder of the right key can recover what it says.
Encryption at rest
Encryption at rest means storing data in encrypted form so that a stolen disk, a copied backup or a discarded drive is useless without the keys. It protects against physical and storage-layer access only: an application or an identity authorised to read the data still reads it in the clear, which is the part people misread.
Encryption in transit
In data security, encryption in transit protects data as it travels across a network, usually with TLS, so it cannot be read or altered in flight. It is one arm of the encryption story, sitting alongside encryption at rest and encryption in use, and each protects data in a different state, which is why they are not interchangeable.
ENS
In Spanish security regulation, the ENS (Esquema Nacional de Seguridad) is the mandatory security framework for the public sector and its suppliers, established by Royal Decree 311/2022. It sets security requirements by category, and it exists to raise the baseline of public-sector systems, which is a different thing from any single test of one of them.
ENS security categories
In Spanish public-sector security, the ENS security categories are the levels (basic, medium and high) that set how much protection a system needs under the Esquema Nacional de Seguridad. The category is what actually decides an assessment’s scope and cost, and the difference between a self-declaration and a certified conformity.
Envelope encryption
Envelope encryption is the pattern behind most encryption at rest in cloud platforms: data is encrypted with a data key, and that data key is then encrypted with a key encryption key held in a key management service. The wrapped data key is stored next to the ciphertext, and the master key never leaves the service.
EPSS
In vulnerability prioritisation, EPSS is the Exploit Prediction Scoring System: a model published by FIRST that estimates the probability a given vulnerability will be exploited in the wild in the near term. It answers how likely, where severity scoring answers how bad, and the two questions have different answers.
EU AI Act
In EU regulation, the EU AI Act governs artificial intelligence systems placed on or used in the European market, taking a risk-based approach: obligations rise with the risk a system poses. For certain systems it turns AI security testing from optional into an obligation, which is where the AI-security and European-regulation strands meet.
Evil twin attack
In wireless security, an evil twin attack sets up a rogue access point that clones the name of a legitimate network, so nearby devices connect to the attacker instead. It is the exercise a wireless test runs and the one that lands clearly in a presentation to management, because it needs no vulnerability in the real network at all.
Excessive agency
Excessive agency is the condition in which a language model application is granted more functionality, more permission or more autonomy than its task requires. It is the entry in the OWASP list for LLM applications that decides whether a successful injection is an embarrassing answer or an incident.
Executable file
An executable file contains instructions a computer can run. That is what makes software possible, and it is also why an attachment that runs on a double click has been a delivery route for malware for thirty years.
Exploit
In offensive security, an exploit is the code or technique that turns a vulnerability into actual unauthorised access or impact. The vulnerability is the defect; the exploit is the demonstration that the defect can be used. The distance between the two is what decides how urgently anybody should care.
Exposure management
In security operations, exposure management is the practice of continuously assessing which assets are reachable, which weaknesses are exploitable, and which actually matter, then driving those down. The market usually calls it CTEM, continuous threat exposure management, and its purpose is to turn a list of findings into an order of work.
False negative
A false negative is a real threat that a detection system fails to flag. It is the more expensive of the two errors, because nobody is looking at the thing that did not fire.
False positive
A false positive is an alert pointing at a threat that is not there: the tool has flagged normal activity as malicious. On its own it costs a few minutes. At volume it costs far more, because the team stops opening alerts and the one that mattered goes by without anybody looking at it.
File Transfer Protocol (FTP)
FTP is the classic protocol for moving files between a client and a server over TCP/IP. It was designed for an internet without adversaries, so it encrypts nothing: the username, the password and the contents of every file travel in the clear. It still runs everywhere, and that is precisely the problem.
Fileless malware
Fileless malware is malicious activity that runs without writing an executable to disk, operating from memory and from tools already present on the system. It is not a category of malware so much as a set of techniques for avoiding the artefacts that traditional file based detection was built to find.
Fingerprinting
Fingerprinting is the technique of identifying devices, operating systems, applications and services on a network by reading what they reveal about themselves, from service banners to the small differences in how they answer.
Firewall
In network security, a firewall is a control point that allows or denies traffic according to policy. The single word now covers several distinct things: a stateful filter at the network layer, an application-aware next-generation firewall, a host firewall on the endpoint, and the cloud security group where much of the decision is actually made today.
Firmware
Firmware is the low-level software embedded in a device that controls how its hardware behaves. It runs before anything else does, which is exactly why compromising it is worth so much to an attacker.
Firmware analysis
In device security, firmware analysis is the examination of the software embedded in a device to find its weaknesses: extracting it from the hardware, unpacking its filesystem, and reading the code and data inside. It is the parent activity of IoT testing, covering extraction, filesystem inspection and the hunt for embedded secrets.
Footprinting
An organisation’s footprint is the trail it leaves on the internet without meaning to publish it: domains, IP addresses, exposed services, documents carrying metadata and the profiles of its staff. Footprinting is the work of collecting it, and it is the first thing both an attacker and the people auditing them do.
GDPR
In EU data protection, the GDPR is the regulation governing the processing of personal data, with strict handling requirements and breach duties. The seventy-two-hour deadline people quote is the notification to the supervisory authority under article 33; telling affected individuals is a separate duty, without undue delay, and only on high risk.
GNU Privacy Guard (GnuPG)
GNU Privacy Guard is the free, open source implementation of the OpenPGP standard. It lets you encrypt and digitally sign files and messages, and it is what most of the signature verification in the software supply chain still runs on.
Golden Ticket
A Golden Ticket is a forged Kerberos ticket granting ticket, created offline using the key of the domain’s krbtgt account. Because every ticket in the domain is validated against that key, an attacker holding it can mint credentials for any user, including ones that do not exist, with any group membership they choose.
GraphQL security
In API security, GraphQL security is the set of controls needed by an API where the client, not the server, decides the shape of each response. One endpoint, a typed schema and client-composed queries break several assumptions that REST security tooling and REST reviewers rely on.
Grey hat hacker
A grey hat hacker looks for flaws in systems they have no permission to touch, but without intent to profit or cause harm, and usually tells the owner what they found. What separates them from a professional is not technique or intent: it is that there is no written authorisation behind it.
Guardrails
In AI security, guardrails are the input and output controls placed around a language model to block unwanted content: filters that screen prompts, checks that inspect responses, and policies that constrain behaviour. They are the control a client believes protects them, and explaining why a filter does not fix a structural problem is exactly the offensive angle.
