APIs, Networking and Security
request
noun
Meaning
A message that a client sends to a server or API, asking it to do something such as return data or save a new record.
Where you use it
Every API call is a request followed by a response. An HTTP request has a method (GET, POST…), a URL, headers and often a body. Common phrases: send a request, handle a request, the request timed out, bad request (status 400).
Examples
The app sends a request to the pricing service every time the cart changes.
Our server handles about 3,000 requests per second at peak time.
Common phrases
send a request · handle a request · request body · the request timed out · requests per second
More about this term →response
noun
Meaning
The message a server or API sends back after receiving a request, usually containing a status code, headers and data such as JSON.
Where you use it
Developers inspect, parse and log responses. 'Response time' is how long the server takes to answer, an important performance measure. An 'empty response' or 'unexpected response' usually means something went wrong on the other side.
Examples
The response comes back as JSON, but the date field is sometimes missing.
Average response time went up to 900 milliseconds after the last deploy.
Common phrases
response time · response body · parse the response · empty response · API response
More about this term →API key
noun
Meaning
A unique secret code that a program sends with its requests so that the API can identify who is calling and decide what they are allowed to do.
Where you use it
You generate, rotate or revoke an API key in a provider's dashboard. Keys must stay secret: never commit them to a repository or put them in front-end code. If a key leaks, rotate it immediately.
Examples
Someone pushed an API key to the public repo, so we rotated it within an hour.
Each customer gets their own API key, so we can track usage per account.
Common phrases
generate an API key · rotate an API key · revoke an API key · leaked API key
More about this term →token
noun
Meaning
A string of characters that proves a user or app has already logged in or has permission. It is sent with each request instead of a password.
Where you use it
Common types are access tokens, refresh tokens and JWTs (JSON Web Tokens). Tokens usually expire, so apps refresh them. A token is often sent in the Authorization header as 'Bearer <token>'. In AI and compilers, 'token' has other meanings.
Examples
The request fails with 401 because the access token expired an hour ago.
Store the refresh token securely and never write it to the logs.
Common phrases
access token · refresh the token · the token expired · bearer token
More about this term →authorization
noun
Meaning
The process of checking what an identified user or app is allowed to do, for example whether they can read a file or delete an account.
Where you use it
Often confused with authentication, which asks 'Who are you?', while authorization asks 'What are you allowed to do?'. Shortened to authz (and authentication to authn). An HTTP 403 Forbidden response usually means authorization failed. British English also writes 'authorisation'.
Examples
The user is logged in, but the authorization check stops them from seeing other teams' reports.
We moved all authorization rules into one service so they're easier to audit.
Usage note
The HTTP header called 'Authorization' actually carries authentication data, such as a token; the name is a historical accident.
Common phrases
authorization check · role-based authorization · Authorization header · authorization rules
More about this term →webhook
noun
Meaning
A way for one system to automatically send an HTTP request to another system's URL when an event happens, such as a successful payment, instead of waiting to be asked.
Where you use it
Used by services such as Stripe, GitHub and Slack. You register or set up a webhook, and your webhook endpoint receives the events. The opposite approach is polling, which means asking again and again. Always verify the webhook signature for security.
Examples
Stripe calls our webhook when a payment succeeds, and we mark the order as paid.
The GitHub webhook triggers a build every time someone pushes to main.
Common phrases
set up a webhook · webhook endpoint · webhook payload · verify the webhook signature
More about this term →rate limit
noun
Meaning
A cap on how many requests a client may send to an API in a given time, for example 100 requests per minute, to protect the service from overload or abuse.
Where you use it
When you hit or exceed the rate limit, the API usually returns status 429 Too Many Requests. Clients handle it by waiting and retrying with increasing delays (backoff). As a verb: 'We got rate-limited.'
Examples
The import job hit the rate limit after 1,000 requests and stopped.
We added a rate limit to the login endpoint to slow down password-guessing attacks.
Common phrases
hit the rate limit · exceed the rate limit · get rate-limited · 429 Too Many Requests
More about this term →backward compatible
adjective
Meaning
Still working with older versions, data or clients after a change, so existing users do not have to update their code or settings.
Where you use it
Also written 'backwards compatible', which is more common in British English. The noun is backward compatibility. Adding an optional field to an API is usually backward compatible; renaming a field is a breaking change. Teams promise to stay backward compatible within a major version.
Examples
Make the new parameter optional so the change stays backward compatible.
Version 3 is not backward compatible, so older mobile apps will stop working.
Common phrases
stay backward compatible · backward compatibility · fully backward compatible · break backward compatibility
More about this term →HTTP
abbreviation
Meaning
Hypertext Transfer Protocol: the set of rules that browsers and servers use to send requests and responses across the web.
Where you use it
Developers speak of HTTP requests, methods, headers and status codes. Versions are named HTTP/1.1, HTTP/2 and HTTP/3; the secure version, used by almost every site today, is HTTPS.
Examples
The app sends an HTTP request to the server every time you press Save.
Our CDN already serves everything over HTTP/2.
Common phrases
HTTP request · HTTP response · HTTP header · HTTP status code · over HTTP
More about this term →HTTPS
abbreviation
Meaning
The secure version of HTTP, which encrypts the connection between the browser and the server with TLS so that others cannot read or change the data.
Where you use it
Needs a valid certificate on the server. Browsers mark plain HTTP pages as 'Not secure', and many modern features, such as service workers and geolocation, only work over HTTPS.
Examples
Redirect all traffic from HTTP to HTTPS.
The camera doesn't work on the test site because it isn't served over HTTPS.
Common phrases
over HTTPS · force HTTPS · redirect to HTTPS · HTTPS connection
More about this term →fetch
verb
Meaning
To request and receive data from a server or API, for example the latest messages or a list of products, often while the page is already open.
Where you use it
In JavaScript, fetch() is also the name of the built-in function for HTTP requests (the Fetch API). Developers fetch data on page load, on scroll or after a click, and talk about 'data fetching' strategies.
Examples
We fetch the user's profile as soon as they log in.
The component fetches new comments every thirty seconds.
Common phrases
fetch data · fetch from an API · data fetching · refetch
More about this term →HTTP method
noun
Meaning
The word at the start of an HTTP request that says what the client wants to do, such as GET to read, POST to create or DELETE to remove.
Where you use it
The common methods are GET, POST, PUT, PATCH and DELETE, also called HTTP verbs. Developers say 'send a POST request' or 'this endpoint only accepts GET'.
Examples
The server returns 405 because we used the wrong HTTP method.
Use PATCH as the HTTP method when you only change a few fields.
Usage note
PUT usually replaces a whole resource, while PATCH changes only part of it.
Common phrases
GET request · POST request · HTTP verb · method not allowed
More about this term →cross-site scripting
noun
Meaning
An attack in which someone gets harmful JavaScript into a page that other users open, for example through a comment, so that the script runs in their browsers.
Where you use it
Usually called XSS. It can be used to steal session data or change what users see. Common defenses are escaping user input, avoiding raw innerHTML and setting a Content Security Policy (CSP) header.
Examples
The search page was open to cross-site scripting because it printed the query without escaping it.
The security report lists two cross-site scripting issues in the comment form.
