Cybersecurity Glossary

Access Control – Restricting who/what can use resources.
Adware – Software that displays unwanted ads.
Advanced Persistent Threat (APT) – Long-term targeted cyber intrusion by skilled attackers.
AINAPP (AI-Native Application Protection Platform) – A unified protection for code, cloud and ai-native apps across build, deploy and runtime.
AI-SPM (AI Security) – Secures AI and ML workloads by monitoring configurations, data access, model exposure, and risks associated with AI pipelines and services.
Antivirus – Software that detects and removes malware.
API Security – Protection of application programming interfaces from abuse.
APT Group – Organized threat group often tied to a nation-state.
ASM (Attack Surface Management) – Continuously discovers and monitors external-facing assets to identify unknown, exposed, or misconfigured attack paths.
Attack Surface – All possible entry points for an attacker.
Authentication – Verifying a user’s identity.
Authorization – Determining what an authenticated user can do.
Backdoor – Hidden way to bypass security controls.
Baiting – Social engineering attack offering something enticing (e.g., USB drop).
Bot – Automated program that executes commands.
Botnet – Network of compromised computers controlled by attackers.
Brute Force Attack – Trying many password combinations to guess it.
Buffer Overflow – Overwriting memory due to improper bounds checking.
CBPM (Cloud Backup Posture Management) – The practice and tooling that continuously assesses, monitors, and enforces the security, availability, and compliance of cloud backup configurations and data across cloud environments.
CDR (Cloud Detection & Response) – Detects and responds to active threats in cloud environments by correlating logs, signals, and behaviors across infrastructure, identities, and workloads.
Certificate – Digital document proving identity in secure communications.
CIA Triad – Model: Confidentiality, Integrity, Availability.
CIEM (Cloud Infrastructure Entitlement Management) – Provides visibility and control over cloud permissions by identifying excessive, unused, or risky identities and enforcing least-privilege access across cloud platforms (AWS, GCP, Azure). IAM grants and enforces access; CIEM optimizes and reduces access risk in complex cloud environments.
CIS (Center for Internet Security) – The CIS Critical Security Controls (CIS Controls) are a prescriptive, prioritized, and simplified set of best practices that you can use to strengthen your cybersecurity posture.
Clickjacking – Trick users into clicking malicious hidden elements.
Cloud Compliance – Continuously maps cloud resources to regulatory frameworks and internal policies, enabling real-time compliance visibility and audit readiness.
Cloud Security – Practices and tools that protect workloads, infrastructure, and data stored or operated in cloud environments.
Cloud Security Graph – A unified, continuously updated graph model that represents all cloud assets, identities, configurations, relationships, and risks—and how they connect to one another.
Cloud Security Issue Landscape – All cloud security issues across infra, config, IAM, workload, app, API, compliance and more.
Cloud Shared Responsibility Model – A cloud security structure where providers secure the underlying infrastructure, and customers safeguard their data, applications, and configurations.
CNAPP (Cloud-Native Application Protection Platform) – a unified security architecture designed to protect cloud-native applications across their entire lifecycle.
Command & Control (C2) – Server used to control infected devices.
Common Vulnerabilities and Exposures (CVE) – A cataloging system that assigns identifiers to known cybersecurity vulnerabilities.
Compliance Framework – A set of principles, domains and controls used for governance, structure and continuous control coverage.
Compliance Regulation – A set for referencing laws or mandatory obligations.
Compliance Standard – A set for formal certification or audit requirements (ISO 27001).
Connector – APIs that link agents with customer systems, enabling agents to gather context, query data, and form conclusions about alerts.
Container & Kubernetes Security – Secures containerized environments by scanning images, monitoring Kubernetes configurations, and detecting runtime threats across the container lifecycle.
CSPM (Cloud Security Posture Management) – Continuously assesses cloud configurations against security best practices and compliance frameworks to detect misconfigurations, drift, and risky settings across cloud environments.
CVE Scanning – Common Vulnerabilities and Exposures Scanning.
CWPP (Cloud Workload Protection Platform) – Protects cloud workloads such as VMs, containers, and serverless functions by detecting vulnerabilities, misconfigurations, and runtime threats.

