Cybersecurity & Vulnerability Glossary

Demystifying critical security concepts, vulnerability scoring metrics, and defensive architectures for SOC analysts, security engineers, and engineering managers.

Showing 20 security terms

Threat Intelligence

CISA Known Exploited Vulnerabilities (KEV)

An authoritative catalog maintained by the U.S. CISA listing CVEs that have confirmed active exploitation in the wild.

The CISA KEV catalog is the gold standard for prioritizing vulnerability remediation. Under Binding Operational Directive (BOD) 22-01, federal agencies and leading enterprises must patch KEV vulnerabilities within strict 14-day deadlines to prevent imminent ransomware and cyber espionage intrusions.

Related SecOps Tool:Explore CISA KEV Catalog →

Vulnerability Management

Common Vulnerability Scoring System (CVSS)

An open industry standard for assessing the severity of computer system security vulnerabilities on a scale from 0.0 to 10.0.

CVSS calculates a numerical score based on metrics including Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), Scope (S), and Impact on Confidentiality, Integrity, and Availability. Scores from 9.0 to 10.0 denote Critical severity.

Related SecOps Tool:Interactive CVSS 3.1 Calculator →

Threat Intelligence

Exploit Prediction Scoring System (EPSS)

A data-driven scoring system estimating the probability (0% to 100%) that a software vulnerability will be exploited in the wild within the next 30 days.

Unlike CVSS which measures technical severity if exploited, EPSS predicts the real-world likelihood of exploitation using machine learning models trained on active threat intelligence, honeypot telemetry, and weaponization feeds.

Related SecOps Tool:CVSS & EPSS Calculator →

Threat Intelligence

Zero-Day Vulnerability

A software security flaw that is unknown to the vendor or has no official patch available, leaving defenses vulnerable to immediate exploit.

Because developers have had 'zero days' to fix the flaw, zero-day vulnerabilities command high black-market bounties and are frequently weaponized by state-sponsored Advanced Persistent Threats (APTs) and initial access brokers.

Related SecOps Tool:Zero-Day Incident Playbook →

Vulnerability Management

Remote Code Execution (RCE)

A critical vulnerability class allowing an attacker to execute arbitrary commands or code over a network on a remote server or workstation.

RCE typically occurs due to insecure deserialization, memory corruption, command injection, or path traversal. It frequently receives a CVSS 9.8-10.0 rating and enables attackers to achieve initial enterprise foothold.

Related SecOps Tool:Zero-Day RCE Playbook →

Defensive Architecture

Endpoint Detection and Response (EDR)

An endpoint security solution that continuously monitors end-user devices to detect, investigate, and isolate cyber threats.

EDR agents collect process trees, registry modifications, network sockets, and file hashes to identify suspicious behavioral anomalies, stopping ransomware encryption in real time and enabling rapid quarantine.

Related SecOps Tool:EDR Policy Template →

Defensive Architecture

Extended Detection and Response (XDR)

A SaaS-based security platform that consolidates and correlates data across endpoints, cloud workloads, email, and network telemetry.

XDR evolves beyond standalone EDR by providing unified detection and automated cross-domain incident response, breaking down telemetry silos to accelerate mean time to detect (MTTD) and mean time to respond (MTTR).

Related SecOps Tool:Compare EDR & XDR Vendors →

Defensive Architecture

Zero Trust Network Access (ZTNA)

A security model operating on the principle of 'never trust, always verify', granting least-privilege application access based on identity and context.

ZTNA replaces traditional perimeter VPNs by establishing micro-segmented, encrypted application-level tunnels. Users are never placed directly onto the corporate network, neutralizing lateral movement.

Related SecOps Tool:Zero Trust Remote Access Policy →

Threat Intelligence

Ransomware

Malicious software that encrypts victim files and systems, demanding extortion payments in exchange for decryption keys and non-disclosure.

Modern double-extortion ransomware gangs exfiltrate sensitive intellectual property and customer databases before detonating encryptors, threatening public leaks if the ransom is not paid.

Related SecOps Tool:Ransomware Containment Playbook →

Threat Intelligence

Software Supply Chain Attack

A cyberattack that infiltrates a trusted upstream software vendor or open-source dependency to compromise downstream customers.

