Cybersecurity Glossary

Agentic AI refers to AI systems that can plan and take multi-step actions toward a goal with little human input, using tools, memory, and feedback loops, rather than only responding to a single prompt. Instead of generating one answer, an agentic system decides what to do next, runs an action, observes the result, and repeats until the goal is met.

The practice of protecting Application Programming Interfaces from threats that exploit vulnerabilities in authentication, authorization, data validation, and business logic, ensuring that only authorized users and systems can access API resources and perform permitted operations.

An attack surface is the total set of points where an unauthorized user could try to enter, extract data from, or otherwise interact with a system. It includes every exposed endpoint, input field, API, service, port, and user role, across digital, physical, and human channels.

Authentication is the process of verifying a user's identity (proving who you are), while authorization is the process of determining what an authenticated user is permitted to access or do (proving what you are allowed to do). Together, they form the foundation of access control in every application and API.

Broken access control is a class of vulnerability where an application fails to enforce restrictions on what users can do or see, letting them reach data or actions outside their intended permissions. It is the number one risk in the OWASP Top 10 2021 and includes IDOR and BOLA, privilege escalation, forced browsing, and method or header based bypasses.

A trial-and-error attack method that systematically attempts every possible combination of passwords, encryption keys, or other credentials until finding the correct one, relying on computational power rather than exploiting vulnerabilities.

A bug bounty is a program in which an organization invites security researchers to find and report vulnerabilities in its systems in exchange for recognition or financial rewards. Hunters test in-scope targets under defined rules, submit a report with proof, and are paid a bounty when the issue is validated.

Burp Suite is an integrated platform for web application and API security testing that works as an intercepting proxy, sitting between your browser and the target server so you can view, modify, and replay every HTTP request and response. It is the de facto standard tool for manual web penetration testing and bug bounty hunting.

A business logic vulnerability is a flaw in the design or rules of an application that lets an attacker abuse legitimate functionality to produce an unintended outcome, such as paying the wrong price or bypassing a workflow step. It exploits how the application is supposed to work rather than a technical coding bug like a missing input filter.

The Chief Information Security Officer is a senior executive responsible for establishing and maintaining an organization's security vision, strategy, and program to ensure information assets and technologies are adequately protected.

The set of policies, technologies, controls, and services designed to protect cloud computing environments, including the data, applications, and infrastructure hosted across IaaS, PaaS, and SaaS providers from threats, misconfiguration, and unauthorized access.

A cybersecurity professional who specializes in designing, implementing, and maintaining security controls for cloud-based infrastructure, applications, and data across platforms like AWS, Azure, and Google Cloud.

Command and control (C2) is how an attacker communicates with and directs malware on compromised systems, issuing instructions and receiving stolen data while trying to blend into normal network traffic.

The discipline of meeting and demonstrating adherence to laws, regulations, contractual obligations, and industry standards governing how organizations protect data, operate technology, and manage risk, encompassing frameworks like SOC 2, ISO 27001, PCI DSS, HIPAA, and GDPR.

Credential dumping is the act of extracting account login material, such as password hashes or plaintext passwords, from a compromised system (for example from LSASS memory or the SAM database) so an attacker can authenticate as legitimate users.

An automated cyberattack that uses stolen username-password pairs from data breaches to gain unauthorized access to user accounts on other services, exploiting the widespread practice of password reuse.

A deliberate attempt by malicious actors to breach, disrupt, or damage computer systems, networks, or data, ranging from phishing and malware infections to sophisticated nation-state operations targeting critical infrastructure.

The Cyber Kill Chain is a model, created by Lockheed Martin, that breaks a cyberattack into sequential stages from reconnaissance to actions on objectives, so defenders can detect and interrupt an attack before it reaches its goal.

The practice of protecting computer systems, networks, programs, and data from digital attacks, unauthorized access, damage, or theft through technologies, processes, and practices designed to safeguard digital assets.

A cybersecurity analyst protects an organization's computer systems, networks, and data from cyber threats by monitoring security infrastructure, analyzing vulnerabilities, investigating incidents, and implementing security measures to prevent breaches.

An incident where sensitive, protected, or confidential information is accessed, disclosed, or stolen by unauthorized individuals, whether through cyberattacks, insider threats, or accidental exposure, potentially causing financial, reputational, and legal harm.