Hacker
A hacker is someone who understands a system well enough to make it do something it was not meant to do. The word says nothing about legality: what separates the hacker you hire from the one you report is not the technique, which is the same, but written authorisation, an agreed scope and a report at the end.
Hacktivist
A hacktivist is a person or group who uses technical skills to push a political, social or ideological cause, from publishing documents to knocking a website offline.
Hardening
In systems security, hardening is the work of reducing what a system exposes and what it will do by default: removing components that are not needed, closing permissive defaults, and applying a configuration baseline. It changes what an attacker can reach and reuse after they arrive, which is why it survives an unpatched day.
Hardware security module (HSM)
A hardware security module is a dedicated device that generates and stores cryptographic keys and performs operations with them, built so that the key material cannot be exported in the clear. Applications send data to be signed or decrypted and receive a result, never the key itself.
Hash function
In cryptography, a hash function turns arbitrary input into a fixed-size fingerprint that is hard to reverse. A cryptographic hash must resist preimage, second-preimage and collision attacks; it underpins integrity checks and digital signatures. Passwords are the exception: they need a purpose-built key derivation function, never a fast general-purpose hash.
Heartbleed
Heartbleed is a critical vulnerability in OpenSSL, disclosed in April 2014, that let an attacker read chunks of a server’s memory straight off the wire.
Heuristic analysis
Heuristic analysis identifies threats by what a program does rather than by matching it to a known signature, which is what makes it able to catch something nobody has seen before, and what makes it produce false positives.
High availability
High availability is the ability of a system, network or service to stay operational and reachable without significant interruption, including when a component fails or something goes wrong.
HMAC
HMAC is a message authentication code built from a hash function and a shared secret key, specified in RFC 2104. It proves that a message was not altered and that it came from someone holding the key, which is a different guarantee from a digital signature: both parties can produce it, so it establishes authenticity but not non repudiation.
Hoax
A hoax is a false message that travels by email, chat or social media and whose only goal is that you keep passing it on: a fake virus alert, a chain message, an invented security warning. There is nothing technical inside it, which is why no filter stops it. It spreads because checking it costs more than forwarding it.
Homograph attack
A homograph attack uses characters from different alphabets that look identical on screen, so that a fake domain, sender or filename passes for the real one. It is the delivery vehicle for a phishing campaign rather than a family of malware: what it fools is the eye, not the code.
Honeypot
A honeypot is a system that exists only to be attacked. It looks vulnerable and valuable, it is watched closely, and because nothing legitimate has any reason to touch it, every interaction with it is a signal.
HTTP and HTTPS
HTTP is the protocol browsers and servers use to exchange web content; HTTPS is the same protocol carried inside a TLS connection, so that what is exchanged is encrypted and the server is authenticated.
HTTP request smuggling
HTTP request smuggling is an attack that exploits disagreement between two servers on a connection about where one request ends and the next begins. A front end forwards what it considers one request, the back end reads it as two, and the attacker’s leftover bytes are prefixed onto whoever uses that connection next.
IAM
In enterprise security, IAM is identity and access management: the systems that establish who or what an identity is, what it may access, and how that access is granted, reviewed and revoked. It covers human and non-human identities alike, and in most estates the non-human ones are now the larger and less governed population.
IEC 62443
IEC 62443 is the international standards series for the security of industrial automation and control systems. It is the reference an industrial client cites in a tender the way ISO 27001 is cited in corporate IT, and it is written for three distinct audiences: the asset owner, the system integrator and the product supplier.
Immutable backup
An immutable backup is a copy that cannot be modified or deleted until a retention period expires, enforced by the storage layer rather than by policy. In ransomware recovery it is the property that matters, because attackers routinely delete or encrypt backups before triggering the payload.
Incident response (IR)
In security operations, incident response is the full cycle of preparing for, detecting, containing, eradicating and recovering from a security incident, and of learning from it afterwards. Preparation is the phase that decides how the others go: almost every decision that determines the cost of an incident is made before it starts.
Indicator of compromise (IoC)
In detection and threat intelligence, an indicator of compromise is an observable artefact, such as a file hash, an address, a domain or a registry key, that is associated with malicious activity. Indicators are the cheapest form of intelligence to consume and the easiest for an adversary to change, which is exactly the trade-off.
Indirect prompt injection
In AI security, indirect prompt injection is an attack in which malicious instructions are hidden in content an LLM reads (a web page, a document, a retrieved record, a tool result) rather than typed by the user. When the model has tools or memory, following those hidden instructions becomes a real security event, not a curiosity.
Information asset
An information asset is any data, resource or component in a digital environment that has real value to an organisation, financial, strategic, operational or reputational. It is the unit everything else in security is measured against.
Infostealer
In criminal operations, an infostealer is malware built for one job: harvest credentials, session cookies, browser data and files from a machine, send them to the operator and leave. It is the origin of a large share of the corporate access sold today, and the reason a stolen session matters more than a stolen password.
Infrastructure as code security
In cloud security, infrastructure as code security is the practice of finding and fixing misconfigurations in the templates that define cloud resources, before they are deployed. It is where a cloud misconfiguration is actually repaired durably, in the template rather than the console, and it closes the loop between a finding and a lasting fix.
Initial access broker
In the criminal economy, an initial access broker is a specialist who compromises organisations and sells that access to somebody else rather than using it. They are the reason an intrusion can begin with no exploitation at all: the buyer logs in with access that was obtained weeks earlier by a different party.
Insecure deserialisation
In application security, insecure deserialisation is a flaw where an application rebuilds objects from data an attacker controls, and the rebuilding itself runs code. The attacker does not supply a payload the application will later interpret: the act of reading the input is the exploitation.
Insecure direct object reference (IDOR)
In web and API testing, an insecure direct object reference (IDOR) is a flaw where the application takes an identifier straight from the request and uses it to fetch or change a record without checking that the caller owns it. Changing one number in a URL returns somebody else’s data.
Insecure local storage
Insecure local storage is the retention of sensitive data on a mobile device in a form that another application, a person with the handset, or a backup can read. It is the most frequently reported finding in mobile assessments and the easiest to demonstrate, because it needs no exploit at all.
Insider threat
In risk terms, an insider threat is the risk that somebody with legitimate access uses it against the organisation, whether deliberately, carelessly, or because their account has been taken over by an outsider. The third case is the most common, and it is why the category cannot be separated from ordinary access control.
Instance metadata service (IMDS)
In cloud security, the instance metadata service (IMDS) is an endpoint reachable from inside a cloud instance that returns information about it, including temporary credentials for the role attached to the instance. It is the link that turns a server-side request forgery into role credentials, and the chain that best shows why web and cloud testing belong together.