D–F

Data Breach – Unauthorized access/exposure of data.
Data Exfiltration – Stealing data from a system.
DDoS (Distributed Denial of Service) – Flooding services with traffic to make them unavailable.
Decryption – Converting encrypted data back to readable form.
DSPM (Data Security Posture Management) – Discovers, classifies, and monitors sensitive data across cloud services to reduce data exposure, enforce access controls, and meet regulatory requirements.
Zero-Day – Newly discovered vulnerability with no patch.
Dashboard Cloud Security – A quick, high-level overview of the key cloud security areas; inventory, issues, security graph, policies, compliance, reports and projects
Defense in Depth – Layered security approach.
Digital Forensics – Investigating cyber incidents using evidence from devices.
DMZ (Demilitarized Zone) – Network segment separating internal and external networks.
DNS Spoofing – Redirecting users by manipulating DNS responses.
Drive-by Download – Malware installation without the user’s knowledge.
Encryption – Encoding data to prevent unauthorized access.
Endpoint Security – Securing user devices (laptops, phones).
Endpoint Detection and Response (EDR) – A monitoring system capturing endpoint activity in real time to detect, analyze, and respond to threats.
Enterprise Insights – Context gathered from internal sources—like asset inventories, security policies, or admin-provided details—that enables Niagaros to understand each customer’s specific environment.
Exploit – Code that takes advantage of a vulnerability.
Exposure – Condition where an asset is vulnerable to a threat.
Exposure Management – Correlates vulnerabilities, misconfigurations, identities, and attack paths to prioritize the risks most likely to be exploited.
Extended Detection and Response (XDR) – A unified solution that integrates security telemetry from multiple layers—endpoints, network, cloud—to enhance detection and response.
Firewall – System that blocks unauthorized network access.

G–I

Gateway – Device that connects networks.
Hacker – Individual skilled in computing; can be malicious or ethical.
Hashing – Converting data into a fixed-size string.
Honeypot – Decoy system set to lure and study attackers.
Identity and Access Management (IAM) – A framework ensuring individuals have appropriate access rights to organizational resources.
Incident Response – A structured process for detecting, handling, and recovering from security breaches.
Inventory Landscape – Everything that can and should be inventoried in a modern digital organization.
Identity Theft – Stealing personal information for fraud.
IDS (Intrusion Detection System) – Detects suspicious activity.
IPS (Intrusion Prevention System) – Detects and blocks attacks.
Incident Response – Handling and managing cyber incidents.
Insider Threat – Threat from internal users.
IoT Security – Protecting internet-connected devices.
Infrastructure-as-Code Scanning. Scans Terraform, CloudFormation, and other IaC templates to detect security issues before deployment and prevent misconfigurations from reaching production.

J–L

Keylogger – Malware capturing keystrokes.
Kill Chain – Model describing attack lifecycle.
Least Privilege – Giving users only the access they need.
Log Management – Collecting and analyzing security logs.

M–O

Malware – Malicious software (viruses, worms, ransomware).
Man-in-the-Middle (MITM) – Intercepting communication between two parties.
Managed Detection and Response (MDR) – A service combining automated technology with analysts to detect and respond to threats.
Managed Security Service Provider (MSSP) – An external provider offering outsourced security operations.
Multi-Factor Authentication (MFA) – Security mechanism that requires multiple verification steps to confirm identity.
Network Segmentation – Dividing networks to reduce spread of attacks.
Obfuscation – Making code or data harder to understand.
Open Redirect – Flaw allowing attackers to redirect users to malicious sites.