Common phrases
XSS attack · XSS vulnerability · prevent cross-site scripting · escape user input · Content Security Policy
More about this term →SQL injection
noun
Meaning
An attack in which someone types SQL code into a form or URL so that the database runs it, which can expose or delete data.
Where you use it
Happens when user input is pasted directly into a query string. It is prevented with parameterized queries (prepared statements) or an ORM. SQL is said letter by letter or as 'sequel'.
Examples
This login form is vulnerable to SQL injection because it builds the query by joining strings.
Parameterized queries protect us from SQL injection.
Common phrases
SQL injection attack · vulnerable to SQL injection · parameterized query · prepared statement
More about this term →CORS
abbreviation
Meaning
Cross-Origin Resource Sharing: browser rules that let a server say which other websites (origins) may read its responses through JavaScript.
Where you use it
Pronounced as one word, 'cors'. The famous 'blocked by CORS policy' error appears when a front end calls an API on another domain that doesn't send the right Access-Control-Allow-Origin header. It is fixed on the server, not in the browser.
Examples
The API works in Postman but fails in the browser with a CORS error.
Ask the back-end team to allow our domain in the CORS settings.
Usage note
CORS does not protect the server; it relaxes the browser's same-origin policy in a controlled way.
Common phrases
CORS error · CORS policy · enable CORS · CORS headers · cross-origin request
More about this term →CSRF
abbreviation
Meaning
Cross-Site Request Forgery: an attack that tricks a logged-in user's browser into sending an unwanted request, such as changing an email address, to a site the user trusts.
Where you use it
Often said as 'sea-surf' or letter by letter. Common protections are CSRF tokens in forms and SameSite cookies, and many back-end frameworks include CSRF protection by default.
Examples
The form fails with 'CSRF token mismatch' because the page was open for too long.
SameSite cookies make CSRF attacks much harder.
Common phrases
CSRF token · CSRF protection · CSRF attack · token mismatch
More about this term →hash
verb
Meaning
To turn data such as a password into a fixed-length string with a one-way function, so that the original value cannot be read back from it.
Where you use it
Passwords are hashed with slow algorithms designed for the job, such as bcrypt or Argon2, together with a random salt. The noun is also hash: at login, the system hashes the typed password and compares the two hashes.
Examples
We never store passwords in plain text; we hash them with bcrypt.
The old system hashed passwords with MD5, which is no longer considered safe.
Usage note
Hashing is not encryption: encrypted data can be decrypted with a key, but a hash cannot be reversed.
Common phrases
hash a password · password hash · hashing algorithm · salt and hash
More about this term →IAM
abbreviation
Meaning
Short for identity and access management: the system that controls who or what can sign in to a cloud account and what they are allowed to do there.
Where you use it
Said letter by letter, 'I-A-M'. Its building blocks are users, groups, roles and policies. AWS and Google Cloud call their services IAM; Azure uses Microsoft Entra ID with role-based access control (RBAC).
Examples
The deploy failed because the pipeline's IAM role can't write to the bucket.
We review IAM permissions every quarter and remove anything that isn't used.
Common phrases
IAM role · IAM policy · IAM user · IAM permissions
More about this term →least privilege
noun
Meaning
The security principle that every user, service or program should get only the permissions it really needs for its job, and nothing more.
Where you use it
Usually in the phrase 'the principle of least privilege'. It comes up in security reviews, audits and IAM work: 'this role breaks least privilege', 'scope it down to least privilege'.
Examples
Following least privilege, the reporting service can read the database but never write to it.
Giving everyone admin rights goes against the principle of least privilege.
Common phrases
principle of least privilege · least-privilege access · apply least privilege · least-privilege policy
More about this term →secret
noun
Meaning
A sensitive value that a system needs to work, such as a password, API key, token or private key, which must be stored safely and never shown in code or logs.
Where you use it
Secrets are stored in tools such as HashiCorp Vault, AWS Secrets Manager or Azure Key Vault, injected at runtime and rotated regularly. A 'leaked secret' in Git history must be rotated at once, not just deleted.
Examples
Someone committed a secret to the repo, so we rotated the key within the hour.
The app reads its database password from the secret store at startup.
Usage note
A Kubernetes Secret is only base64-encoded by default, not encrypted, so it needs extra protection.
Common phrases
store a secret · rotate a secret · secrets manager · leaked secret · Kubernetes Secret
More about this term →security group
noun
Meaning
A virtual firewall in the cloud with rules that say which network traffic, by port and source, may reach or leave a server or other resource.
Where you use it
The name comes from AWS; Azure has network security groups (NSGs) and Google Cloud uses firewall rules. Engineers open or close ports with inbound and outbound rules. 'Open to 0.0.0.0/0' means open to the whole internet.
Examples
The security group only allows traffic on port 443 from the load balancer.
I can't connect to the instance; I think the security group is blocking SSH.
Common phrases
security group rule · inbound rule · open a port · network security group
More about this term →encryption
noun
Meaning
Turning data into an unreadable form that can only be turned back with the right key, so that people without the key cannot read it.
Where you use it
Cloud teams talk about 'encryption at rest' (stored data, such as disks and buckets) and 'encryption in transit' (data moving over the network, usually with TLS). Keys are often kept in a key management service (KMS).
Examples
Encryption at rest is turned on for every disk and bucket by default.
The auditors asked us to prove encryption in transit between the services.
Common phrases
encryption at rest · encryption in transit · encryption key · end-to-end encryption
More about this term →shared responsibility model
noun
Meaning
The idea that security in the cloud is split: the provider protects the data centers, hardware and core services, and the customer protects their own data, settings and access.
Where you use it
AWS sums it up as security 'of' the cloud (provider) versus security 'in' the cloud (customer). The split depends on the service type: with IaaS the customer manages more than with SaaS. Often mentioned in audits and training.
Examples
Under the shared responsibility model, a public bucket is our mistake, not the provider's.
Every new engineer learns the shared responsibility model in their first security training.
Common phrases
under the shared responsibility model · security of the cloud · security in the cloud
More about this term →push notification
noun
Meaning
A short message sent from a server to a user's device that appears on the screen even when the app is not open, for example about a new message or a delivery.
Where you use it
Used by developers, product managers and marketers. You send, receive, schedule and tap on push notifications; people often shorten it to 'push' (send a push). On iOS they go through Apple's APNs, and on Android usually through Firebase Cloud Messaging (FCM).
Examples
Users who turn on push notifications come back to the app much more often.
Tapping the push notification should open the order details, not the home screen.
Common phrases
send a push notification · receive push notifications · turn on push notifications · push notification permission
More about this term →permission
noun
Meaning
The user's approval that an app needs before it can use sensitive features or data, such as the camera, location, contacts or notifications.
Where you use it
An app requests or asks for a permission, and the user grants or denies it. Both platforms ask at runtime, when the feature is first needed; iOS also requires a short text explaining why the app needs it. The timing and wording of the request affect how many users say yes.
Examples
If the user denies camera permission, show a button that opens the Settings app.
We ask for location permission only when the user opens the map.
Common phrases
request permission · grant permission · deny permission · location permission · permission prompt
More about this term →deep link
noun
Meaning
A link that opens a specific screen inside an app, such as a product page or an order, instead of just starting the app on its home screen.