IP address
An IP address is the identifier assigned to a device on a network so that data can be routed to it. In security work it is the unit almost every rule, log and block list is written in, and it is a weaker identifier than it looks.
ISMS
In security governance, an ISMS (information security management system) is the framework of policies, processes and controls through which an organisation manages security risk continuously. It is the object that ISO 27001 certifies: the standard does not certify a checklist of controls, it certifies that you run a working management system around them.
ISO 27001
In security governance, ISO/IEC 27001:2022 is the international standard for an information security management system: a framework for managing security risk, not a checklist of controls. The edition is the point a client asks about first. The 2022 revision reorganised Annex A into ninety-three controls grouped in four themes, and it is the current version.
Jailbreak (LLM)
In AI security, an LLM jailbreak is an input crafted to make a model ignore its own safety policy and produce output it was aligned to refuse. It is constantly confused with prompt injection, but the two are different: a jailbreak defeats the model’s policy, while injection hijacks the surrounding application’s instructions.
JWT
A JWT, or JSON Web Token, is a compact format defined in RFC 7519 for carrying claims between parties, signed as a JWS or encrypted as a JWE. It is a token format, not a session system: the receiver must validate algorithm, issuer and audience, and a live token cannot be revoked without state the format lacks.
Kerberoasting
In an Active Directory intrusion, kerberoasting is the act of requesting a service ticket for an account that has a service principal name, then cracking the ticket offline to recover that account’s password. Any domain user can ask for the ticket, so nothing about the request itself looks abnormal.
Kerberos
In enterprise authentication, Kerberos is the ticket-based protocol that Active Directory uses to prove identity between clients and services without sending passwords over the network. Understanding its ticket exchange is a prerequisite for understanding most of what happens in an internal intrusion on a Windows estate.
Key derivation function (KDF)
In cryptography, a key derivation function (KDF) turns a password or shared secret into a cryptographic key, and for password storage it is deliberately slow and memory-hard so that guessing is expensive. It is the control that actually resists cracking, and the entry that repairs the incorrect hash-function advice and the outdated salt advice, because both point here.
Keylogger
A keylogger is hardware or software that records the keys pressed on a device, covertly and without the user’s knowledge, in order to capture passwords and anything else typed.
KMS
In cloud security, a KMS (key management service) generates, stores and rotates cryptographic keys and performs operations with them without ever handing the key material back. That non-release is its defining property: it is distinct from a secrets manager, which stores credentials your applications actually read.
Kubernetes RBAC
In cloud security, Kubernetes RBAC is the role-based access control model that governs what users and workloads may do inside a cluster. It is where a cluster’s excessive permissions concentrate and the shortest route to cluster administrator, and it is distinct enough from generic RBAC to warrant its own entry, because the model and the findings differ.
Kubernetes security
Kubernetes security is the work of protecting a cluster and everything it runs: the control plane and its API, the permissions model that decides who may create what, the isolation between workloads, and the secrets they consume. In a cluster, the ability to create a pod is usually equivalent to control of the node.
Lateral movement
In a network intrusion, lateral movement is how an attacker travels from the machine they first compromised to the systems that hold what they came for, usually by reusing valid credentials rather than by exploiting anything. It is the longest phase of most real intrusions and the one defenders have the best chance of interrupting.
Least privilege
Least privilege is the principle of granting each identity only the access it needs for its task, and nothing more. In an intrusion it is the control that decides consequences: it does not stop an attacker getting in, it decides how far the first account they compromise can take them.
Legacy authentication
Legacy authentication is any sign in protocol that sends a username and password directly to the service without supporting modern authentication, so it cannot prompt for a second factor and is not evaluated by conditional access. In Microsoft 365 estates it is the path that quietly bypasses the controls the organisation believes it has deployed.
Licence agreement
A licence agreement is the contract that sets out the terms on which software, an application or an online service may be used. In security work it is where the limits on use, the data handling obligations and the liability caps actually live.
Living off the land (LOLBins)
In intrusion tradecraft, living off the land means conducting an operation using software that is already present and trusted on the target: signed system utilities, administrative tools and scripting engines. The binaries used this way are called LOLBins, and the technique exists because trusted tools are not what security controls are looking for.
LLM red teaming
In AI security, LLM red teaming is the adversarial testing of a language model application to find where it can be made to misbehave: jailbreaks, prompt injection, data leakage and harmful output. It is the name under which AI penetration testing is usually bought, and what it tests is the deployed application rather than the model on its own.
Logic bomb
A logic bomb is malicious code that sits inert inside a system until a condition is met: a date, a program running, a piece of data appearing or disappearing. What sets it apart from other malware is not what it does when it fires, but that the attacker chooses when, and that months can pass between the intrusion and the damage.
Long-lived access key
A long-lived access key is a static cloud credential that does not expire on its own: an identifier and a secret that authenticate an API call from wherever they are presented. It is the most repeated finding of a cloud assessment and one of the easiest to remove, because in most cases nothing needs it any more.
LOPDGDD
The LOPDGDD is Ley Orgánica 3/2018, of 5 December, on the protection of personal data and the guarantee of digital rights. It is the Spanish law that adapts the GDPR to national law, exercising the margins the regulation leaves to member states and adding a set of digital rights of its own.
MAC address
On a local network, a MAC address is the identifier the manufacturer burns into a device’s network interface and that travels in every link-layer frame. It exists to deliver traffic inside the segment, not to prove which device sent it: any operating system can change it in seconds.
Malware
In threat work, malware is hostile software written to act against the interests of the system it runs on: ransomware, infostealers, remote access tools, loaders, wipers and the rest. It is a means to an attacker’s end rather than the end itself, and defining an intrusion by the malware found in it usually describes the least important part of it.
Mass assignment
Mass assignment is an API flaw in which a framework binds the fields of an incoming request straight onto an internal object, so a caller can set properties the interface never offered. Adding a field such as role or isAdmin to an otherwise legitimate profile update is the whole attack.
MDR
In security operations, MDR is managed detection and response: a service in which a provider supplies the analysts, the process and usually the tooling to monitor a client’s estate and act on what they find. It is bought instead of building a round-the-clock team, and what distinguishes it from older monitoring is the mandate to respond.
Membership inference
Membership inference is an attack that determines whether a particular record was part of a model’s training set, by observing how the model responds to it. It is the question a data protection officer asks when a model has been trained on customer data, because a positive answer is a disclosure about an identifiable person.