P–R

Patch – Fix for vulnerabilities in software.
PCI-DSS – Security standard for handling credit card data.
Penetration Testing – Ethical hacking to identify weaknesses.
Phishing – Fraudulent attempt to steal information via deceptive messages.
Policies – Rules and configurations that define how cloud resources should be secured and governed. They act as guardrails for automated security and compliance enforcement.
Privilege Escalation – Gaining higher-level access illegally.
Projects Cloud Security – A logical organizational layer used to group, scope, and manage security data, controls and workflows.
Proxy Server – Intermediary server used to route traffic.
Ransomware – Malware encrypting data and demanding payment.
Red Team – Offensive cybersecurity testers.
Reports Cloud Security – Structured, consumable outputs that summarize security posture, risk, compliance, and operational insights across cloud-native and AI-driven environments.
Risk Assessment – Evaluating risks to systems and data.
Rootkit – Stealthy malware hiding its presence.

S

Sandboxing – Running software in isolation to prevent system damage.
Secured Container Images – Ensures container images are hardened and free from known vulnerabilities by enforcing security policies during build and deployment.
SOAR – Security Orchestration, Automation, and Response
SOC (Security Operations Center) – Centralized security monitoring unit.
Secure Boot – Ensures only trusted software loads at startup.
Sensor: Runtime Security – Lightweight runtime sensors that monitor cloud and workload behavior in real time to detect threats, anomalies, and active attacks.
SIEM – Security Information and Event Management system.
Single Sign-On (SSO) – A login system that lets users access multiple applications with one authentication.
Skimming – Stealing credit card data using special devices.
SMishing – Phishing via SMS messages.
Social Engineering – Manipulating people into revealing information.
Spoofing – Impersonating entities to mislead.
Spyware – Malware that gathers user information covertly.
SQL Injection (SQLi) – Attack injecting malicious SQL queries.
Supply Chain Attack – Attacking through third-party vendors.
SCA & SBOM (Supply Chain Security) – Identifies vulnerabilities and license risks in open-source dependencies and provides full software bill of materials (SBOM) visibility across applications.
Surveillanceware – Malware used to monitor users.
Symmetric Encryption – Encryption using a single key.

T–V

Threat Hunting – A proactive search for hidden threats using analytics, intelligence, and investigation techniques.
Threat Intelligence – Information about existing/emerging cybersecurity threats.
Threat Actor – Individual or group conducting cyber attacks.
Tokenization – Replacing sensitive data with tokens.
Trojan Horse – Malware disguised as legitimate software.
Two-Factor Authentication (2FA) – Authentication using two factors.
UEBA – (User and Entity Behavior Analytics)
URL Filtering – Blocking access to specific websites.
UVM (Unified Vulnerability Management) – Centralizes vulnerability discovery, prioritization, and remediation across cloud, workloads, applications, and dependencies to reduce exploitable risk faster.
Vishing – Phishing via voice calls.
Virtual Private Network (VPN) – Encrypted connection over the internet.
Virus – Malware that replicates by attaching to files.
Vulnerability – Weakness that can be exploited.
Vulnerability Scanning – The automated process of locating weak points in systems or networks.

W–Z

Watering Hole Attack – Infecting sites likely to be visited by targets.
Worm – Self-replicating standalone malware.
Whaling – Phishing targeting high-profile individuals.
WPA3 – Latest Wi-Fi security protocol.
Zero-Day Exploit – An attack exploiting a vulnerability that is unknown to the vendor.
Zero-Knowledge Proof – Method to verify information without revealing it.
Zero Trust – “Never trust, always verify” security model.
Zero Trust Architecture – A security framework requiring continuous verification; no user or device is trusted by default.
Zombied Device – Device controlled remotely by attackers.
Whitelist – List of permitted applications or senders.
Blacklist – List of blocked applications or senders.
Digital Signature – Cryptographic proof of authenticity and integrity.
DNSSEC – DNS security extensions to prevent tampering.
Heuristic Analysis – Detecting malware based on behavior patterns.

