Cybersecurity Glossary

Plain-language definitions of the terms that matter

40 concise, technical definitions — from anti-ransomware to vCISO — written for security, compliance, and leadership teams who need to understand, not just spell, the terminology.

Search the glossary

The Passeca cybersecurity glossary is a reference of 40 terms spanning compliance frameworks (ISO 27001, SOC 2, NIS2, DORA, PCI DSS), managed security (SOC-as-a-Service, MDR, SIEM, SOAR), offensive security (penetration testing, threat modelling, TLPT), and threat intelligence (infostealer logs, exposure management, attack surface management). Each entry has a self-contained definition and a longer technical explainer that links to the relevant Passeca service.

Browse

All glossary terms

Search by term or keyword, or jump to a letter. Every term links to a dedicated page with a full definition, context, and related services.

Showing 40 terms

Anti-ransomwareAnti-ransomware is a category of security controls purpose-built to stop ransomware — malware that encrypts files or systems and extorts payment for recovery. Unlike general antivirus, anti-ransomware tools intercept the ransomware lifecycle at pre-execution, block data exfiltration, capture encryption keys for automated decryption, and protect their own agent from being disabled.Read definition

Attack surface managementAttack surface management (ASM) is the continuous discovery, inventory, and risk assessment of every internet-facing asset an organisation owns or is responsible for — including forgotten subdomains, cloud instances, exposed databases, shadow IT, and third-party services. ASM works from an attacker's perspective, scanning the open internet rather than relying on internal asset registers.Read definition

BSI C5 (Cloud Computing Compliance Controls Catalogue)BSI C5 is a cloud security criteria catalogue assessed through independent audits and attestation reports. Developed by Germany's Federal Office for Information Security (BSI), it defines the baseline of security controls a cloud service provider must meet. An independent auditor tests the provider against the C5 catalogue and issues an attestation report. German public-sector buyers and many regulated industries treat C5 as a procurement requirement for cloud services.Read definition

CNAPP (Cloud-Native Application Protection Platform)A CNAPP is a unified security platform that combines cloud security posture management (CSPM), cloud workload protection (CWPP), container and Kubernetes security, and infrastructure-as-code scanning into a single product. The goal is to assess risk across the whole cloud-native stack — configuration, workloads, identities, code — and prioritise the exposures that are actually reachable and exploitable.Read definition

Cyber EssentialsCyber Essentials is a UK government-backed certification scheme that defines a baseline of technical controls against the most common internet-borne cyber attacks. It covers five controls: secure configuration, boundary firewalls, access control, malware protection, and patch management. Cyber Essentials is self-assessed; Cyber Essentials Plus adds an independent hands-on technical verification.Read definition

Deception technologyDeception technology deploys realistic but fake assets — decoy systems, fake credentials, planted files, and breadcrumbs — across an environment so that an attacker who interacts with them reveals themselves. Because real users never touch decoys, any interaction is almost certainly malicious, giving deception a near-zero false-positive rate and high-confidence detection of attackers already inside.Read definition

DORA (Digital Operational Resilience Act)DORA is EU regulation, in force since January 2025, that establishes a uniform framework for the digital operational resilience of financial entities and their critical ICT third-party providers. It requires firms to manage ICT risk, report major incidents, test operational resilience, and manage ICT third-party risk. DORA also allows financial entities to participate in cyber threat information-sharing arrangements. DORA is directly applicable across the EU.Read definition

EDR (Endpoint Detection and Response)EDR is security software installed on endpoints — workstations, servers, mobile devices — that continuously records activity and uses behavioural analytics to detect attacks that bypass preventative controls. Beyond detection, EDR provides investigation tooling, so analysts can reconstruct an incident from recorded telemetry, and response capabilities, so a compromised endpoint can be contained and remediated.Read definition

EDR tamper protectionEDR tamper protection is the hardening of an endpoint detection and response agent so it cannot be disabled, uninstalled, blinded, or evaded by an attacker — even one with local administrator rights. It is a critical control because ransomware operators routinely attempt to neutralise EDR before launching encryption, and disabling EDR can significantly weaken an organisation's ability to detect and respond to threats.Read definition

Exposure managementExposure management is the practice of identifying, prioritising, and remediating the security exposures that are actually reachable and exploitable in a given environment. It combines vulnerability data with asset criticality, threat intelligence, and attack-path analysis so a security team can act on the handful of exposures that genuinely matter, rather than the tens of thousands that exist on paper.Read definition

GDPR (General Data Protection Regulation)GDPR is EU regulation, in force since 2018, that governs the processing of personal data of anyone in the European Economic Area. It establishes principles for lawful processing, grants rights to individuals over their data, requires organisations to demonstrate accountability, and requires notification of certain personal data breaches, where feasible, within 72 hours of becoming aware of them. GDPR carries penalties up to 4% of global annual turnover.Read definition

HIPAA (Health Insurance Portability and Accountability Act)HIPAA is US federal law, in effect since 1996, that sets national standards for protecting the privacy and security of individuals' protected health information (PHI). It applies to covered entities — healthcare providers, health plans, and clearinghouses — and to their business associates who handle PHI on their behalf. The Security Rule requires administrative, physical, and technical safeguards.Read definition