Microsegmentation
In network security, microsegmentation enforces access policy at the level of the individual workload rather than the subnet, so that each server, container or service only talks to the specific others it needs. It is what actually stops the lateral movement a red team demonstrates on an internal test, and it operates a layer below network segmentation.
MITRE ATT&CK
MITRE ATT&CK is a public, curated knowledge base of what attackers actually do once they are inside, organised as tactics, which are the goals, and techniques, which are the ways of reaching them. It is a shared vocabulary for describing intrusions, not a maturity model and not a checklist to be completed.
Mobile app attestation
Mobile app attestation is a platform service that issues a signed statement about the genuineness of an application and the integrity of the device it is running on, which the application’s backend then verifies. It moves the trust decision off the device, which is what client side integrity checks cannot do.
Model Context Protocol (MCP)
In AI security, the Model Context Protocol (MCP) is an open standard that lets a language model application connect to external tools and data through a common interface. It is how an AI agent acquires the capabilities it acts with, and therefore where much of an agent’s real attack surface now lives.
Model extraction
Model extraction is an attack in which repeated queries to a model are used to build a functional copy of it. The attacker never touches the weights: they use the interface as an oracle, collecting input and output pairs until a substitute model reproduces the original’s behaviour closely enough to be useful.
Model inversion
Model inversion is an attack that reconstructs representative features of the data a model was trained on, using only access to the model’s outputs. Where the training set contained personal data, a successful inversion turns a deployed model into a disclosure of that data, which is a privacy problem before it is a security one.
mTLS
mTLS, or mutual TLS, is TLS in which both sides present a certificate, so the client proves its identity to the server as well as the other way round. It gives service-to-service traffic an authenticated identity that does not depend on network position, which is why it underpins zero trust between workloads.
Multi-factor authentication (MFA)
Multi-factor authentication (MFA) requires evidence from two or more different categories: something you know, something you have, something you are. Two passwords are not MFA. Against a phishing proxy that relays the login in real time, codes and push approvals all fall; only origin-bound factors such as WebAuthn survive.
Natural disasters
In information security, a natural disaster is an event nobody causes that still takes systems, data or the place you work from out of service. It sits in the same chapter as ransomware because the outcome to be avoided is the same: not being able to operate.
Network segmentation
In network security, network segmentation is the practice of dividing a network into separate zones so that a compromise in one does not spread freely to the rest. It is the control that decides how far an intruder moves after the first foothold, turning a single breached host into a contained event rather than a whole-estate one.
NIS2
NIS2 is Directive (EU) 2022/2555, the European Union’s network and information security directive, which sets baseline cybersecurity and incident reporting duties for essential and important entities across a wide list of sectors. Being a directive, it obliges through each member state’s national transposition rather than directly.
Nmap
Nmap, short for Network Mapper, is the open source tool used to explore and map networks: which hosts are reachable, which ports are open, and what software is answering on them.
Non-human identity
In identity security, a non-human identity is an account used by software rather than by a person: a service account, a workload identity, an API key, an automation credential or an autonomous agent. In most estates these now outnumber human accounts, and they have no manager, no starter form and no leaving date.
NTLM relay
In internal network attacks, NTLM relay is a technique where an attacker forwards a victim’s authentication attempt to a third system instead of cracking it, and is accepted there as the victim. Nothing is decrypted and no password is recovered: the authentication is genuine, and it is simply used against a destination the victim never chose.
OAuth 2.0
In API and identity security, OAuth 2.0 is an authorisation framework that lets an application act on a user’s behalf without handling their password. It does not authenticate the user: that is OpenID Connect, the identity layer built on top of it, and confusing the two is the most common design error in the ecosystem.
Open redirect
An open redirect is a flaw where an application sends the visitor to a URL taken from a parameter without checking it against a list of permitted destinations. On its own it leaks nothing, which is why it is often dismissed; its value to an attacker comes from what it is chained to.
OpenID Connect (OIDC)
In identity, OpenID Connect (OIDC) is the authentication layer built on top of OAuth 2.0. Where OAuth delegates permission to an application, OIDC states who the user is, by adding an ID token with a defined set of claims and the rules for validating it. It is the piece that OAuth deliberately does not provide.
OSINT
In offensive security, OSINT (open source intelligence) is the gathering of information about a target from publicly available sources: registration records, code repositories, social media, leaked data and the wider web. It is the first move of almost every engagement and the shared vocabulary of several of the firm’s services.
OT and ICS security
In industrial security, OT and ICS security covers the protection of operational technology and industrial control systems: the equipment that runs physical processes in factories, utilities and infrastructure. It is the vocabulary of the industrial client who buys IoT testing and who falls under NIS2, and where safety and availability outrank confidentiality.
OWASP API Security Top 10
In API security, the OWASP API Security Top 10 is a separate awareness list covering the weaknesses that appear specifically in application programming interfaces. It exists because APIs fail differently from web pages: the object graph is exposed directly, and most of the entries are authorisation problems rather than injection problems.
OWASP MASVS
In mobile security, OWASP MASVS (Mobile Application Security Verification Standard) is a framework that sets the security requirements a mobile app should meet, grouped by area. It defines the scope of a mobile penetration test and structures its report, the way the OWASP Top 10 structures a web test. It is the standard, paired with the separate MASTG testing guide.
OWASP Top 10
In application security, the OWASP Top 10 is a periodically updated awareness document listing the categories of web application weakness that the project considers most important. It is a set of categories to be aware of, published by a non-profit foundation. It is not a standard, a certification, or a test scope.
OWASP Top 10 for LLM Applications
In AI security, the OWASP Top 10 for LLM Applications is a community framework that lists the most significant security risks specific to applications built on large language models. It structures an AI penetration test the way the original OWASP Top 10 structures a web test, and citing the source is what gives a report its authority.
Packet filtering
Packet filtering is the firewall technique of examining each packet crossing a boundary and allowing or dropping it against a set of rules, using the addresses, ports and protocol it carries.
Pass-the-hash
Pass-the-hash is a Windows attack in which an intruder authenticates to a remote system using the stored hash of a password rather than the password itself. Nothing is cracked and nothing is guessed: NTLM proves knowledge of the hash, so the hash is the credential.
Passive attack
A passive attack observes without touching: the attacker intercepts information in transit or collects it from where it is already exposed, changing nothing and provoking no response from the system. It is hard to detect precisely because it generates no activity, and it is rarely the whole attack. It is the phase that makes the next one cheap.