Agentic Security Glossary

A–C

Access Anomaly Agent – Identifies irregularities in how users access systems or resources.
AI Agent – A software-driven entity that independently interprets its environment, analyzes information, and carries out tasks to accomplish defined objectives using technologies such as machine learning and natural language processing.
AINAPP (AI-Native Application Protection Platform) – A unified protection for code, cloud and ai-native apps across build, deploy and runtime.
AI-SPM (AI Security) – Secures AI and ML workloads by monitoring configurations, data access, model exposure, and risks associated with AI pipelines and services.
Agentic Security – A protection model where autonomous AI agents manage alert handling, investigations, and actions with minimal or no human involvement.
Alert Time Correlation Agent – Examines alerts occurring close in time to uncover related or linked events.
Anomaly Behavior Agent – Detects unusual or unexpected patterns in device actions.
Application Security Agent – Evaluates custom-built applications and APIs for weaknesses.
Attack Surface Mapping Agent – Discovers visible assets—services, devices, and domains—that form the organization’s attack surface.
Automated Payload Delivery Agent – Emulates malicious payload drops through methods such as email, removable media, or downloads.
Autonomous Agent – A self-directed software component that makes decisions and executes tasks without human supervision.
Behavioral Drift Agent – Monitors gradual changes in user behavior over extended periods.
Behavioral Signature Learning Agent – Creates new behavioral profiles for assets or users based on observed activities.
Breach Containment Agent – Automatically isolates compromised systems from the network.
BYOD Policy Compliance Agent – Verifies that personal device usage complies with organizational rules.
CDN Behavior Analysis Agent – Tracks and analyzes network traffic patterns originating from Content Delivery Networks.
Cloud Vulnerability Agent – Finds cloud-specific issues like misconfigurations, risky permissions, or improper setup.
Command and Control (C&C) Simulation Agent – Creates artificial C2 infrastructure to test an environment’s detection capabilities.
Configuration Drift Detection Agent – Identifies systems that have diverged from approved or secure baselines.
Container Vulnerability Agent – Assesses Kubernetes and Docker containers for flaws or outdated components.
Credential Sharing Detection Agent – Alerts when account usage patterns indicate potential shared credentials.
Credential Spraying Agent – Simulates password spraying attempts across multiple accounts to test resilience.

D–F

Data Anomaly Agent – Detects irregular or unexpected trends in datasets.
Data Correlation Agent – Links and evaluates related data points from diverse sources.
Database Vulnerability Agent – Detects issues such as outdated database engines or weak authentication protocols.
Device Behavior Agent – Analyzes process activity, network connections, file interactions, registry changes, and login behavior.
Device Connections Agent – Identifies devices recently connected to a specific domain.
Device Firmware Vulnerability Agent – Monitors device firmware versions for known weaknesses.
Dark Web Monitoring Agent – Scans dark web forums for leaked credentials or discussions tied to the organization.
Data Exfiltration Simulation Agent – Imitates data theft through channels like DNS tunneling or covert HTTP transfers.
Device Exposure Agent – Evaluates how exposed a device is to external or internal threats.
Device Usage Activity Agent – Summarizes recent device actions to provide added investigative context.
Data Integrity Verification Agent – Confirms that data remains unchanged during storage and transfer.
Data Retention Compliance Agent – Checks that stored data follows required retention timelines.
DNS Tunneling Detection Agent – Identifies suspicious DNS patterns indicative of tunneling activity.
Domain Reputation Agent – Assesses domain trustworthiness using factors like certificate validity and domain age.
Domain Resolution Agent – Resolves a domain into an IP address for deeper inspection.
Endpoint Exploitation Agent – Simulates endpoint compromises, including malware execution or exploitation of local flaws.
Exploit Availability Monitoring Agent – Monitors whether known exploits have been weaponized and made publicly available.
Exploit Simulation Agent – Runs known exploits in controlled environments to assess exposure.
Exposure Validation Agent – Determines whether identified vulnerabilities can be realistically exploited.
Email Analysis Agent – Examines an email’s content, headers, and sender details.
Email Content Sentiment Agent – Evaluates the emotional tone of emails to detect potential insider risks.
Email Domain Traffic Agent – Analyzes communications between internal and external domains, including traffic volume and direction.
Email Spoofing Agent – Checks SPF, DKIM, and DMARC to determine whether an email source is legitimate.
Email Thread Reconstruction Agent – Rebuilds email threads to show how conversations developed.
Encryption Compliance Agent – Detects email messages sent without mandatory encryption.
External IP Reputation Agent – Evaluates the trust level of an external IP address.
File Attachment Agent – Analyzes files attached to emails for threats or unusual properties.
File Access Pattern Agent – Monitors file access habits and flags unusual mass or atypical usage.
File Obfuscation Detection Agent – Identifies files that attempt to hide their true intent through obfuscation techniques.
File Reputation Agent – Classifies files as safe, suspicious, malicious, or unknown.
File Sharing Policy Agent – Ensures file-sharing behavior follows corporate guidelines.
File Size Anomaly Agent – Flags files that significantly deviate in size from established norms.
File Type Mismatch Agent – Points out files whose true content doesn’t match their extension.
Firmware Versioning Agent – Tracks firmware updates and associated vulnerabilities.
Foundation Model – A large AI model trained on broad datasets and adaptable to specific specialized tasks.