ISMS (Information Security Management System)An ISMS is the set of policies, procedures, roles, controls, and processes an organisation uses to manage information security risk. Defined and structured by standards such as ISO/IEC 27001, an ISMS is not a checklist of controls but a management system: it identifies risks, selects controls to treat them, measures effectiveness, and continuously improves — closing the plan-do-check-act loop.Read definition

Infostealer logAn infostealer log is the data file produced by infostealer malware — a class of malware designed to steal credentials, session cookies, and other sensitive data from an infected machine and exfiltrate it to the attacker. Each log represents one compromised device and may contain valid, reusable credentials and session tokens for dozens of corporate and personal services, which are then traded or sold.Read definition

ISO/IEC 27001ISO/IEC 27001 is the international standard for an information security management system (ISMS). It specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS based on risk assessment and treatment. Certification, issued by an accredited body after a two-stage audit, demonstrates that an organisation meets the standard and is independently verified to do so.Read definition

ISO 22301 (Business Continuity)ISO 22301 is the international standard for a business continuity management system (BCMS). It specifies requirements for an organisation to prepare for, respond to, and recover from disruptions — whether from cyber attack, natural disaster, supply-chain failure, or any other cause. Certification demonstrates that business continuity is managed as a deliberate, tested capability rather than a hope.Read definition

MalwareMalware, short for malicious software, is any software written with hostile intent — to damage systems, steal data, spy on users, or provide unauthorised access. Major categories include viruses, worms, Trojans, ransomware, spyware, rootkits, and infostealers. Malware is the primary delivery mechanism for most cyber attacks and is distributed via email attachments, malicious websites, compromised software, and exploits.Read definition

MDR (Managed Detection and Response)MDR is a managed security service that provides 24/7 threat detection, investigation, and response on top of an organisation's existing security tooling. Unlike a managed EDR service, MDR spans multiple data sources, adds human threat hunting and detection engineering, and includes active response — containment and remediation — rather than alerting alone. MDR is technology-agnostic across the customer's stack.Read definition

SOC (Security Operations Center)A Security Operations Center, or SOC, is the function responsible for continuous monitoring, detection, investigation, and response to security threats across an organisation's environment. A SOC combines people — analysts operating in shifts — with process and technology, typically a SIEM, EDR, threat intelligence, and case management, to detect and respond to incidents on a 24/7 basis.Read definition

MTTD (Mean Time to Detect)MTTD, mean time to detect, is the average time between a security incident beginning in an environment and the security team identifying it as an incident worth investigating. It is a primary measure of detection capability and one of the two metrics — alongside MTTR — that define how quickly a security operation contains threats. Lower MTTD means threats are caught sooner, limiting damage.Read definition

MTTR (Mean Time to Respond)MTTR, mean time to respond, is the average time between a security incident being detected and being contained. It is a primary measure of response capability and, alongside MTTD, one of the two metrics that define how quickly a security operation limits damage. Lower MTTR means threats are stopped sooner after detection, reducing the window in which an attacker can act.Read definition

NIS2 (Network and Information Security Directive 2)NIS2 is EU legislation, in force since January 2023 and applicable from October 2024, that strengthens the cybersecurity obligations of essential and important entities across a wide range of sectors. It requires risk-management measures, an early warning within 24 hours of becoming aware of a significant incident (followed by further reporting), management accountability, supply-chain security, and business continuity. Member states transpose NIS2 into national law with supervisory and enforcement powers.Read definition

PCI DSS (Payment Card Industry Data Security Standard)PCI DSS is a global security standard, maintained by the PCI Security Standards Council, that applies to any organisation that stores, processes, or transmits cardholder data. It defines a set of technical and operational requirements — access control, encryption, vulnerability management, monitoring, and testing — and is enforced by the payment card brands through acquiring banks rather than by a regulator.Read definition

Penetration testingPenetration testing is an authorised, methodical simulation of a real cyber attack against a system, application, or network, conducted by skilled security consultants to find exploitable vulnerabilities before attackers do. A pentest goes beyond automated scanning: it chains findings, exploits weaknesses to demonstrate impact, and produces evidence-based remediation guidance. It is delivered against defined methodologies such as OWASP, PTES, and NIST.Read definition

Phishing simulationPhishing simulation is the practice of sending realistic, safe phishing emails to an organisation's own employees to test whether they click, enter credentials, or report the message. Results identify which users are most susceptible, which departments need targeted training, and whether reporting is improving over time. Simulation is paired with training so that a click leads to immediate education rather than punishment.Read definition

RansomwareRansomware is malware that denies a victim access to their systems or data — typically by encrypting files — and demands payment, usually in cryptocurrency, to restore access. Modern ransomware also steals data before encrypting, threatening to publish it (double extortion) and to harass customers or partners (triple extortion). Ransomware is the dominant extortion threat and a top cause of major organisational disruption.Read definition