Where you use it
Used with push notifications, emails, ads and QR codes. iOS Universal Links and Android App Links use normal web addresses; older custom URL schemes such as myapp:// are also common. A deferred deep link still works when the user has to install the app first.
Examples
The deep link in the email opens the app but lands on the home screen instead of the campaign.
Every push notification should include a deep link to the right screen.
Common phrases
open a deep link · handle deep links · deferred deep link · deep link URL
More about this term →local notification
noun
Meaning
A notification that the app schedules on the device itself, for example a reminder at 9 a.m., without needing a server to send it.
Where you use it
Used for reminders, alarms, timers and calendar events. Developers schedule, cancel and update local notifications, and they still need the user's notification permission. Compared with push notifications, which come from a server.
Examples
The medicine reminder is a local notification, so it works even without internet.
Cancel the local notification if the user completes the task early.
Common phrases
schedule a local notification · cancel a local notification · repeating notification · notification trigger
More about this term →APNs
abbreviation
Meaning
Apple Push Notification service: Apple's system that delivers push notifications from a server to iPhones, iPads and other Apple devices.
Where you use it
Every push notification to an Apple device goes through APNs, even when a service such as FCM sits in between. Servers connect with an authentication key (.p8 file) or a certificate, and there are separate sandbox and production environments.
Examples
Notifications work in debug builds but not in TestFlight; are we using the production APNs environment?
Upload the APNs key to Firebase, or iOS users won't get any notifications.
Usage note
Written with a small 's' (APNs) because the 's' stands for 'service'.
Common phrases
APNs key · APNs certificate · APNs environment · send via APNs
More about this term →FCM
abbreviation
Meaning
Firebase Cloud Messaging: Google's free service for sending push notifications and data messages to Android, iOS and web apps.
Where you use it
The standard way to send push notifications on Android, and widely used for iOS too, where it forwards messages through APNs. Developers get an FCM registration token for each device and send messages with the HTTP v1 API or the Firebase console. It replaced the older Google Cloud Messaging (GCM).
Examples
We send all marketing pushes through FCM, for both Android and iOS.
The FCM token changes after the user reinstalls the app.
Common phrases
FCM token · send via FCM · FCM data message · Firebase console
More about this term →device token
noun
Meaning
A unique string that identifies one installation of an app on one device; the server needs it to send push notifications to that device.
Where you use it
The app registers for notifications, receives the device token (on Android, the FCM registration token) and sends it to the back end. Tokens can change, so apps send the new one when it is refreshed, and servers delete tokens that are no longer valid.
Examples
The user isn't getting notifications because we never saved their device token.
Send the device token to the server again after every login.
Common phrases
register a device token · refresh the token · invalid token · registration token
More about this term →badge
noun
Meaning
A small number or dot shown on an app icon or a tab, usually in red, that tells users how many unread items or new notifications are waiting.
Where you use it
Developers set, update and clear the badge count, on iOS often from the push notification payload. On Android, notification dots on the icon depend on the launcher. Wrong badge counts that never clear are a common user complaint.
Examples
The badge still shows 3 even after I read all my messages.
Clear the badge when the user opens the notifications screen.
Common phrases
badge count · clear the badge · app icon badge · notification badge
More about this term →opt in
phrasal verb
Meaning
To choose actively to take part in something, such as receiving notifications or sharing data; the opposite is to opt out.
Where you use it
Used as a phrasal verb (opt in to notifications) and, with a hyphen, as a noun or adjective: the opt-in rate, an opt-in prompt. iOS and, since Android 13, Android need the user's permission for notifications, so teams track how many users opt in.
Examples
Only 45% of our iOS users opt in to push notifications.
Our opt-in rate went up after we explained what the notifications are for.
Common phrases
opt in to notifications · opt-in rate · opt-in prompt · opt out
More about this term →keychain
noun
Meaning
Apple's encrypted storage for small secrets such as passwords, tokens and keys, protected by the system and kept separate from normal app data.
Where you use it
iOS developers save access tokens to the keychain rather than UserDefaults. Keychain items can survive app deletion and can be shared between apps from the same developer team. The closest Android counterpart is the Android Keystore system, which protects cryptographic keys.
Examples
Store the refresh token in the keychain, not in UserDefaults.
Users stay logged in after reinstalling because the token is still in the keychain.
Common phrases
save to the keychain · keychain item · keychain access · Android Keystore
More about this term →biometric authentication
noun
Meaning
Confirming a user's identity with a physical feature, such as a fingerprint or a face scan, instead of or in addition to a password or PIN.
Where you use it
On iOS this means Face ID and Touch ID through the LocalAuthentication framework; on Android, BiometricPrompt. Banking and health apps use it to unlock the app or approve payments. The app never receives the fingerprint or face data, only a success or failure result.
Examples
Users can turn on biometric authentication to log in with Face ID.
If biometric authentication fails three times, fall back to the PIN.
Common phrases
biometric login · Face ID · Touch ID · fall back to a passcode
More about this term →threat
noun
Meaning
Anything that could cause harm to a system or to data, such as an attacker, a piece of malware, a careless employee or even a flood in the server room.
Where you use it
Used constantly in risk discussions, threat reports and briefings. Security people talk about threats to an organisation, emerging threats and the threat landscape. A threat is the possible source of harm; a vulnerability is the weakness it could use.
Examples
Insider threats are harder to detect because the person already has legitimate access.
The quarterly report summarises the main threats to our payment systems.
Usage note
Threat, vulnerability and risk are not synonyms. Roughly: risk = how likely a threat is to use a vulnerability × how bad the impact would be.
Common phrases
insider threat · emerging threat · threat landscape · threat model · pose a threat
More about this term →vulnerability
noun
Meaning
A weakness in software, hardware, a configuration or a process that an attacker could use to cause harm or to gain access they should not have.
Where you use it
One of the most frequent words in security work. Vulnerabilities are discovered, reported, rated, patched and tracked. In speech people often shorten it to 'vuln'. A publicly known vulnerability usually gets a CVE ID and a severity score.
Examples
The scanner found three critical vulnerabilities on the public web server.
This vulnerability allows remote code execution, so it has to be patched this week.
Common phrases
critical vulnerability · known vulnerability · discover a vulnerability · patch a vulnerability · vulnerability management
More about this term →malware
noun
Meaning
Short for 'malicious software': any program written to damage systems, steal data, spy on users or take control of a device without permission.
Where you use it
The general umbrella word: viruses, worms, trojans, ransomware and spyware are all types of malware. Analysts talk about malware samples, malware families and malware analysis. It is uncountable, so say 'a piece of malware'.
Examples
The malware was hidden inside a fake invoice attachment.
We sent the malware sample to the analysis team.
Usage note
Malware is uncountable in English. Turkish speakers often write 'a malware' or 'malwares'; use 'a piece of malware', 'malware samples' or 'malware families' instead.
Common phrases
malware infection · malware sample · malware analysis · detect malware · remove malware
More about this term →phishing
noun
Meaning
A trick in which attackers send fake emails, messages or websites that look trustworthy, hoping people will click a link, open a file or reveal their passwords.