G–I

Generative AI (GenAI) – AI that produces new content—text, code, images—based on learned data patterns.
Group Membership Agent – Monitors user group memberships and reports changes.
Hash Investigation Agent – Analyzes file hashes like MD5, SHA-1, and SHA-256 to assess file identity or risk.
HIPAA Data Access Agent – Tracks access to protected health information to prevent misuse.
Hostname-to-Device Agent – Retrieves a device’s unique ID from its hostname.
Incident Context Compilation Agent – Collects surrounding details to assist in incident investigations.
Incident Root Cause Agent – Determines the fundamental cause behind a security event.
IoT Device Activity Agent – Observes behaviors specific to Internet of Things devices.
IT Asset Tracking Agent – Keeps inventory and usage details of IT equipment.
IP Services Agent – Identifies public-facing services running on an IP and categorizes them.

J–O

Large Dataset Summarization Agent – Extracts essential insights from very large datasets.
Lateral Movement Simulation Agent – Imitates attacker movement across systems to test defenses.
License Compliance Agent – Ensures all software usage aligns with licensing requirements.
Machine Learning Drift Agent – Detects changes in performance or behavior of deployed ML models.
Malware Variant Correlation Agent – Links malware variants together based on shared attributes or campaign patterns.
Metadata Analysis Agent – Extracts and inspects metadata for suspicious indicators.
Mitigation Strategy Agent – Provides customized recommendations for responding to particular threats.
Natural Language Processing (NLP) – AI techniques that allow machines to understand and generate human language.
Network Protocol Misuse Agent – Flags abnormal or unauthorized use of network protocols.
Network Vulnerability Scanner Agent – Checks networks for misconfigurations, outdated components, or other weaknesses.
Non-Human Identity – Machine or application identities that authenticate and interact within systems.
Non-Human Work – Routine, repetitive work suited for automation by AI agents.
Open Source Vulnerability Agent – Monitors vulnerabilities in open-source components used internally.
Outbound Spam Detection Agent – Detects when internal accounts are sending spam externally.
Outcome-Driven Security – A strategy centered on achieving measurable security outcomes rather than deploying tools for their own sake.
Outlier Detection Agent – Highlights users or devices that operate outside normal behavior patterns.
Ownership Transfer Agent – Tracks and verifies changes in device ownership.

