Security glossary

Automated Moving Target DefenceTechnology that keeps changing the attack surface so attackers cannot rely on what they learned during reconnaissance.

Attack Surface ManagementContinuous discovery and monitoring of every asset an attacker could target.

Breach and Attack SimulationAutomated, safe execution of attack techniques to test whether controls detect and block them.

Cloud Detection and ResponseDetection of threats in cloud control planes and workloads, with containment actions.

Cloud Infrastructure Entitlement ManagementDiscovery and reduction of excessive permissions held by cloud identities.

Cloud-Native Application Protection PlatformA combined approach to cloud posture, workload and code security.

Cloud Security Posture ManagementContinuous checks of cloud accounts for misconfigurations and policy violations.

Continuous Threat Exposure ManagementA five-stage programme to scope, discover, prioritise, validate and mobilise fixes for exposures.

Cloud Workload Protection PlatformSecurity for virtual machines, containers and serverless functions at runtime.

Database Activity MonitoringIndependent monitoring of queries and privileged activity on databases.

Deception technologyDecoys and honeytokens that only an attacker would touch, giving high-confidence alerts.

External Attack Surface ManagementASM focused on internet-facing assets and exposures.

Endpoint Detection and ResponseRecording and analysis of endpoint activity to detect and respond to threats.

Governance, Risk and ComplianceThe policies, risk processes and evidence an organisation uses to meet its obligations.

Large Language Model gatewayA control point that inspects and governs traffic between users, applications and AI models.

Managed Detection and ResponseA service in which an external team monitors, investigates and responds on your behalf.

Adversary tactics and techniquesA public knowledge base of attacker behaviour used to map and measure detection coverage.

Network Access ControlChecks the identity and posture of devices before allowing them on the network.

Network Detection and ResponseBehavioural analysis of network traffic to find threats that other tools miss.

Open Cybersecurity Schema FrameworkAn open, vendor-neutral schema for security events, so data from any tool looks the same.

Operational TechnologyHardware and software that monitors and controls industrial processes.

Penetration Testing as a ServicePen testing delivered through a platform, with ongoing findings management and retests.

Risk-Based Vulnerability ManagementPrioritising vulnerabilities by exploitability and business impact rather than raw severity.

Software Bill of MaterialsAn inventory of the components and dependencies inside a piece of software.

Security Information and Event ManagementCentral collection, search and correlation of security logs.

Security Orchestration, Automation and ResponsePlaybooks that automate investigation and response steps across tools.

Security Operations CenterThe team, processes and technology that monitor and defend an organisation.

User and Entity Behaviour AnalyticsBaselines of normal behaviour for users and devices, used to spot anomalies.

Extended Detection and ResponseDetection and response across endpoint, network, cloud and identity in one system.