Where you use it
Probably the word employees hear most in security training. Teams talk about phishing emails, phishing campaigns and phishing simulations. Targeted phishing is called spear phishing; phishing by text message is smishing and by phone call is vishing.
Examples
Several staff reported the phishing email before anyone entered their password.
Our last phishing simulation had a click rate of eight percent.
Usage note
Spelled with 'ph' but pronounced exactly like 'fishing'.
Common phrases
phishing email · phishing campaign · spear phishing · phishing simulation · report a phishing attempt
More about this term →ransomware
noun
Meaning
Malware that encrypts a victim's files or systems and demands a payment, usually in cryptocurrency, in exchange for the key to unlock them.
Where you use it
Common in news, board meetings and incident reports. People speak of a ransomware attack, a ransom note and a ransom demand. Many groups now also steal data before encrypting it and threaten to publish it, which is called double extortion.
Examples
The ransomware encrypted the file servers overnight, but the backups were offline and safe.
Our tabletop exercise this year is based on a ransomware scenario.
Common phrases
ransomware attack · ransomware group · ransom note · double extortion · recover from ransomware
More about this term →password
noun
Meaning
A secret string of characters that a person types to prove their identity and log in to an account, device or system.
Where you use it
An everyday word in security policies and help-desk work. Passwords are set, changed, reset and rotated, and policies define their length and complexity. Current guidance, such as NIST's, favours long passphrases over frequent forced changes.
Examples
Your password has expired, so you'll need to reset it before you can log in.
The audit found shared admin passwords stored in a spreadsheet.
Usage note
Everyday Turkish uses 'şifre' for password, but security texts prefer 'parola', because 'şifre' also means a cipher or encryption.
Common phrases
reset a password · strong password · password policy · password manager · default password
More about this term →multi-factor authentication
noun
Meaning
A login method that asks for two or more different kinds of proof, such as a password plus a code from a phone, before granting access.
Where you use it
Almost always called MFA in speech; 2FA (two-factor authentication) is the two-factor version. Teams enable, enforce or roll out MFA. The factors are usually described as something you know, something you have and something you are.
Examples
We enforced multi-factor authentication for all remote access last month.
The stolen password was useless because the account had multi-factor authentication.
Common phrases
enable MFA · enforce MFA · MFA prompt · two-factor authentication · MFA fatigue
More about this term →firewall
noun
Meaning
A hardware device or piece of software that checks network traffic and allows or blocks it according to a set of security rules.
Where you use it
Network and security teams talk about firewall rules, firewall policies and opening or closing ports on the firewall. Adding a rule usually needs a change request. Products that also inspect applications are called next-generation firewalls (NGFW).
Examples
Can you open port 443 on the firewall for the new web server?
The firewall blocked several connection attempts from an unknown IP range.
Common phrases
firewall rule · firewall policy · next-generation firewall · configure a firewall · behind the firewall
More about this term →data breach
noun
Meaning
A security incident in which personal or confidential data is accessed, stolen, disclosed or lost without authorisation.
Where you use it
A word with legal weight: under laws such as the GDPR and Turkey's KVKK, organisations must notify the regulator, and sometimes the people affected, within set time limits. People say a company 'suffered a data breach' or that data was 'exposed in a breach'.
Examples
The data breach exposed the names and email addresses of 40,000 customers.
Legal wants to know whether this counts as a reportable data breach.
Usage note
'Breach' is also a verb: 'The attackers breached the network.'
Common phrases
suffer a data breach · report a data breach · breach notification · personal data breach · large-scale breach
More about this term →risk
noun
Meaning
The chance that a threat will use a weakness and cause harm, combined with how serious that harm would be for the organisation.
Where you use it
Central to management, audit and compliance language. Risks are identified, assessed, rated (low, medium, high), treated and accepted. The four classic responses are to mitigate, transfer (for example with insurance), avoid or accept a risk.
Examples
Running an unsupported operating system is a high risk we can no longer accept.
The risk owner signed off on the exception for six months.
Common phrases
risk assessment · accept a risk · residual risk · risk owner · risk register
More about this term →exploit
noun
Meaning
A piece of code or a technique that takes advantage of a vulnerability to make a system do something it was not designed to do.
Where you use it
Also a verb: attackers exploit a vulnerability, and the act is called exploitation. Advisories say whether a vulnerability is 'actively exploited' or has a 'public exploit', and either fact raises its patch priority.
Examples
A public exploit for this flaw was released two days after the advisory.
The attackers exploited an unpatched VPN appliance to get in.
Usage note
The stress changes with the part of speech: the noun is EX-ploit, the verb is ex-PLOIT.
Common phrases
public exploit · actively exploited · exploit a vulnerability · exploit code · exploit chain
More about this term →compromise
verb
Meaning
To get unauthorised access to or control of a system, account or network, so that it can no longer be trusted.
Where you use it
Very common in incident language, usually in the passive or as an adjective: 'the account was compromised', 'a compromised host'. As a noun it means the successful attack itself, as in 'signs of compromise' or 'business email compromise (BEC)'.
Examples
We believe the attacker compromised a contractor's account first.
Two compromised hosts were isolated from the network.
Usage note
False friend: in everyday English 'compromise' means an agreement in which both sides give something up. In security it means that a system has been taken over.
Common phrases
compromised account · compromised host · fully compromised · business email compromise · assume compromise
More about this term →VPN
abbreviation
Meaning
Virtual private network: a technology that creates an encrypted connection over the internet so that remote users or offices can reach a private network safely.
Where you use it
Said letter by letter. Employees connect to the VPN or work 'on VPN'; network teams set up site-to-site VPNs between offices. VPN gateways face the internet, so their vulnerabilities are often targeted and need quick patching.
Examples
You need to connect to the VPN before you can open the internal dashboard.
The site-to-site VPN between Istanbul and Frankfurt went down this morning.
Common phrases
connect to the VPN · VPN gateway · site-to-site VPN · remote-access VPN · VPN client
More about this term →penetration test
noun
Meaning
An authorised, simulated attack on a system, application or network, carried out by security specialists to find weaknesses before real attackers do.
Where you use it
Almost always called a pentest, and the people who do it are pentesters. Companies commission and scope a pentest, often yearly or after major changes, and receive a report of findings. The work needs written permission and an agreed scope.
Examples
The annual penetration test is scheduled for the second week of March.
The penetration test report listed two high-severity findings in the login flow.
Common phrases
run a penetration test · external penetration test · penetration test report · scope a pentest · web application pentest
More about this term →compliance
noun
Meaning
The state of following the laws, regulations, standards and internal policies that apply to an organisation, and being able to prove it.
Where you use it
Used for both the goal and the team: 'the compliance team', 'a compliance requirement'. Organisations are 'compliant with' or 'in compliance with' standards such as ISO/IEC 27001 or PCI DSS. Security people often point out that compliance is not the same as security.
Examples
We need to show compliance with PCI DSS before the payment launch.
Is the new logging setup compliant with our retention policy?
Common phrases
regulatory compliance · compliance requirement · compliant with · compliance audit · maintain compliance
More about this term →access control
noun
Meaning
The rules and technical measures that decide who or what can use a system, view data or enter a place, and what they are allowed to do there.