Data exfiltration is the unauthorized transfer of data out of a system or network by an attacker. The stolen data is often staged, compressed, and routed over a command and control channel or an alternate protocol so the activity blends in with normal traffic and avoids detection.

A Distributed Denial of Service attack overwhelms a target server, service, or network with massive amounts of traffic from multiple sources, making it unavailable to legitimate users.

Defense evasion is the set of techniques attackers use to avoid being detected, such as obfuscating or encoding code, disabling or tampering with security tools, and hiding payloads inside legitimate processes. It maps to the MITRE ATT&CK tactic TA0005 and runs across nearly every stage of an intrusion.

The process of converting readable data (plaintext) into an unreadable format (ciphertext) using mathematical algorithms and cryptographic keys, ensuring that only authorized parties can access the original information.

EDR solutions continuously monitor endpoints (computers, servers, mobile devices) for threats, providing real-time visibility, threat detection, investigation capabilities, and automated response to security incidents.

A piece of code, sequence of commands, or technique that takes advantage of a vulnerability in software, hardware, or human behavior to cause unintended consequences such as remote code execution, privilege elevation, denial of service, or information disclosure.

A network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

Google dorking (also called Google hacking) is the use of advanced search operators such as site:, inurl:, intitle:, and filetype: to find information that is exposed on the public web but not easy to discover through normal searching. Security researchers use it to surface exposed files, login pages, and vulnerability disclosure policies.

HTTP method tampering, also called verb tampering, is an attack technique where a request's HTTP method (GET, POST, HEAD, OPTIONS, PUT, DELETE, TRACE) is changed to bypass security controls that only protect specific methods. A common outcome is bypassing authentication or access controls that a developer configured for GET and POST only.

A framework of policies, processes, and technologies that ensures the right individuals and machines have the appropriate access to the right resources at the right times for the right reasons, encompassing authentication, authorization, governance, and lifecycle management.

Insecure Direct Object Reference (IDOR) and Broken Object Level Authorization (BOLA) are access control vulnerabilities where an application exposes internal object references, such as user IDs or file names, and fails to verify that the requesting user has permission to access the referenced object.

Intrusion Detection Systems (IDS) monitor network traffic for suspicious activity and alert security teams, while Intrusion Prevention Systems (IPS) can actively block detected threats in real-time.

A cybersecurity professional who investigates, contains, and remediates security breaches and cyberattacks, working to minimize damage, recover systems, and prevent future incidents through forensic analysis and coordinated response.

The organized approach to addressing and managing security breaches or cyberattacks, including preparation, detection, containment, eradication, recovery, and lessons learned to minimize damage and reduce recovery time.

Indirect prompt injection, also called second-order prompt injection, hides a malicious instruction inside external content that a large language model will read later, such as a web page, PDF, email, or product review. When a victim asks the model to summarize or process that content, the model executes the hidden instruction, so the attacker never interacts with the target directly.

Information disclosure, also called information leakage, is a vulnerability where an application unintentionally reveals sensitive data to users, such as stack traces, database errors, internal file paths, framework versions, API keys, or other users' data. It is frequently the reconnaissance gateway that makes higher impact attacks possible.

Lateral movement is the set of techniques attackers use to move from one compromised system to others inside a network, pivoting through systems and accounts toward higher-value targets. It is post-compromise activity that happens after the initial foothold, as the intruder expands access and hunts for the data, credentials, or systems they actually came for.

The lethal trifecta is a term coined by security researcher Simon Willison for the three capabilities that, when combined in one AI system, make it trivially exploitable through prompt injection: access to private data, exposure to untrusted content, and the ability to communicate externally. Any system with all three at once can have its data stolen by a hidden instruction, and removing any single leg breaks the chain.

An LLM jailbreak is an attack that bypasses a large language model's safety alignment so it produces content it was trained to refuse. Unlike prompt injection, which abuses the application's inability to separate instructions from data, a jailbreak targets the model's alignment training directly, using personas, fiction framing, encoding, or many-shot context flooding to strip the safety layer.

LLM security is the practice of protecting applications built on large language models from attacks unique to them, such as prompt injection, jailbreaks, sensitive information disclosure, and excessive agency. Because a model cannot separate instructions from data, LLM security relies on defense in depth: input and output guardrails, system prompt hardening, alignment training, least privilege, and human oversight, rather than a single fix.