P–R

Patch Compliance Agent – Ensures critical patches are deployed organization-wide.
Patch Management Agent – Manages and applies software updates.
PCI DSS Payment Data Agent – Monitors compliance with PCI DSS requirements relating to payment data.
Pen Testing Coordination Agent – Combines manual penetration test results with automated scans for a full picture.
Phishing Org Context Agent – Assesses the role, identity, and actions of email recipients to determine phishing impact.
Phishing Simulation – Training exercises that mimic phishing attacks to educate employees.
Phishing Simulation Agent – Generates realistic phishing campaigns to test user responses.
Playbook Execution Agent – Runs predefined incident response workflows automatically.
Policy Violation Detection Agent – Identifies deviations from organizational or security policies.
Port Scanning Detection Agent – Alerts when internal or external scanning attempts occur.
Port Scanning Agent – Simulates attacker-style port scans to identify weaknesses.
Post-Incident Forensic Agent – Collects evidence for in-depth post-incident reviews.
Post-login Activity Agent – Checks for unusual activity on a device after authentication.
Post-login User Activity Agent – Examines user behavior following authentication to spot anomalies.
Privilege Escalation Agent – Detects unauthorized increases in access levels.
Privilege Escalation Simulation Agent – Tests known escalation paths to evaluate the environment’s exposure.
Privileged Access Management (PAM) – Tools and policies to oversee and secure privileged accounts.
Process Communication Agent – Investigates processes communicating with external IPs.
Reinforcement Learning (RL) – A learning method where agents improve decisions through reward and penalty feedback.
Remediation Tracker Agent – Monitors remediation tasks and flags overdue fixes.
Retrieval-Augmented Generation (RAG) – Combines generative AI with retrieved external data to improve accuracy.
Risk-Based Prioritization Agent – Ranks vulnerabilities based on severity, exploitability, and impact.
Root Domain Agent – Extracts the primary domain (TLD+1) from a URL.
SHA1 Alert Evidence Agent – Evaluates file-related alert evidence using SHA1 hashes.
Security Agents of Cloud Service Providers – Frontier agents of AWS, GCP, OCI, Azure to proactively secure your applications throughout the development lifecycle
Service Uptime Monitoring Agent – Ensures mission-critical services remain accessible and functional.
SOX Compliance Monitoring Agent – Validates controls required by Sarbanes-Oxley regulations.
Social Engineering Test Agent – Simulates impersonation-based attacks to test user awareness.
Swarm – A coordinated collection of AI agents and tools focused on delivering a specific security outcome.
Swarm Intelligence – Collaborative decision-making and problem-solving among multiple AI agents.
System Configuration Drift Agent – Detects unauthorized changes to system settings.

T–Z

Temporal Pattern Analysis Agent – Identifies anomalies tied to time patterns, such as off-hours access.
Third-party Dependency Agent – Tracks vulnerabilities in external services and libraries.
Threat Actor Profiling Agent – Develops profiles of adversaries based on their tactics and observed behavior.
Threat Exposure Management (TEM) – The process of identifying, ranking, and reducing an organization’s exposure to threats.
Threat Feed Aggregation Agent – Consolidates incoming threat intelligence updates.
URL Agent – Determines whether a URL poses a risk to data or users.
User Activity Agent – Checks with the user—via integrations—whether a login or action was legitimate.
User Email Context Agent – Analyzes email metadata and communication patterns for contextual insights.
User Login Pattern Agent – Evaluates login frequency, timing, and locations for suspicious deviations.
User Role Agent – Determines a user’s position, responsibilities, and organizational context.
Vulnerability Discovery Agent – Searches systems for known issues using sources such as CVE feeds.
VPN Utilization Agent – Monitors VPN use for compliance and unusual trends.
Web App Attack Agent – Simulates attacks like SQL injection or XSS against web applications.
Wireless Network Attack Agent – Tests wireless infrastructure using attacks such as deauthentication and sniffing.
Workflow Optimization Agent – Detects inefficiencies and recommends security workflow improvements.
Workforce Productivity Analysis Agent – Tracks trends in workforce activity levels over time.
Zero-Day Detection Agent – Looks for behavior patterns consistent with zero-day exploit attempts.