Where you use it
Covers both digital and physical security, since badge readers are access control too. Auditors check access control lists, user access reviews and how leavers' accounts are removed. Common models are role-based (RBAC) and attribute-based (ABAC) access control.
Examples
Weak access control let any logged-in user download other customers' invoices.
We review access control for the finance share every quarter.
Common phrases
access control list · physical access control · broken access control · access review
More about this term →social engineering
noun
Meaning
Manipulating people, rather than breaking technology, to make them reveal information, give access or take an action that helps an attacker.
Where you use it
The umbrella term for phishing, pretexting (inventing a believable story), fake help-desk calls and tailgating into buildings. Used in awareness training and in pentest scopes, where a social engineering test must be explicitly approved.
Examples
The caller used social engineering, pretending to be from IT and asking for a reset code.
Social engineering is out of scope for this year's test.
Common phrases
social engineering attack · social engineering test · pretexting · tailgating
More about this term →DDoS
abbreviation
Meaning
Distributed denial of service: an attack that floods a website or network with traffic from many machines at once so that real users cannot reach it.
Where you use it
Usually pronounced 'dee-doss'. The single-source version is a DoS attack. Companies buy DDoS protection or mitigation from their internet provider or a cloud service; the traffic often comes from a botnet.
Examples
The online banking site was down for an hour because of a DDoS attack.
Our DDoS protection absorbed the traffic before it reached the data centre.
Common phrases
DDoS attack · DDoS protection · DDoS mitigation · volumetric DDoS
More about this term →trojan
noun
Meaning
Malware disguised as a useful or harmless program, such as a free tool or a document, that secretly performs harmful actions once it is run.
Where you use it
Short for 'Trojan horse', from the Greek legend. Unlike a worm, it does not spread by itself; the user has to run it. A remote access trojan (RAT) gives the attacker control of the machine, and banking trojans steal online banking details.
Examples
The cracked software from the forum turned out to contain a trojan.
Analysis shows the trojan was sending screenshots to a remote server.
Common phrases
remote access trojan · banking trojan · Trojan horse · trojanised installer
More about this term →worm
noun
Meaning
Malware that copies itself and spreads from one computer to another across a network without any action from the user.
Where you use it
Known for spreading very fast, often through an unpatched network service. A vulnerability is called 'wormable' when malware could use it to spread this way, which makes patching urgent.
Examples
The worm spread to hundreds of machines through an old file-sharing service.
The vendor rated the flaw as wormable, so we patched it the same day.
Common phrases
network worm · self-propagating worm · wormable vulnerability · worm outbreak
More about this term →spyware
noun
Meaning
Malware that secretly watches what a user does and collects information such as browsing habits, messages, passwords or location.
Where you use it
Used both for simple programs that track browsing and for advanced commercial tools that target mobile phones. Like malware, it is uncountable: 'a piece of spyware'. Related words are adware and stalkerware.
Examples
The mobile team found spyware on two executives' phones during the review.
This browser extension behaves like spyware: it sends every visited URL to a third party.
Common phrases
mobile spyware · commercial spyware · spyware infection · detect spyware
More about this term →decrypt
verb
Meaning
To turn encrypted data back into its original, readable form, normally by using the correct key.
Where you use it
The opposite of encrypt; the noun is decryption. Common in ransomware cases (a decryptor tool or decryption key), in TLS inspection, where a firewall decrypts traffic to check it, and in key management discussions.
Examples
Without the private key, nobody can decrypt these files.
The proxy decrypts outbound traffic so that the DLP tool can inspect it.
Usage note
Do not confuse decrypt with 'crack': to crack means to break encryption or a password without having the key.
Common phrases
decrypt data · decrypt traffic · decryption key · free decryptor
More about this term →encryption key
noun
Meaning
A secret value, usually a long string of bits, that an encryption algorithm uses to lock and unlock data. Without it, the encrypted data cannot be read.
Where you use it
Teams generate, store, rotate and revoke keys, often in a key management service (KMS) or a hardware security module (HSM). Key length is given in bits, as in AES-256. Losing a key can mean losing the data.
Examples
The encryption keys are stored in an HSM, not on the application server.
We rotate the database encryption key every twelve months.
Common phrases
rotate a key · key management · private key · key length · revoke a key
More about this term →digital certificate
noun
Meaning
An electronic document that links a public key to an identity, such as a website or a person, and is signed by a trusted certificate authority.
Where you use it
Mostly called just a 'certificate' or 'cert'. Websites use TLS certificates for HTTPS; teams issue, install, renew and revoke them. An expired certificate is a classic cause of outages and browser warnings.
Examples
The site is showing a warning because its digital certificate expired last night.
We use a script to renew our digital certificates automatically every 60 days.
Usage note
People still say 'SSL certificate', even though these certificates are used with TLS today.
Common phrases
TLS certificate · renew a certificate · certificate authority · expired certificate · self-signed certificate
More about this term →TLS
abbreviation
Meaning
Transport Layer Security: the standard protocol that encrypts data travelling between two systems, such as a browser and a website, and checks the server's identity.
Where you use it
Said letter by letter. TLS is the security layer behind the 'S' in HTTPS and the successor of the older SSL protocol; TLS 1.2 and 1.3 are the versions in normal use. Audits check that old versions are disabled and weak cipher suites removed.
Examples
All internal services must use TLS 1.2 or higher.
The scan flagged a server that still accepts TLS 1.0.
Common phrases
TLS handshake · TLS 1.3 · TLS certificate · TLS inspection · enforce TLS
More about this term →intrusion detection system
noun
Meaning
A tool that monitors network traffic or system activity for signs of attacks or policy violations and raises an alert when it finds them.
Where you use it
Usually called an IDS. An IDS only detects and alerts, while an intrusion prevention system (IPS) can also block traffic. Teams tune IDS rules to reduce false positives. Snort and Suricata are well-known open-source examples.
Examples
The intrusion detection system raised an alert for unusual traffic from a printer.
We placed the intrusion detection system between the DMZ and the internal network.
Common phrases
network-based IDS · host-based IDS · IDS rule · IDS/IPS · tune the IDS
More about this term →zero-day
noun
Meaning
A vulnerability that is unknown to the vendor or has no patch yet, so defenders have had 'zero days' to fix it when it is first exploited.
Where you use it
Used as a noun ('a zero-day') and as an adjective ('a zero-day vulnerability', 'a zero-day exploit'). Zero-days are rare and valuable, so they make the news, but most real attacks still use known, unpatched vulnerabilities. Also written 0-day.
Examples
The attackers used a zero-day in the mail server, so there was no patch to apply.
The vendor confirmed the zero-day and published a temporary workaround.
Common phrases
zero-day vulnerability · zero-day exploit · exploited zero-day · zero-day attack
More about this term →CVE
abbreviation
Meaning
Common Vulnerabilities and Exposures: a public catalogue that gives each publicly known vulnerability a unique ID, such as CVE-2021-44228.
Where you use it
Said letter by letter. The ID itself works as a name: 'Are we affected by CVE-2021-44228?' It shows the year and a sequence number. Vendors, scanners and advisories all refer to CVEs, so that everyone talks about the same flaw.
Examples
Can you check whether any of our servers are affected by the new CVE?
The advisory lists four CVEs, two of them rated critical.