Passkey
In authentication, a passkey is a FIDO2 and WebAuthn credential: a key pair created for one specific site, where the private key stays on the user’s device and sign-in is a signature over a challenge. It is the only widely deployed consumer credential that a phishing proxy cannot capture and replay.
Password manager
A password manager stores, generates and protects the credentials a person uses across many accounts, so that each one can be different and none of them has to be memorable.
Password spraying
In credential attacks, password spraying tries a small number of likely passwords against a very large number of accounts, instead of many passwords against one account. It is designed to stay below lockout thresholds, and it is the technique that most reliably produces a first foothold in a cloud tenant.
Passwordless
In authentication, passwordless describes any sign-in that does not require the user to present a memorised shared secret. In practice the term is used for two very different things, and only one of them removes the phishing problem: credentials based on public key cryptography, as against codes and links delivered over a channel.
Patch management
In security operations, patch management is the process of getting vendor fixes into production reliably and quickly, across every system that runs somebody else’s code. The gap between disclosure and deployment is where attackers live, and the length of that gap is a property of the process, not of the vulnerability.
Path traversal
In application security, path traversal is a flaw where user input is used to build a file path and the attacker escapes the intended directory, reaching files the application never meant to serve. It is also called directory traversal, and it reads or writes files with the privileges of the service.
PCI DSS
In payment security, PCI DSS is the standard that sets security requirements for organisations that store, process or transmit cardholder data. It is what obliges many businesses to run penetration tests on a fixed cadence, and it explains why tokenisation reduces scope, which makes it a direct bridge between compliance and commissioning a test.
Penetration test
A penetration test is an authorised, time-boxed exercise in which testers use attacker techniques against an agreed scope in order to find weaknesses and prove they are exploitable. The proof is the point: it is what separates a penetration test from a scan, and what makes the resulting risk statement defensible.
Persistence
In intrusion operations, persistence is the set of mechanisms an attacker plants so their access survives reboots, credential changes and clean-up. It is the difference between an intrusion that ends when a machine is restarted and one that has to be hunted, and it is what a red team exercise is meant to test the response to.
Personal data (GDPR)
In EU data protection, personal data is any information relating to an identified or identifiable person, as defined in article 4 of the GDPR. It is the canonical concept in Spain and the EU, and it is broader than the US term PII: it covers online identifiers, IP addresses, cookies and pseudonymised data that can still be linked back.
Phishing
Phishing is an attack that persuades a person to hand over credentials, money or access, usually by message. What changed is the target: the phishing that succeeds against a modern organisation no longer wants the password, it wants the session, and it takes it by relaying the real login through a proxy the victim never sees.
PII
In data protection, PII (personally identifiable information) is the United States framing for data that identifies a person. Under the GDPR the operative concept is personal data, which is broader: it covers online identifiers, IP addresses, cookies and pseudonymised data. In Spain and the EU, personal data is the canonical term, and PII narrows the scope.
Playbook
A playbook is a documented and repeatable procedure for handling one specific incident type, written so that responders do not have to improvise under pressure. In security operations it fixes the decisions, the thresholds and the authority to act in advance, when there is time to think about them properly.
PMKID attack
The PMKID attack is a technique against WPA2 personal networks that obtains crackable material directly from the access point, without waiting for a client to connect. A single frame from the access point can contain a value derived from the network passphrase, which is then attacked offline.
Port and vulnerability scanning
Port scanning asks what is listening on a system; vulnerability scanning asks what is wrong with what answered. They are done one after the other, they answer different questions, and neither of them is vulnerability management.
Post-quantum cryptography
In cryptography, post-quantum cryptography is the family of algorithms designed to remain secure against an attacker with a large quantum computer, which would break the public-key schemes protecting most traffic today. It is the boardroom question of the moment, and the answer depends on how long a given piece of data has to stay confidential.
Privacy
Privacy is the protection of personal and sensitive information against unauthorised access, misuse or disclosure. It is the principle; the GDPR is the law that turns it into obligations, and personal data is what both apply to.
Privilege escalation
In an intrusion, privilege escalation is the step where an attacker turns limited access into more: from an ordinary user to administrator on a machine, or from a normal account to control of a directory or a cloud tenant. It usually comes from a misconfiguration or an over-granted permission rather than from an exploit.
Privileged access management (PAM)
In identity security, privileged access management (PAM) is the set of controls applied specifically to the accounts that can change a system rather than use it: vaulting their credentials, brokering their sessions, granting rights only when needed and recording what was done. It is the control that breaks the routes an internal test finds.
Prompt injection
Prompt injection is input that a language model reads as instruction when it was meant to be data, because the model receives both through the same channel and cannot tell them apart. It is direct when the user writes it and indirect when it arrives hidden inside a page, a document or a tool result.
Public key infrastructure (PKI)
In cryptography, a public key infrastructure (PKI) is the system of certificate authorities, certificates and revocation that binds a public key to an identity and lets parties trust that binding. It underpins TLS, mutual TLS, digital signatures and DNSSEC, so five other entries point at a concept that has to exist here.
Purple team
A purple team is an exercise, not a department: attackers and defenders work in the same room, running known techniques deliberately and checking together whether the telemetry, the detection and the response each hold. The goal is not to win, it is to leave with a list of detections that were built and verified.
Race condition
In application security, a race condition is a flaw where the result depends on the order in which concurrent requests are processed, because a check and the action it authorises are not atomic. Sending the same request many times in parallel makes the application act on state it has already invalidated.
Ransomware
Ransomware is an extortion operation against an organisation, not simply a type of malware: intruders take the data first, then usually encrypt it, and charge for both silence and recovery. Some crews now skip the encryption altogether and extort on the threat of publication alone, which is why the old definition no longer fits.
Ransomware leak site
A ransomware leak site is a site, usually reachable over Tor, where an extortion group publishes the names of victims who have not paid and releases the data it claims to have stolen. It is the publication half of double extortion: encryption creates the outage, the site creates the deadline.
Ransomware-as-a-service (RaaS)
In the criminal economy, ransomware-as-a-service (RaaS) is the model in which one group builds and maintains the encryption software, the leak site and the negotiation infrastructure, and other people, the affiliates, carry out the intrusions in exchange for a share of the payment. It is why two incidents under the same name can look nothing alike.
Rate limiting
In application and API security, rate limiting is the control that caps how many requests a client may make in a window, so that guessing attacks, enumeration and abuse cost the attacker time. It does not decide whether a request is allowed: it decides how often the question can be asked.
