SecurityX key terms

The amount of risk an organization is willing to accept while pursuing its objectives, expressed as a statement or set of thresholds. It guides whether each risk is treated, transferred, avoided, or retained.

The acceptable variation around the risk appetite - concrete limits a team or system may operate within before action is required. Tolerance turns a broad appetite statement into measurable thresholds that can be monitored.

The level of risk that exists before any controls or safeguards are applied. It gives a baseline for judging how much a given control actually reduces exposure.

The risk that remains after controls, mitigations, or transfers have been applied. Comparing it against the risk appetite shows whether more treatment or a formal acceptance decision is needed.

A structured study that identifies critical business processes and estimates how disruption affects them over time, producing recovery priorities and the objectives used for continuity and disaster recovery planning.

The longest acceptable time to restore a process or system after a disruption. It drives architecture choices such as redundancy, replication, and warm or hot standby capacity.

The greatest amount of data loss, measured in time, that a process can tolerate before the loss becomes unacceptable. It sets backup frequency and replication strategy.

A living record of identified risks with owners, likelihood and impact ratings, planned treatments, and current status. Leadership and auditors use it to track risk decisions over time.

The continuing process of assessing, contracting with, monitoring, and offboarding vendors and partners whose access or services could affect security posture, including due diligence, contractual security clauses, and periodic reassessment.

The principle that data is subject to the laws of the jurisdiction where it is stored or processed, which constrains cloud region choice, replication, and who may lawfully access it.

A review completed before a new system or data flow goes live that records what personal data is collected, why, where it travels, and how privacy risks will be reduced.

An access model that grants no implicit trust based on network location; each request is authenticated and authorized against policy using identity, device health, and context before the resource is reached.

Splitting a network into small zones with granular allow rules at the workload level, so a compromised host cannot move laterally. Enforcement is usually host-based or software-defined rather than relying on VLANs.

Layering independent controls across people, process, and technology so a single failure or bypass does not lead to compromise. Layers are selected to complement each other's coverage instead of duplicating it.

Every point where an attacker could interact with or influence a system: exposed services, APIs, identities, supply chain components, and users. Shrinking it reduces the paths an adversary can attempt.

A line around components that share the same level of trust or privilege. Data crossing it must be validated and authenticated, which is why threat models place entry points on these boundaries.

The component that evaluates an access request against policy and returns allow or deny. It works with a policy enforcement point, which actually permits or blocks the traffic.

A cloud-delivered architecture that combines network connectivity with security services such as secure web gateway, cloud access security broker, and zero trust network access, so policy follows users and devices.

A hardware-isolated processing area that keeps code and data confidential and tamper-resistant from the rest of the system, used for key storage, attestation, and confidential computing.

A structured exercise that examines components, data flows, and trust boundaries to list plausible threats and agree on mitigations before code ships; frameworks such as STRIDE help organize the analysis.

Building security activities - requirements, design review, secure coding standards, testing, and deployment checks - into every development phase so security is continuous rather than a final gate.

Automated analysis of declarative templates and manifests for misconfigurations, exposed secrets, and policy violations before or during deployment, catching cloud and container mistakes earlier than runtime tooling.

Keeping credentials, API keys, and certificates in a controlled vault with access policy, rotation, and audit logging, so they never live in source code, configuration files, or images.

A machine-readable inventory of the components and dependencies inside a software product, used to find exposure quickly when a library vulnerability is published and to support supply chain due diligence.

A hardened appliance or service that generates and stores cryptographic keys and performs operations inside a tamper-resistant boundary, keeping key material away from general-purpose systems.

Encrypting data with a data key, then encrypting that data key with a longer-lived master key held in a key management service or hardware module, which limits exposure and simplifies rotation.

A cryptographic value made with a private key that anyone holding the matching public key can verify, proving both message integrity and signer identity and supporting non-repudiation.

Restricting an application to accept only a specific certificate or public key for a host, which blocks interception with a fraudulently issued certificate but complicates planned rotation.

A platform that centralizes logs and events from many sources, correlates them with rules and analytics, and raises alerts, forming the detection layer most security operations centers are built around.

Tooling that automates and orchestrates response playbooks - enriching alerts, opening tickets, isolating hosts - to cut manual effort and make incident handling consistent and repeatable.

A detection and response product that fuses telemetry from endpoints, identity, email, and cloud workloads into correlated detections and guided response, aiming to cut alert volume and analyst pivoting.

A proactive, hypothesis-driven search through telemetry for adversary activity that existing detections missed, often guided by threat intelligence and framework techniques, with findings fed back into monitoring.

An artifact such as a file hash, domain, IP address, or registry key seen in or linked to an intrusion. Indicators are easy to share but age quickly and are easily changed by attackers.

A curated knowledge base of real-world adversary tactics and techniques organized by goal, used to map detection coverage, prioritize gaps, and structure threat hunting and adversary emulation.

The documented, unbroken record of who handled evidence, when, and where, from collection through presentation, which is required for the evidence to be credible in legal or disciplinary proceedings.

The priority for collecting evidence from most to least perishable - processor registers and memory before disk, disk before backups - so time-sensitive data is captured before it disappears.

A standardized scoring system that rates vulnerability severity from technical characteristics, producing a base score that teams combine with asset criticality and exploit availability when prioritizing remediation.

Decoys such as honeypots, fake file shares, and honeytokens that have no legitimate business use; any interaction with them is high-fidelity evidence of unauthorized activity and produces low-noise alerts.