Usage note
CVE-2021-44228 is the well-known Log4Shell vulnerability in the Log4j logging library.
Common phrases
CVE ID · assign a CVE · affected by a CVE · CVE entry
More about this term →vulnerability scan
noun
Meaning
An automated check of systems, networks or applications that looks for known weaknesses, missing patches and insecure settings and lists them in a report.
Where you use it
Teams run or schedule vulnerability scans weekly or monthly with tools such as Nessus, Qualys or OpenVAS. A scan is automated and broad; a penetration test is manual and deeper. Authenticated scans log in to hosts and find more.
Examples
The monthly vulnerability scan found 120 hosts missing last month's patches.
Please exclude the production database from tonight's vulnerability scan.
Common phrases
run a vulnerability scan · authenticated scan · scan results · scheduled scan · external scan
More about this term →SIEM
abbreviation
Meaning
Security information and event management: a platform that collects logs from many systems, correlates them and raises alerts about possible attacks.
Where you use it
Usually pronounced like 'sim'. The SIEM is the central tool of a SOC: analysts write detection rules, build dashboards and search logs in it. Well-known products include Splunk, Microsoft Sentinel and Elastic Security.
Examples
Make sure the new firewall sends its logs to the SIEM.
I wrote a SIEM rule that fires when an admin logs in from a new country.
Common phrases
SIEM rule · SIEM alert · feed logs into the SIEM · SIEM dashboard
More about this term →false positive
noun
Meaning
An alert or test result that wrongly reports a threat or vulnerability when nothing harmful is actually there.
Where you use it
Very common in SOC and scanning work: analysts mark alerts as false positives and tune rules to reduce them. The opposite problem, a real attack that goes unnoticed, is a false negative and is usually more dangerous.
Examples
It was a false positive: the backup job looked like data exfiltration.
This scanner reports a lot of false positives on our Linux servers.
Common phrases
mark as a false positive · reduce false positives · false positive rate · false negative
More about this term →containment
noun
Meaning
The stage of incident response in which the team stops an attack from spreading or causing more damage, for example by isolating infected machines.
Where you use it
Part of the usual incident response sequence: detection, containment, eradication, recovery. Typical containment actions are isolating hosts, disabling accounts, resetting credentials and blocking IP addresses. The verb is 'contain': 'we contained the incident'.
Examples
Containment came first: we isolated the three infected laptops before starting the investigation.
Short-term containment bought us time to rebuild the server safely.
Common phrases
containment measures · short-term containment · contain an incident · containment strategy
More about this term →remediation
noun
Meaning
The work of fixing a security problem at its source, such as applying a patch, changing a configuration or rewriting vulnerable code.
Where you use it
Used in vulnerability management, audits and pentest reports, which give each finding a remediation recommendation and a deadline. The verb is 'remediate'. Remediation removes the problem, while mitigation only reduces its risk.
Examples
Critical findings have a remediation deadline of 14 days.
Remediation is complete: the library was upgraded and the retest passed.
Common phrases
remediation plan · remediation deadline · track remediation · remediate a finding
More about this term →mitigate
verb
Meaning
To reduce the likelihood or impact of a risk or attack when it cannot be removed completely, for example with a workaround or an extra control.
Where you use it
Used constantly in advisories and risk registers: a vendor 'provides mitigations' until a patch is ready, and a team 'mitigates the risk'. The noun is mitigation; 'DDoS mitigation' means filtering out attack traffic.
Examples
Until the patch is out, we can mitigate the issue by disabling the vulnerable feature.
MFA mitigates the risk of stolen passwords but does not remove it.
Usage note
Do not confuse it with the similar-sounding 'militate' (militate against = make something less likely to happen).
Common phrases
mitigate a risk · mitigating control · risk mitigation · temporary mitigation
More about this term →security policy
noun
Meaning
A formal document, approved by management, that sets the rules an organisation follows to protect its information, systems and people.
Where you use it
There is usually a top-level information security policy plus specific ones on acceptable use, passwords, access control or remote working. Policies are written, approved, reviewed yearly and enforced; breaking one is a 'policy violation'.
Examples
Under our security policy, personal USB drives are not allowed on company laptops.
The auditor asked when the security policy was last reviewed.
Common phrases
information security policy · acceptable use policy · policy violation · enforce a policy · review a policy
More about this term →attack surface
noun
Meaning
All the points where an attacker could try to get into a system or organisation or take data out, such as open ports, web apps, user accounts and suppliers.
Where you use it
Teams talk about reducing or shrinking the attack surface, for example by switching off unused services. 'External attack surface' means everything visible from the internet; tools that track it are called attack surface management (ASM) tools.
Examples
Every new cloud service we add increases our attack surface.
Turning off the old FTP server was an easy way to reduce the attack surface.
Common phrases
reduce the attack surface · external attack surface · attack surface management · expand the attack surface
More about this term →brute-force attack
noun
Meaning
An attack that tries a huge number of passwords or keys one after another, usually automatically, until the right one is found.
Where you use it
Usually seen in logs as many failed logins from one source. Related forms are password spraying (one common password tried against many accounts) and credential stuffing (reusing leaked username and password pairs). Account lockout and MFA are typical defences.
Examples
The SIEM flagged a brute-force attack against the VPN login page.
Account lockout stopped the brute-force attack after five failed attempts.
Common phrases
brute-force login attempts · password spraying · credential stuffing · account lockout
More about this term →credentials
noun
Meaning
The details that prove who a user is and let them log in, most often a username and password, but also keys, tokens and certificates.
Where you use it
Usually plural. People speak of stolen, leaked, compromised or hard-coded credentials and of credential theft. After an incident, teams reset or rotate credentials. Many breaches start with valid credentials rather than with an exploit.
Examples
The attacker logged in with valid credentials taken from a phishing page.
We found database credentials hard-coded in the source code.
Usage note
In everyday English 'credentials' also means qualifications, as in 'her academic credentials'. In security it almost always means login details.
Common phrases
stolen credentials · hard-coded credentials · reset credentials · credential theft · valid credentials
More about this term →single sign-on
noun
Meaning
A login system that lets a user sign in once with one set of credentials and then use many different applications without logging in again.
Where you use it
Called SSO, letter by letter. Companies connect apps to an identity provider (IdP) such as Microsoft Entra ID or Okta using protocols like SAML or OpenID Connect. SSO is convenient and centralises control, but it makes the IdP account very valuable to attackers.
Examples
The new HR app supports single sign-on, so staff can use their normal company login.
Every SaaS tool must be connected to single sign-on before it goes live.
Common phrases
SSO login · identity provider · SAML SSO · enable single sign-on
More about this term →role-based access control
noun
Meaning
A way of managing permissions in which rights are given to roles, such as 'accountant' or 'admin', and users get access by being assigned to a role.
Where you use it
Called RBAC, pronounced 'ar-back'. It makes access reviews easier because auditors check roles instead of individual permissions. A frequent problem is 'role creep', when users collect roles over time and keep access they no longer need.
Examples
With role-based access control, new nurses get the right permissions on day one.
We are redesigning the role-based access control model for the cloud accounts.
Common phrases
RBAC model · assign a role · role creep · role-based permissions
More about this term →public-key cryptography
noun
Meaning
A type of cryptography that uses a pair of related keys: a public key that can be shared with anyone and a private key that its owner keeps secret.