Malicious software designed to infiltrate, damage, or gain unauthorized access to computer systems, including viruses, worms, trojans, ransomware, spyware, and other harmful programs.

The process of dissecting malicious software to understand its functionality, origin, capabilities, and potential impact, using static, dynamic, behavioral, and code analysis techniques to produce indicators of compromise, signatures, and threat intelligence.

A cyberattack where an attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other, enabling eavesdropping, data theft, and session hijacking.

Mass assignment is a vulnerability where an application automatically binds user supplied input to internal object properties without filtering, letting an attacker set fields they should not control, such as role, isAdmin, or balance. Also called autobinding or object injection, it appears on the OWASP API Security Top 10.

MITRE ATT&CK is a free, globally used knowledge base of real-world adversary tactics and techniques, organized into 14 tactics that map the stages of a cyberattack from reconnaissance to impact. Defenders use it as a common language to describe, detect, and respond to how attackers actually operate.

Network security encompasses the policies, practices, and technologies designed to protect the integrity, confidentiality, and accessibility of computer networks and data from unauthorized access, misuse, or attacks.

A consensus-driven ranking of the ten most critical API security risks, published by the Open Web Application Security Project (OWASP), that serves as the industry standard for understanding and prioritizing API vulnerabilities in web and mobile applications.

Parameter tampering is a web attack technique where an attacker modifies the parameters exchanged between client and server, such as form fields, URL query strings, cookies, or POST and PUT body values, to change how the application behaves. It is used to probe for SQL injection, access control flaws, price manipulation, and business logic vulnerabilities.

A software application that securely stores, generates, and manages passwords and other credentials in an encrypted vault, allowing users to maintain unique, complex passwords for every account without memorizing them.

A cybersecurity professional who conducts authorized simulated attacks against computer systems, networks, and applications to identify security vulnerabilities before malicious actors can exploit them.

A simulated cyberattack against a computer system, network, or web application to identify security vulnerabilities that could be exploited by malicious actors.

A social engineering attack that uses fraudulent emails, messages, or websites to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.

An attack technique in which an adversary gains higher-level permissions than originally granted on a system, network, or application, typically moving from a standard user context to administrative, root, or domain-level access.

Prompt injection is an attack that manipulates a large language model into treating attacker-supplied text as a trusted instruction instead of data. Because an LLM reads the developer's system prompt, the user's message, and any external content as one continuous stream of tokens, input phrased to look like a command can override the developer's rules, leak the hidden system prompt, or trigger unintended actions.

A race condition is a flaw that occurs when the outcome of an operation depends on the timing or order of multiple actions that run concurrently. In security, attackers exploit the brief window between a check and an action (a time-of-check to time-of-use gap) to bypass limits, such as redeeming a single coupon or withdrawing funds multiple times.

A type of malicious software that encrypts victim files or locks access to systems, demanding payment (typically in cryptocurrency) in exchange for restoring access or preventing data disclosure.

Reconnaissance, or recon, is the information-gathering phase of a security assessment in which a tester maps an organization's assets, technologies, endpoints, and people before any active testing. It is split into passive recon (collecting public data without touching the target) and active recon (directly probing the target).

A security exercise methodology where red teams simulate real-world attacks against an organization while blue teams defend, with the goal of testing and improving security capabilities through adversarial collaboration.

Responsible disclosure is the practice of privately reporting a security vulnerability to the affected organization and giving it reasonable time to fix the issue before any public disclosure. It balances the researcher's goal of transparency with the organization's need to protect users while a patch is developed.

A structured discipline for identifying, assessing, prioritizing, treating, and monitoring risks to an organization's information, systems, and operations, balancing security investment against business impact, threat likelihood, and risk tolerance.

A senior cybersecurity professional who designs and oversees the implementation of an organization's security infrastructure, frameworks, and strategies to protect against current and emerging threats.

A cybersecurity professional who designs, implements, and maintains security systems and infrastructure to protect an organization's networks, applications, and data from threats and vulnerabilities.

A structured set of guidelines, controls, and best practices that organizations use to design, implement, and assess their cybersecurity programs, providing a common language for managing risk and demonstrating maturity, with examples including NIST CSF, ISO 27001, CIS Controls, and MITRE ATT&CK.

