Glossary

Terms as they are used on this site. Several of these are used inconsistently across the industry; where that is true, the entry says so rather than pretending there is one settled meaning.

Alert fatigue

The state in which analysts stop reading a queue carefully because experience has taught them it rarely contains anything. Usually described as a volume problem; more accurately a precision problem, since a small trustworthy queue does not produce it.

Asset inventory

The record of what systems exist, what they do and who owns them. Almost every other control is defined relative to it, which is why its accuracy silently caps the effectiveness of everything else.

Attack surface

The set of points at which an untrusted party can interact with a system. Expands with every exposed service, credential, integration and dependency, and is usually larger than the diagram suggests.

Baseline

A model of normal behaviour for an entity, used to judge whether current behaviour is unusual. Converts static rules into comparative ones, at the cost of needing enough clean history to learn from.

Blast radius

How much is affected when something goes wrong — including when an automated response fires incorrectly. The property that automated containment must bound explicitly, since automation removes the friction that used to limit it.

Containment

Action taken to stop an incident spreading, distinct from eradication and recovery. Ranges from cheaply reversible (forcing re-authentication) to irreversible (reimaging), and the two should not be automated on the same confidence threshold.

CVSS

The Common Vulnerability Scoring System. Its base score describes a vulnerability in isolation, deliberately excluding your environment, which is what makes scores comparable between organisations and why they should not be used directly as a work queue.

Detection

Logic that identifies suspicious activity in telemetry. Code that runs in production against adversarial input, whose failure mode is silence rather than an error.

Detection engineering

Treating detections as software: version controlled, tested against positive and negative samples, reviewed, and monitored for the input drift that breaks them.

Dwell time

How long an attacker is present before being discovered. Widely used and easily gamed, since it can only be measured for incidents that were eventually found.

EDR

Endpoint detection and response. Agent-based telemetry collection and response capability on hosts. Its usefulness is bounded by deployment coverage, and the uncovered hosts are rarely a random sample.

Enrichment

Automatically attaching context to an alert — asset owner, normal behaviour, prior activity, reputation — before a human sees it. The lowest-risk automation available, because gathering information cannot break anything.

Exploitability

Whether a vulnerability can actually be attacked in practice, including whether working exploit code exists and is being used. External to a CVSS base score by design, and usually more decisive than the score itself.

False positive

An alert that did not represent the activity it was intended to catch. A high rate degrades the detections around it by training dismissal, so it is not a neutral cost.

Hardening

Reducing a system’s attack surface by removing unnecessary functionality, tightening configuration and restricting privileges. Preventive, and therefore invisible when it works.

Impossible travel

Two authentications from locations too far apart for the time between them. A useful signal that generates false positives from VPNs, proxies and mobile networks, which is why it works better combined than alone.

Indicator of compromise

A specific observable associated with known malicious activity — a hash, an address, a filename. Cheap to match and cheap for an attacker to change, so useful for coverage rather than as a primary strategy.

Lateral movement

An attacker moving between systems after initial access. Frequently the longest phase and the one where detection is most feasible, since it produces authentication and network activity that has to look like something.

Least privilege

Granting only the access required for a task. Constrains what a compromised identity can reach, and decays continuously as people change roles and permissions accumulate.

Playbook

A defined sequence of response steps for a scenario. Valuable to the extent it has been rehearsed; an unrehearsed playbook is a hypothesis containing at least one step that does not work.

Privilege escalation

Gaining higher permissions than initially held, either to another user’s level (horizontal) or to administrative level (vertical).

Scope (CVSS metric)

Whether a vulnerability’s impact crosses into a different security authority than the vulnerable component. The most commonly misapplied metric in scoring, and one that materially inflates the result when set wrongly. It asks about boundaries, not about how bad the damage is.

SIEM

Security information and event management. Central collection, normalisation and querying of telemetry. Its value is governed by what is actually being ingested, which is why source health monitoring matters more than rule count.

SOAR

Security orchestration, automation and response. Executes response workflows automatically. The design problem is bounding what it can affect, not writing the workflow.

Threat hunting

Proactively searching telemetry for activity no detection currently catches. Distinguished from alert triage by starting with a hypothesis rather than a trigger; the durable output is a new detection, not the hunt itself.

True positive

An alert that correctly identified the activity it was designed to catch. The ratio of these to total alerts determines whether a queue gets read carefully.

Zero trust

An architectural approach that removes implicit trust based on network location, requiring verification per request. Used loosely enough in marketing that it is worth asking what specifically is meant in any given conversation.