Where you use it
Also called asymmetric cryptography, in contrast to symmetric encryption, where one shared key does both jobs. It underpins TLS, digital signatures, SSH keys and certificates. RSA and elliptic-curve cryptography (ECC) are common algorithms.
Examples
Public-key cryptography lets the browser and the server agree on a secret without meeting first.
The team is planning how its public-key cryptography will move to post-quantum algorithms.
Common phrases
public key · private key · key pair · asymmetric encryption · public key infrastructure
More about this term →end-to-end encryption
noun
Meaning
Encryption in which only the sender and the intended recipient can read the messages, so even the service provider in the middle cannot see their content.
Where you use it
Often shortened to E2EE. Used mostly for messaging apps, video calls and some file-sharing services. Compare it with encryption in transit, where the provider can still read the data on its own servers.
Examples
Because the chat app uses end-to-end encryption, the provider cannot hand over message content.
The client asked whether our file transfer service offers end-to-end encryption.
Common phrases
end-to-end encrypted · E2EE messaging · end-to-end encryption by default
More about this term →network segmentation
noun
Meaning
Dividing a network into separate zones, with controlled traffic between them, so that a problem in one part cannot easily spread to the others.
Where you use it
Done with VLANs, firewalls and access lists. Payment systems, industrial control networks and guest Wi-Fi are typically separated from the corporate network. A finer, per-workload version is called microsegmentation; the opposite is a 'flat network'.
Examples
Good network segmentation stopped the ransomware from reaching the factory floor.
Network segmentation around the card systems keeps our PCI DSS scope small.
Common phrases
segment the network · microsegmentation · flat network · network zone
More about this term →zero trust
noun
Meaning
A security model that trusts no user or device by default, even inside the company network, and checks identity and context for every request.
Where you use it
Summed up as 'never trust, always verify'. It describes a strategy, not a single product: 'zero trust architecture', 'moving to zero trust'. It replaces the older idea of a trusted internal network behind a strong perimeter.
Examples
As part of our zero trust project, the VPN will be replaced by identity-aware access.
Zero trust does not mean we distrust employees; it means every access is checked.
Common phrases
zero trust architecture · zero trust model · zero trust network access · never trust, always verify
More about this term →EDR
abbreviation
Meaning
Endpoint detection and response: security software on laptops and servers that records activity, detects suspicious behaviour and lets analysts investigate and respond remotely.
Where you use it
Said letter by letter. EDR goes beyond classic antivirus: from one console, analysts can see process trees, isolate a host from the network or stop a process. XDR extends the same idea to email, cloud and identity data.
Examples
We used the EDR console to isolate the laptop within two minutes.
The EDR flagged an unsigned script that tried to disable the security tools.
Common phrases
EDR agent · EDR console · EDR alert · isolate a host · XDR
More about this term →threat intelligence
noun
Meaning
Collected and analysed information about attackers, their methods and their tools that helps an organisation prepare for and detect attacks.
Where you use it
Often shortened to 'threat intel' or CTI (cyber threat intelligence). Teams consume threat intel feeds, share information through sector groups such as ISACs and use it to write detections. It ranges from technical IOCs to strategic reports for management.
Examples
Threat intelligence shows that this group targets logistics companies in Europe.
We added the new IP addresses from the threat intelligence feed to the blocklist.
Common phrases
threat intelligence feed · threat intel report · cyber threat intelligence · share threat intelligence
More about this term →indicator of compromise
noun
Meaning
A piece of technical evidence that suggests a system may have been attacked, such as a malicious IP address, file hash or domain name.
Where you use it
Almost always called an IOC or IoC, said letter by letter. Analysts collect, share and search for IOCs in logs and EDR data. Because attackers can change them easily, IOCs are usually combined with detections based on behaviour.
Examples
We searched all mailboxes for the indicators of compromise listed in the advisory.
No indicator of compromise was found on the remaining servers.
Common phrases
IOC list · share IOCs · search for IOCs · indicators of attack
More about this term →digital forensics
noun
Meaning
The collection and analysis of digital evidence, such as disk images, memory and logs, to find out what happened during an incident in a way that can stand up in court.
Where you use it
Often combined with incident response as DFIR. Key ideas are chain of custody, forensic images and preserving evidence before systems are wiped. Investigators take a forensic image and verify it with a hash.
Examples
Don't reboot the server yet; the digital forensics team needs a memory capture first.
The digital forensics report confirmed that the attacker was inside for nine days.
Common phrases
forensic image · chain of custody · DFIR · forensic analysis · preserve evidence
More about this term →playbook
noun
Meaning
A written, step-by-step guide that tells a security team how to handle a specific type of alert or incident, such as phishing or ransomware.
Where you use it
SOC and incident response teams write, follow and update playbooks. When the steps are automated in a SOAR tool, people may also call them runbooks or workflows. Playbooks are tested in tabletop exercises.
Examples
Follow the phishing playbook: check the headers, block the sender, then search the other mailboxes.
After the incident, we updated the ransomware playbook with the new contact list.
Common phrases
incident response playbook · follow the playbook · automated playbook · runbook
More about this term →escalate
verb
Meaning
To pass an alert, incident or problem to a more senior person or team because it is serious or beyond your own authority or skills.
Where you use it
A daily word in SOC work: Tier 1 escalates to Tier 2, and major incidents are escalated to management or the CISO. The noun is escalation, as in 'escalation path' or 'escalation matrix'. Do not confuse it with privilege escalation, which is an attack technique.
Examples
If the host is a domain controller, escalate the alert to Tier 2 immediately.
The incident was escalated to the CISO because customer data was involved.
Common phrases
escalate an alert · escalate to management · escalation path · escalation matrix
More about this term →patch management
noun
Meaning
The ongoing process of finding, testing, approving and installing software updates across all systems, and tracking which ones are still missing.
Where you use it
Usually owned by IT operations but measured by security through patch compliance rates, patch SLAs (for example 'critical patches within 14 days') and exceptions for systems that cannot be patched. Tools such as Microsoft Intune or WSUS support the process.
Examples
Our patch management process requires critical patches to be installed within 14 days.
The audit found weak patch management on the factory systems.
Common phrases
patch management process · patch compliance · patch cycle · patch SLA
More about this term →CVSS
abbreviation
Meaning
Common Vulnerability Scoring System: a standard method for rating how severe a vulnerability is, with a score from 0.0 to 10.0.
Where you use it
Scores map to ratings: low (0.1–3.9), medium (4.0–6.9), high (7.0–8.9) and critical (9.0–10.0). People say 'a CVSS score of 9.8'. It is maintained by FIRST; version 4.0 was published in 2023, but many sources still show 3.1 scores.
Examples
The flaw has a CVSS score of 9.8, so it goes to the top of the list.
Our policy uses CVSS ratings to set patch deadlines.
Common phrases
CVSS score · CVSS base score · CVSS vector · CVSS v4
More about this term →misconfiguration
noun
Meaning
A security weakness caused by settings that are wrong, insecure or left at their defaults, rather than by a bug in the software itself.