RBAC
In access management, RBAC is role-based access control: permissions attach to roles, and roles attach to users. It replaced the practice of granting rights person by person, and it scales administration well, but only while the number of roles stays smaller than the number of people they describe.
Reconnaissance
In offensive security, reconnaissance is the first phase of an attack: gathering information about a target to plan the intrusion. It is the first tactic in MITRE ATT&CK and the opening stage of the cyber kill chain, which both begin by describing exactly this, and it splits into a passive form and an active one.
Red team
In offensive security, a red team is a group that plays the adversary in an objective-driven exercise, testing not just what is vulnerable but whether an organisation detects and responds to a real intrusion. The name comes from military exercises where a red force plays the enemy against a defending blue force.
Registration authority (RA)
A registration authority is the part of a public key infrastructure that verifies who an applicant is, before any certificate is issued to them.
Remote code execution (RCE)
In offensive security, remote code execution (RCE) is a flaw that lets an attacker run their own instructions on a target system across the network, without needing an account on that system. It is the outcome that other classes of bug lead to, and the finding that decides the severity of a report.
Replay attack
In a replay attack the attacker captures valid data in transit and sends it again, unchanged, so the receiving system accepts it a second time. No decryption required: the message was legitimate the first time.
Retest
A retest is a bounded second engagement whose only purpose is to verify that the findings of a previous assessment have actually been fixed. In an audit programme it is what converts a report into evidence, because a remediation plan marked complete internally and a finding proven closed by testing are not the same claim.
Retrieval-augmented generation (RAG)
In AI security, retrieval-augmented generation (RAG) is an architecture that gives a language model access to an external knowledge store at query time, retrieving relevant documents and adding them to the prompt. It is the design almost every organisation deploys when it says it has AI, and it is where indirect prompt injection lives.
Right to be forgotten
The right to be forgotten is the right of an individual to ask that personal information about them be erased or delisted, and to have that request assessed.
Risk analysis
Risk analysis is the structured assessment of the risks affecting an organisation’s assets, systems and operations, so that decisions about them can be made on evidence rather than instinct.
Risk model
A risk model is the structure an organisation uses to value risk: what counts as an asset, how likelihood and impact are scored, and above which threshold a risk gets treated rather than accepted.
Root and jailbreak detection
Root and jailbreak detection is a set of client side checks by which a mobile application tries to establish whether the device it runs on has been modified to remove the platform’s restrictions. In mobile security it is an obstacle that raises the cost of analysis, not a boundary, because the code performing the check runs on the attacker’s device.
Rootkit
In malware analysis, a rootkit is malware that subverts the operating system so the system under-reports the attacker’s presence, hiding processes, files, connections and accounts from the tools that trust it for their answers. The deception happens inside the system being queried, which is why the tools running on it report a clean machine.
Rules of engagement
In offensive security, rules of engagement are the written agreement that defines exactly what a test may and may not do: the scope, the timing, the permitted techniques, the systems that are off limits, and who to call if something breaks. They are agreed before any testing starts and they authorise the whole exercise.
Salt
In password storage, a salt is a unique random value stored alongside each password hash so that identical passwords do not produce identical hashes and precomputed tables are useless. A salt is not secret, and it does not slow an attacker down: that is the job of the key derivation function’s cost. Modern algorithms generate and store it for you.
SAML
SAML 2.0 is an XML based federation standard used for enterprise single sign on: an identity provider issues a digitally signed assertion about a user, and a service provider trusts it. It is what most of the installed corporate estate runs on, while new development generally chooses OpenID Connect instead.
SASE
In network security, SASE (secure access service edge) is a cloud-delivered model that combines networking and security into one service: it bundles software-defined wide-area networking with controls such as a secure web gateway, a cloud access security broker, ZTNA and firewall-as-a-service. It is how organisations increasingly buy secure connectivity as a single platform.
SAST
In application security, SAST is static application security testing: analysing source code, bytecode or binaries for weaknesses without running the software. It reads the code the way a compiler does, tracing how data moves from where it enters to where it is used, and reports the paths that look unsafe.
SBOM
In software supply chain security, an SBOM is a software bill of materials: a formal, machine-readable inventory of the components in a piece of software, including transitive dependencies, with versions and relationships. It answers one question fast, namely whether you contain a given component, and it answers no other question at all.
Secrets management
In application and cloud security, secrets management is the storage of API keys, certificates and passwords with rotation, access control and audit, instead of in code or configuration. It is a constant finding in cloud tests, and a control worth keeping distinct from a KMS, because a secrets manager returns the secret to be read.
Secure boot
In device security, secure boot is a chain of trust that verifies the signature of each boot stage before running it, so modified firmware or a tampered operating system will not start. It is the control that separates a rootkit from a bootkit: a bootkit persists in the boot chain below the operating system, exactly where secure boot enforces trust.
Secure data erasure
Secure erasure is the set of techniques that remove stored information permanently, so that it cannot be recovered by anybody who later gets hold of the device or the storage it lived on.
Security audit
A security audit is a systematic review of the security controls protecting a system, network, application or infrastructure, to find weaknesses, check that policy is being followed and recommend what to improve.
Security breach
A security breach is an event, or a chain of them, that lets somebody unauthorised compromise the integrity, confidentiality or availability of data, systems or networks. What defines it is not the entry point but how long it goes unnoticed.
Security compliance
In security governance, security compliance is the act of demonstrating, to auditors and regulators, that an organisation meets a defined set of controls. It is necessary, but it is not the same as being secure: a system can pass an audit and still be exploitable, which is precisely the gap an offensive assessment measures.
Security hole
A security hole is a weakness in a system, network, application or any other digital component that an attacker can use to do something they should not be able to do.
Security incident detection
Security incident detection is the capability of noticing, quickly and accurately, that something happening on your networks, systems or applications is a security incident rather than ordinary activity.
Server-side request forgery (SSRF)
In web and cloud security, server-side request forgery (SSRF) is a flaw where an attacker makes the application send an HTTP request of their choosing from its own network position. The request arrives with the server’s source address and its credentials, so it reaches internal services that were never meant to be exposed.
Server-side template injection (SSTI)
Server side template injection is a vulnerability in which user input is concatenated into a template that the server then renders, so the input is evaluated as template syntax rather than treated as data. Because template engines expose language objects, it usually escalates from expression evaluation to remote code execution.
Serverless security
Serverless security covers securing functions and managed services where the provider operates the runtime and the customer supplies only code and configuration. Patching the host stops being the customer’s problem, and identity, event input and dependencies become the whole of it.