A centralized facility where security professionals monitor, detect, analyze, and respond to cybersecurity incidents using a combination of technology solutions, processes, and human expertise on a 24/7 basis.

Security Information and Event Management systems collect, aggregate, and analyze security data from across an organization's IT infrastructure to detect threats, support incident response, and meet compliance requirements.

A Security Operations Center Analyst monitors an organization's networks and systems for security threats, investigates alerts, responds to incidents, and helps maintain the overall security posture through continuous surveillance and analysis.

Psychological manipulation techniques used to deceive people into divulging confidential information, granting access, or taking actions that compromise security, exploiting human trust rather than technical vulnerabilities.

Malicious software that secretly monitors user activity, collecting sensitive information such as keystrokes, passwords, browsing habits, and personal data without consent for exfiltration to attackers.

A code injection attack that exploits vulnerabilities in web applications by inserting malicious SQL statements into input fields, allowing attackers to manipulate databases, access unauthorized data, or execute administrative operations.

A proactive cybersecurity discipline in which analysts hypothesize about, search for, and investigate threats that have evaded existing defenses, using telemetry, threat intelligence, and adversary behavior models to detect attackers already inside the environment.

Threat intelligence is evidence-based knowledge about attackers, their tactics, techniques, and indicators, collected and analyzed so defenders can anticipate, detect, and respond to threats rather than react blindly. It turns scattered data about adversaries into context that guides real security decisions.

A cybersecurity professional who researches, analyzes, and reports on cyber threats, threat actors, and their tactics, techniques, and procedures (TTPs) to help organizations anticipate and defend against attacks.

A structured process for identifying, analyzing, and addressing potential security threats to a system or application by examining its architecture, data flows, and trust boundaries to prioritize security controls.

A type of malware that disguises itself as legitimate software to trick users into installing it, then performs malicious actions such as stealing data, creating backdoors, or downloading additional malware.

TTPs stands for tactics, techniques, and procedures: the layered description of how an attacker operates, from high-level goals (tactics) down to the methods used (techniques) and the exact steps taken (procedures). Defenders use TTPs to describe, detect, and predict adversary behavior.

A security method requiring two different forms of identification to access an account or system, typically combining something you know (password) with something you have (phone, security key) or something you are (biometric).

A classification system for computer hackers based on their motivations, ethics, and methods, ranging from ethical white hat security researchers to malicious black hat criminals, with various grey areas in between.

A Virtual Private Network creates an encrypted tunnel between your device and a remote server, protecting data in transit and masking your IP address to enhance privacy and security on public networks.

A Virtual Private Network (VPN) is a technology that creates a secure, encrypted connection over a less secure network, typically the public internet. By establishing an encrypted tunnel between a user's device and a remote server, VPNs protect data confidentiality, mask the user's IP address, and enable secure remote access to private networks, making them essential for both organizational security and individual privacy.

A systematic process of identifying, classifying, and prioritizing security weaknesses in systems, applications, and networks, using automated scanning, manual review, and threat intelligence to produce actionable remediation guidance.

A Vulnerability Disclosure Program (VDP) is a formal channel an organization publishes so security researchers can report vulnerabilities safely and legally. Unlike a paid bug bounty, a VDP usually offers recognition such as a Hall of Fame entry rather than cash, and provides safe harbor for good-faith research.

Automated security tools that systematically probe systems, networks, and applications to identify known security vulnerabilities, misconfigurations, and weaknesses that could be exploited by attackers.

A web shell is a malicious script an attacker plants on a web server to gain persistent remote access, run commands, and use the server as a foothold for moving deeper into a network. It turns a public web application into a covert backdoor that survives reboots and blends in with normal web traffic.

The world's most widely used network protocol analyzer, Wireshark captures and interactively analyzes network traffic in real-time, enabling security professionals to troubleshoot networks, analyze protocols, and investigate security incidents.

A security model and architecture built on the principle "never trust, always verify," eliminating implicit trust based on network location and continuously authenticating, authorizing, and validating every user, device, and request before granting access to resources.

A cyberattack that exploits a previously unknown security vulnerability before the software vendor has had time to develop and release a patch, leaving systems defenseless against the attack.