Where you use it
Very common in cloud security: a storage bucket left public, an admin panel open to the internet, default passwords never changed. Teams find misconfigurations with configuration scans and cloud security posture management (CSPM) tools.
Examples
The leak was caused by a misconfiguration: the storage bucket was publicly readable.
Most of the cloud findings are misconfigurations, not software vulnerabilities.
Common phrases
security misconfiguration · cloud misconfiguration · default configuration · fix a misconfiguration
More about this term →audit
noun
Meaning
A formal, independent review that checks whether an organisation's security controls and processes meet a standard, a law or its own policies.
Where you use it
Also a verb: auditors audit a company. Audits can be internal or external and end with audit findings and requests for evidence. An 'audit log' or 'audit trail' is a record of who did what and when.
Examples
The ISO 27001 audit is next month, so please upload your evidence by Friday.
The external audit found no major issues with access control.
Common phrases
internal audit · external audit · audit finding · audit trail · pass an audit
More about this term →risk assessment
noun
Meaning
A structured process for identifying risks, estimating how likely and how serious they are, and deciding which ones need action first.
Where you use it
Required by most standards and regulations. Teams carry out or perform risk assessments for new projects, suppliers and systems, often with a likelihood × impact matrix, and record the results in a risk register.
Examples
We need a risk assessment before the new supplier gets access to customer data.
The risk assessment rated the legacy system as high risk.
Common phrases
carry out a risk assessment · third-party risk assessment · risk matrix · risk register
More about this term →rules of engagement
phrase
Meaning
The agreed conditions of a security test: what may be tested, when, with which methods and whom to contact if something goes wrong.
Where you use it
Signed before any penetration test or red team exercise starts, usually together with the scope document. Testers refer to it constantly: 'Is that within the rules of engagement?' Often shortened to RoE.
Examples
Denial-of-service testing is not allowed under the rules of engagement.
The rules of engagement say testing can only happen between 10 p.m. and 6 a.m.
Common phrases
agree the rules of engagement · within the rules of engagement · scope document · out of scope
More about this term →finding
noun
Meaning
A security problem or weakness that is identified and documented during an audit, assessment or penetration test, usually with a severity rating.
Where you use it
Normally used in the plural in reports: 'key findings', 'high-severity findings'. Each finding has a description, evidence, a risk rating and a remediation recommendation. Teams close or accept findings, and testers retest them.
Examples
The report has 14 findings: two high, five medium and seven low.
This finding is a false positive, because the service is not reachable from outside.
Common phrases
key findings · high-severity finding · close a finding · audit finding · retest a finding
More about this term →reconnaissance
noun
Meaning
The first stage of an attack or security test, in which information about the target is gathered, such as domain names, staff, technologies and exposed services.
Where you use it
Usually shortened to 'recon'. Passive reconnaissance uses public sources (OSINT) without touching the target, while active reconnaissance interacts with it. Pentest reports often begin with a recon section.
Examples
During reconnaissance, the testers found an old staging site on a forgotten subdomain.
Our threat model assumes that attackers start with reconnaissance on social media.
Common phrases
passive reconnaissance · active reconnaissance · OSINT · recon phase
More about this term →privilege escalation
noun
Meaning
Gaining higher access rights than one was given, for example moving from a normal user account to administrator, usually by abusing a flaw or misconfiguration.
Where you use it
Common in pentest reports and incident timelines. 'Vertical' escalation means gaining higher rights; 'horizontal' escalation means reaching another user's rights at the same level. Often shortened to 'privesc'. Least privilege and regular patching limit the risk.
Examples
The vulnerability allows local privilege escalation on unpatched Windows hosts.
The timeline shows privilege escalation about an hour after the first login.
Common phrases
local privilege escalation · vertical privilege escalation · horizontal privilege escalation · escalate privileges
More about this term →lateral movement
noun
Meaning
The way attackers move from the first compromised machine to other systems inside the same network, looking for valuable data or higher privileges.
Where you use it
A key phase in incident analysis and in frameworks such as MITRE ATT&CK. Defenders try to detect and limit lateral movement with segmentation, EDR and monitoring of admin logins. Reports say that attackers 'moved laterally'.
Examples
We saw lateral movement from the HR laptop to two file servers.
Segmentation made lateral movement much harder for the attackers.
Common phrases
detect lateral movement · move laterally · limit lateral movement · MITRE ATT&CK
More about this term →man-in-the-middle attack
noun
Meaning
An attack in which someone secretly places themselves between two communicating parties so that they can read or change the traffic passing between them.
Where you use it
Often shortened to MITM. Typical settings are public Wi-Fi and unencrypted connections; TLS with proper certificate checks is the main protection. Many organisations now prefer the neutral terms 'on-path attack' or 'adversary-in-the-middle' (AitM).
Examples
Without certificate validation, the mobile app was open to a man-in-the-middle attack.
HSTS helps protect users from man-in-the-middle attacks on the login page.
Common phrases
MITM attack · on-path attack · adversary-in-the-middle · intercept traffic
More about this term →keylogger
noun
Meaning
Software or a small hardware device that secretly records every key a user presses, often to capture passwords and private messages.
Where you use it
Often part of a trojan or spyware rather than a separate program. Hardware keyloggers are small plugs between a keyboard and a computer, so physical checks matter in shared offices. The activity is called keylogging or keystroke logging.
Examples
The trojan included a keylogger that captured the user's banking password.
During the office check we found a hardware keylogger on a reception PC.
Common phrases
hardware keylogger · software keylogger · keystroke logging · detect a keylogger
More about this term →botnet
noun
Meaning
A network of many infected computers or devices, called bots, that an attacker controls remotely and uses together, for example to send spam or run DDoS attacks.
Where you use it
The bots receive orders from a command-and-control (C2) server. Many modern botnets are made of insecure IoT devices such as cameras and routers. Security news often reports botnet takedowns by police and companies.
Examples
The DDoS traffic came from a botnet of hacked security cameras.
Two of our servers were talking to a known botnet C2 address.
Common phrases
botnet takedown · IoT botnet · command-and-control server · botnet traffic
More about this term →backdoor
noun
Meaning
A hidden way into a system that bypasses normal authentication, either left by developers or installed by attackers so they can return later.
Where you use it
Used as a noun ('a backdoor') and sometimes as a verb ('backdoored software'). Incident reports say attackers 'planted' a backdoor for persistence; supply-chain attacks may hide one inside a trusted update. Policy debates about 'encryption backdoors' also use the word.
Examples
The attackers left a backdoor on the web server so that they could return later.
We rebuilt the server from scratch because we could not rule out a backdoor.
Common phrases
plant a backdoor · remove a backdoor · backdoored update · persistent access
More about this term →sandbox
noun
Meaning
An isolated, controlled environment where suspicious files or programs can be run safely to see what they do, without any risk to real systems.
Where you use it
Email gateways and malware analysts 'detonate' attachments in a sandbox and read the sandbox report. The word is also used for browser and app sandboxes that limit what code can do. Some malware checks whether it is in a sandbox and hides its behaviour.
Examples
We ran the attachment in a sandbox, and it tried to contact three unknown domains.
The email gateway holds attachments until the sandbox analysis is finished.
Common phrases
sandbox analysis · detonate in a sandbox · sandbox report · sandbox evasion
More about this term →