Session fixation
In web application security, session fixation is an attack in which the attacker sets or learns a session identifier before the victim authenticates, and the application keeps that same identifier after login. The attacker then presents the identifier and is inside the authenticated session without ever knowing the password.
Session hijacking
In web and identity security, session hijacking is the theft and reuse of the token that proves a user has already logged in. The attacker never learns the password and never faces the login form: they present the stolen session and the application treats them as the user who created it.
Shadow AI
In security, shadow AI is the use of AI tools inside an organisation without approval or oversight: staff pasting company data into public assistants, teams wiring unsanctioned models into workflows. It is the new, uncontrolled data-leak channel, and it is what makes the older understanding of data loss prevention out of date.
Shadow API
A shadow API is an interface that is live and reachable but absent from the inventory the organisation defends: undocumented, forgotten after a migration, or left running from a version that was supposed to be retired. It is authenticated and monitored to whatever standard applied on the day it was built, which is usually none.
Shadow IT
In security operations, shadow IT is the set of systems and services the business uses without the knowledge of security or IT: unmanaged and unmonitored. It is not usually rebellion. It is a team that needed something on Tuesday and found a way to have it working by Wednesday.
Shared responsibility model
In cloud security, the shared responsibility model is the division of security duties between the cloud provider and the customer: the provider secures the underlying platform, and the customer secures what they build and configure on it. It is the conversation that opens every cloud project, and the misunderstanding that most often distorts an audit’s scope.
Side-channel attack
In security, a side-channel attack recovers a secret not by breaking the algorithm but by measuring what the implementation leaks while it runs: the time it takes, the power it draws, its electromagnetic emissions, or its effect on a shared cache. It has two faces: hardware in embedded devices, and timing in software.
SIEM
A SIEM, or security information and event management platform, is where an organisation collects logs from its systems so they can be searched, correlated and retained. It is the place a security team asks what happened across the whole estate, and it detects only what somebody wrote a rule for.
Smishing
Smishing is phishing delivered by text message. The channel matters more than the technique: messages arrive on a personal device outside the corporate mail gateway, sender identifiers are easy to forge, and the interface gives the recipient almost nothing with which to check a link before tapping it.
SOAR
In security operations, SOAR is security orchestration, automation and response: tooling that connects the systems a security team uses and executes agreed sequences against them automatically. It is not a detection technology. It acts on decisions that have already been made, which is why it amplifies whatever the process already is.
SOC
In security operations, a SOC is a security operations centre: the team and tooling that monitor for and respond to threats, often around the clock. It is defined by an operating model rather than by a room, and its quality is measured by what it detects and how fast it acts, not by how many alerts it processes.
SOC 2
In security governance, SOC 2 is a US attestation, based on the Trust Services Criteria, that reports on the controls a service organisation operates. It is what a US customer asks a Spanish software company to provide, and it usually arrives as a question alongside ISO 27001, which makes the two a natural comparison.
Social engineering
In offensive operations, social engineering is manipulating people, through phishing, pretexting or vishing, to bypass technical controls. It targets the decision rather than the system, and it works because the decisions it targets are ones the organisation needs people to make quickly and often.
Software bug
A software bug is a defect in a program’s code that makes it behave differently from what was intended. It is not an attack and not a malicious act: it is an unintentional mistake. And it is where almost every vulnerability begins, unless that vulnerability comes from weak configuration or a stolen credential.
Software composition analysis (SCA)
In application security, software composition analysis is the identification of the third-party and open source components an application depends on, and of the known vulnerabilities and licence obligations attached to them. Most of the code in a modern application was written by somebody else, and this is the tooling that reads it.
Software supply chain attack
In threat terms, a software supply chain attack compromises something an organisation already trusts and installs, rather than attacking the organisation directly. The malicious code arrives signed, through the update mechanism, and reaches every customer of the compromised component at once.
Spear phishing
In offensive security, spear phishing is a targeted phishing attack aimed at a specific person or small group, built from research about them rather than sent in bulk. It is what a realistic simulation actually rehearses, because it is the technique that gets past the awareness training designed for generic mass email.
SQL injection
In application security, SQL injection is a flaw where input changes the meaning of a query the application builds, instead of being read as data inside it. Parameterised queries fix the common case, but identifiers such as table, column and sort order cannot be parameterised, and dynamic SQL inside stored procedures rebuilds the same problem.
SSE
Security Service Edge, or SSE, is the delivery of network security controls from a cloud platform instead of from appliances in an office: secure web gateway, cloud access security broker, zero trust network access and usually data loss prevention. It is the security half of SASE, without the networking half.
SSO
In identity management, SSO is single sign-on: one authentication event grants access to many applications, so the user proves who they are once and each application accepts an assertion instead of its own login. It is convenient, it removes a large number of passwords, and it concentrates risk into one place.
Statement of Applicability
The Statement of Applicability is the document, required by ISO/IEC 27001, that lists the Annex A controls, states whether each is applicable, justifies every inclusion and every exclusion, and records its implementation status. It is the first artefact an auditor asks for and the one that most often fails to survive scrutiny.
Steganography
In security, steganography is the practice of hiding a message inside another file or channel so that nobody notices there is a message at all. It does not replace encryption or compete with it: encryption makes the content unreadable and admits it exists, while steganography tries to stop anyone asking.
STRIDE
STRIDE is a threat modelling mnemonic used in secure design reviews. It names six failure modes to reason about for each component of a system: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Each one is the negation of a security property the design is supposed to hold.
Subdomain takeover
In external testing, a subdomain takeover is what happens when a DNS record still points at a cloud or hosting resource that no longer exists, so anyone may register that resource and serve content from your domain name. The domain still resolves; the thing it resolves to now belongs to somebody else.
System prompt leakage
System prompt leakage is the disclosure of the instructions an application places in front of a language model: its role, its rules, its tool descriptions and anything else the developer wrote there. It is an entry in the OWASP list for LLM applications, and the real finding is usually not the disclosure but what was put in the prompt.
Targeted attack
A targeted attack is one aimed at a specific organisation, person or piece of infrastructure, planned around what that target actually looks like rather than fired indiscriminately at whoever happens to be reachable.
Terraform state exposure
Terraform state exposure is the disclosure of the state file that infrastructure as code tooling maintains to track deployed resources. The file records resource attributes as they were applied, which means values that were secret in the configuration are stored in it as readable text.
Threat
A threat is any event, action, person or entity with the capability to compromise the security of a system, a network, an application or data. It is one of the three terms in the sentence that defines risk, and the three are routinely confused.