Risk assessmentA risk assessment is the structured process of identifying the threats, vulnerabilities, and potential impacts that could harm an organisation's information and systems, evaluating their likelihood and consequence, and prioritising them for treatment. It is the foundation of any security programme: every subsequent control, decision, and investment is justified by the risks the assessment identifies.Read definition

Security awareness trainingSecurity awareness training is the programme of education that helps employees recognise and respond to security threats — phishing, social engineering, poor password practices, data handling, and incident reporting. Effective training is ongoing rather than annual, relevant to the learner's role, and combined with measurement like phishing simulation, so the organisation can track whether behaviour is actually changing.Read definition

SIEM (Security Information and Event Management)A SIEM, security information and event management system, is the central platform that ingests log and event data from across an organisation's environment, correlates it to detect threats, raises alerts, and provides the investigation and case-management tooling a security team needs to respond. The SIEM is the technical backbone of a SOC, where detection, investigation, and response converge.Read definition

SOC-as-a-ServiceSOC-as-a-Service is a managed security service in which an external provider operates a security operations center on behalf of the customer, providing 24/7 monitoring, detection, investigation, and response. The provider supplies the people, process, and platform — typically SIEM, EDR, and threat intelligence — so the customer gains SOC capability without building and staffing an in-house operation.Read definition

SOC 2SOC 2 is an attestation framework, from the AICPA, for service organisations to demonstrate that their systems meet the Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy. An independent auditor issues a SOC 2 report. Type I attests to control design at a point in time; Type II attests to operating effectiveness across a review period, typically six to twelve months.Read definition

SoA (Statement of Applicability)A Statement of Applicability is a mandatory document in an ISO/IEC 27001 ISMS that lists, for each control in the standard's catalogue, whether it is implemented, the justification for its inclusion or exclusion, and its implementation status. The SoA is the bridge between the risk assessment and the controls actually chosen, and is the document an ISO 27001 certification auditor examines most closely.Read definition

SOAR (Security Orchestration, Automation and Response)SOAR is a category of security technology that orchestrates and automates the response to security alerts through playbooks, integrating the various tools a SOC uses. A SOAR ingests alerts, enriches them with context from connected systems, and executes predefined response actions — isolating a host, blocking an IP, disabling an account, opening a ticket — reducing manual work and dramatically cutting mean time to respond.Read definition

SAST (Static Application Security Testing)SAST, static application security testing, is the analysis of application source code, bytecode, or binaries to find security vulnerabilities without running the application. SAST scans early in the development lifecycle — ideally at commit, in the IDE, or in CI — so developers can fix flaws before they reach production. It detects injection flaws, insecure patterns, hard-coded secrets, and many other code-level weaknesses.Read definition

SCA (Software Composition Analysis)SCA, software composition analysis, is the process of identifying the open-source and third-party libraries an application depends on, mapping them against known vulnerability databases, and tracking licence obligations. Because the majority of modern application code is open-source, SCA is essential: a vulnerability in a library is a vulnerability in the application, and SCA is how those dependencies are discovered and managed.Read definition

SSDLC (Secure Software Development Lifecycle)The Secure Software Development Lifecycle (SSDLC) is the practice of integrating security activities into every phase of software development — requirements, design, coding, testing, and release — rather than treating security as a final pre-production gate. Core activities include threat modelling, secure coding standards, SAST and SCA in CI/CD, and security testing, so vulnerabilities are found and fixed early.Read definition

Threat intelligenceThreat intelligence is evidence-based knowledge about threats — threat actors, their capabilities, motives, and indicators of compromise — collected and analysed to inform security decisions. Effective threat intelligence is timely, relevant to the organisation, and actionable: it tells the security team what to look for, what to block, and where to focus, rather than arriving as generic news about the threat landscape.Read definition

Threat modellingThreat modelling is a structured analysis of a system's design to identify security threats before the system is built. Conducted at design time, it examines the architecture, traces how data flows through it, and applies frameworks like STRIDE to enumerate threats, so that flaws can be fixed on a diagram — where they cost minutes — rather than in production code, where they cost far more.Read definition

TLPT (Threat-Led Penetration Test)A Threat-Led Penetration Test is an advanced, scenario-driven penetration test in which the scope, objectives, and attack scenarios are derived from credible, current threat intelligence, executed by qualified red-teamers over an extended period, and overseen by regulators. DORA requires financial entities selected by competent authorities to conduct TLPT, which follows the European TIBER-EU framework.Read definition

vCISO (Virtual CISO)A vCISO, virtual Chief Information Security Officer, is an experienced security leader provided as a service to organisations that need strategic security leadership but do not require, or cannot recruit, a full-time CISO. A vCISO sets security strategy, manages risk and compliance, leads the security programme, and reports to leadership — delivering CISO-level expertise at a fraction of a full-time executive's cost.Read definition

40 termsCompliance frameworksManaged securityOffensive securityThreat intelligence

Talk to an expert

Need help applying a term to your environment?

Whether it is scoping a penetration test, achieving ISO 27001, or understanding your NIS2 obligations, Passeca's experts turn definitions into action.

Book a free consultation Explore services