Notable examples include SolarWinds and the XZ Utils backdoor. Attackers tamper with CI/CD build pipelines, package repositories (npm, PyPI), or vendor code-signing keys to distribute weaponized updates silently.

Related SecOps Tool:Supply Chain Backdoor Playbook →

Compliance & Governance

Software Bill of Materials (SBOM)

A formal, machine-readable inventory of software components, third-party libraries, and dependencies used in building an application.

Standardized via SPDX or CycloneDX formats, SBOMs allow engineering and security teams to rapidly identify whether newly disclosed zero-days (such as Log4j) exist in their deployed software artifacts.

Related SecOps Tool:Stack Exposure Scanner →

Threat Intelligence

MITRE ATT&CK Framework

A globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations.

ATT&CK structures cyber defense around 14 tactics spanning Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command & Control, Exfiltration, and Impact.

Related SecOps Tool:Incident Response Playbooks →

Threat Intelligence

Indicator of Compromise (IoC)

Forensic evidence of a security breach or malware infection found on a host or network, such as malicious IP addresses, domains, or SHA256 hashes.

Security teams ingest IoCs into SIEMs and firewalls for automated blocking and threat hunting, though IoCs are more easily changed by adversaries than underlying Tactics, Techniques, and Procedures (TTPs).

Related SecOps Tool:Explore Weaponized CVEs →

Defensive Architecture

Security Information and Event Management (SIEM)

A security solution that aggregates, normalizes, and analyzes log and event data from across an enterprise to detect active intrusions.

SIEM systems correlate telemetry from firewalls, servers, cloud infrastructure, and auth providers, firing real-time alerts when threshold-based or behavioral anomalies indicate compromise.

Related SecOps Tool:Configure SOC Webhook Alerts →

Defensive Architecture

Security Orchestration, Automation, and Response (SOAR)

Software enabling SecOps teams to automate repetitive incident response tasks and orchestrate multi-tool investigative workflows.

SOAR platforms execute predefined playbooks (such as isolating an infected host, querying VirusTotal, and revoking compromised OAuth tokens) in seconds without manual intervention.

Related SecOps Tool:Automated Response Playbooks →

Vulnerability Management

Virtual Patching

A security policy or WAF rule that blocks exploit payloads targeting a known vulnerability without altering the underlying application code.

Virtual patching acts as an emergency stopgap during zero-day crises, shielding legacy or mission-critical systems until development teams can test and deploy permanent vendor patches.

Related SecOps Tool:Calculate Patching SLAs →

Cloud Security

Cloud Security Posture Management (CSPM)

An automated security tool that continuously audits cloud environments (AWS, Azure, GCP) against misconfigurations and compliance benchmarks.

CSPM identifies risky conditions such as publicly accessible S3 buckets, unencrypted databases, overly permissive IAM roles, and non-compliant Kubernetes clusters before attackers exploit them.

Related SecOps Tool:Compare Cloud Defense Tools →

Vulnerability Management

Server-Side Request Forgery (SSRF)

A web security flaw that induces the backend server to make unauthorized HTTP requests to arbitrary internal or external domains.

Attackers exploit SSRF to access internal microservices, loopback interfaces (127.0.0.1), and cloud metadata endpoints (e.g. 169.254.169.254) to steal IAM credentials and private tokens.

Related SecOps Tool:Stack Exposure Scanner →

Threat Intelligence

Credential Stuffing

An automated attack where stolen username and password pairs from previous data breaches are tested against other online services.

Because users frequently reuse passwords across personal and corporate accounts, credential stuffing bots can compromise corporate SaaS platforms with high success rates unless MFA is enforced.

Related SecOps Tool:Credential Compromise Playbook →

Compliance & Governance

Principle of Least Privilege (PoLP)

The foundational security practice of granting users, processes, and service accounts only the minimum access necessary to perform their roles.

PoLP curtails blast radius; if a compromised service account only has read-only access to a specific database table, the adversary cannot drop tables or pivot to cloud administrative roles.

Related SecOps Tool:Security Policy Generator →

Expand Your Threat Intelligence Knowledge

Join hundreds of security practitioners getting weekly vulnerability breakdowns, incident response playbooks, and mitigation advice.

Weekly Executive Briefing

Top critical & high-severity threats, every week.

No spam. Unsubscribe anytime. SecOpsPulse may include sponsored security tool recommendations.