Threat hunting
In security operations, threat hunting is the deliberate search for adversary activity that existing detections did not raise. It starts from a hypothesis about how an intruder would behave in this specific estate rather than from an alert, and its output is as often a new detection as it is an incident.
Threat intelligence
In security operations, threat intelligence is information about adversaries, refined into something a defender can actually act on. The refining is the whole discipline: raw data about attacks is abundant and nearly free, and the difficulty is turning it into a decision that would otherwise have been made differently.
Threat modelling
Threat modelling is the practice of reasoning systematically about how a system could fail, who would benefit, and what would matter if it did. It is best started before you build, and repeated whenever the architecture changes, which is why most of it in practice happens on systems already in production.
Threat-led penetration testing (TLPT)
In offensive security, threat-led penetration testing (TLPT) is an intelligence-driven red team exercise against live production systems, run to a supervised framework. It is the form of testing DORA requires of certain financial entities, and it is built on the TIBER-EU methodology used by European central banks.
TLS
In network security, TLS (Transport Layer Security) is the protocol that encrypts and authenticates most internet traffic. The version is the point: the current version is TLS 1.3, versions 1.0 and 1.1 are formally deprecated, and TLS 1.2 remains the bulk of the enterprise estate. Without it, the term tells a reader nothing actionable.
Tokenisation
In data security, tokenisation replaces a sensitive value with a non-sensitive token that maps back to the original only inside a protected vault. It is the concrete answer to a PCI DSS scoping question, because the systems that hold only tokens fall outside the sensitive boundary. It is one technique of pseudonymisation, not the same thing.
Tool poisoning
Tool poisoning is an attack in which the description or metadata of a tool available to an AI agent is written to manipulate the model. Because the agent reads those descriptions to decide what to call and how, the description is untrusted input that reaches the model with the authority of configuration.
Training data poisoning
In AI security, training data poisoning is the manipulation of the data used to train or fine-tune a model so it behaves as the attacker intends: a hidden trigger, a bias, or a degraded capability. It is an attack on the model’s supply chain, and one rarely covered from the tester’s perspective.
Trojan horse
A trojan horse is malware disguised as legitimate or useful software, so that the user installs it themselves and hands over the access the attacker wanted.
Validation authority (VA)
A validation authority is the part of a public key infrastructure that answers, at the moment somebody asks, whether a certificate is still valid.
Vector database security
Vector database security covers the controls on the store that holds the embeddings a retrieval augmented application searches. It matters because that store is a copy of the source content in a different representation, and it is routinely built without the access control, classification and retention rules that governed the original.
Vishing
Vishing is social engineering carried out by voice call: the attacker phones a target and uses a pretext to obtain credentials, a one time code or an action such as an account reset. It is the channel where synthetic voice has changed the economics, because a convincing impersonation no longer needs a skilled caller.
VPN
In network security, a VPN (virtual private network) extends a trusted network over the internet, granting broad network-level access once a user connects. It is increasingly replaced by ZTNA, which brokers access per application rather than per network. Zero trust is the architecture behind that shift; ZTNA is the product that delivers it.
Vulnerability management
In security operations, vulnerability management is the continuous lifecycle of finding, prioritising, fixing and verifying vulnerabilities across an estate. It is a process discipline rather than a scanning activity: the scanner produces a list, and everything that determines whether risk actually falls happens after that.
WAF
In application security, a WAF (web application firewall) inspects HTTP traffic and blocks requests that match attack patterns. It is a useful filter, not a fix for the underlying bug: it is the control clients believe covers them, and explaining that it does not repair the vulnerability behind it is the angle of a firm that audits code.
Whaling (CEO fraud)
Whaling, also known as CEO fraud, is a targeted scam aimed at senior executives, or at the people who take instructions from them, designed to get a payment made or confidential information released.
Wiper
A wiper is malware whose purpose is destruction rather than profit: it overwrites files, partition tables or firmware so the data cannot be recovered. Several notable families have presented themselves as ransomware, complete with a ransom note, when no decryption key ever existed.
Workload identity federation
In cloud security, workload identity federation lets a workload exchange a token from an external identity provider for short-lived cloud credentials, removing the need to store a long-lived key. Scoped correctly it eliminates a class of secret; scoped loosely it lets an untrusted pipeline job assume a production role.
Worm
A worm is malware that spreads across networks on its own, without anybody having to open anything. That is the whole distinction from a virus, and it is what makes a worm a problem measured in minutes rather than in weeks.
WPA3
In wireless security, WPA3 is the current generation of Wi-Fi protection, whose SAE handshake replaces the pre-shared-key handshake of WPA2 to resist offline password guessing. It is a real improvement with honest limits, and it is the wireless surface an assessment covers on estates that still run WPA2 alongside it.
XDR
In detection and response, XDR is extended detection and response: a platform that correlates signals across endpoint, email, identity, network and cloud into one view, so that a sequence of individually unremarkable events can be recognised as a single intrusion. The word that carries the meaning is correlation, not collection.
XML external entity injection (XXE)
XML external entity injection is a vulnerability in which an application parses attacker supplied XML with a parser that resolves external entities. The declaration inside the document tells the parser to fetch a local file or a URL, and the parser obeys, turning a document upload into file disclosure or a request from the server.
Zero trust
Zero trust is a security architecture that stops treating network location as evidence of anything: every request is authenticated, authorised and evaluated against policy, no matter where it comes from. It is a design principle described in NIST SP 800-207, not a product, and no supplier can sell you one.
Zero-day
In vulnerability terms, a zero-day is a vulnerability being exploited before the vendor has a fix, so there is nothing to patch. Most real-world compromise is not this: it is n-day, a known vulnerability with a patch available that nobody applied. The distinction decides where a defence budget should go.
ZTNA
In network security, ZTNA (zero trust network access) is the product that grants a user access to a specific application after verifying identity and device posture, rather than placing them on the network as a VPN does. It is what actually replaces the VPN, and the term that lets the VPN and zero trust entries stop confusing layers.
Los términos, en tu propio entorno.
Todo lo que define este glosario aparece en un encargo real: los hallazgos, su severidad, quién los arregla y el retest que los cierra. Pide media hora y te lo enseñamos sobre la plataforma, con un caso de verdad delante.
Protected by reCAPTCHA. The Google Privacy Policy and Terms of Service apply.
Recibido.
Te escribimos en un día laborable para cuadrar la media hora.
No se ha podido enviar. Inténtalo otra vez o escríbenos.