Key Terms

AI systems configured to act autonomously, accessing email, calendars, file systems, APIs, and executing multi-step tasks with minimal human oversight. The security surface is fundamentally different from query-response AI: agents have permissions, can make persistent changes, and are vulnerable to prompt injection. Least-privilege and human-in-the-loop controls are the primary mitigations.

The world's first comprehensive AI regulation (Regulation 2024/1689, effective 2024). Uses a risk-based approach: high-risk AI systems (used in critical infrastructure, law enforcement, healthcare) must meet cybersecurity, transparency, and human oversight requirements.

The world's first comprehensive AI regulation (Regulation 2024/1689, effective 2024). Uses a risk-based approach: high-risk AI systems (used in critical infrastructure, law enforcement, healthcare) must meet cybersecurity, transparency, and human oversight requirements.

Artificial intelligence security posture management: tooling that inventories the AI models, agents and data flows in an organisation and flags misconfigurations. The same idea as cloud posture management, applied to a layer most organisations cannot yet list.

Cyberattacks where AI tools generate convincing phishing content, automate vulnerability discovery, or enable voice/video deepfakes for social engineering. CrowdStrike reported a 1,000% increase in AI-assisted vishing attacks in 2024. IBM X-Force reports AI-generated phishing achieves 3 to 5× higher click rates than traditional templates. The arms race is now symmetric: AI-powered email security is required to counter AI-powered phishing at scale. In 2024 a finance employee in Hong Kong transferred $25M after a deepfake video call impersonating the company's CFO and three colleagues, none of whom were on the call.

Cyberattacks where AI tools generate convincing phishing content, automate vulnerability discovery, or enable voice/video deepfakes for social engineering. CrowdStrike reported a 1,000% increase in AI-assisted vishing attacks in 2024. IBM X-Force reports AI-generated phishing achieves 3 to 5× higher click rates than traditional templates. The arms race is now symmetric: AI-powered email security is required to counter AI-powered phishing at scale. In 2024 a finance employee in Hong Kong transferred $25M after a deepfake video call impersonating the company's CFO and three colleagues, none of whom were on the call.

Artificial intelligence security posture management: tooling that inventories the AI models, agents and data flows in an organisation and flags misconfigurations. The same idea as cloud posture management, applied to a layer most organisations cannot yet list.

The OWASP Agent Observability Standard: guidance on making AI agents auditable — bounding what an agent may do, and being able to trace any action it took back to the task that started it. The answer to 'who authorised that' when the actor was not a person.

Application Programming Interface: the defined way one system asks another for data or action. Most modern breaches of customer data go through one rather than through a login page.

The OWASP API Security Top 10 (2023 edition) lists the most critical API vulnerabilities including BOLA (Broken Object Level Authorization), Broken Authentication, and Excessive Data Exposure. APIs are now the most common attack surface in web applications.

Advanced Persistent Threat. A sophisticated, long-term cyberattack, typically by a nation-state or state-sponsored group, designed to remain undetected for months or years. APT actors include Cozy Bear (Russia), Lazarus Group (North Korea), and Volt Typhoon (China).

Cryptographically signing a build output so a consumer can verify it came from your pipeline and was not swapped afterwards. Without it, a software bill of materials describes something you cannot prove you received.

Attack surface management: continuously discovering what of yours is reachable from the internet, including the things nobody remembered deploying. Most organisations find their inventory is wrong the first time they measure it.

A complete, up-to-date record of all hardware, software, and data assets in an organization. Without it, you cannot protect what you don't know exists. The foundation of every security framework.

The total number of points where an attacker can try to enter or extract data from an environment. Reducing attack surface, fewer open ports, fewer exposed services, fewer privileged accounts, is a core Zero Trust principle.

Attack surface management: continuously discovering what of yours is reachable from the internet, including the things nobody remembered deploying. Most organisations find their inventory is wrong the first time they measure it.

Antivirus: software that detects malicious files, classically by matching known signatures. It stops commodity malware and misses attacks that use legitimate tools and stolen credentials, which is most serious intrusions now.

A hidden method of bypassing normal authentication to access a system. Can be intentionally inserted by attackers (as in the XZ Utils 2024 supply chain attack) or left accidentally in poorly reviewed code.

Blind carbon copy, the mail field that hides recipients from each other. It appears here as a breach mechanism: a bulk message sent with recipients in the To or Cc field instead discloses everyone on the list to everyone else, which has drawn real fines.

A business continuity plan: the documented answer to how the organisation keeps operating when something essential is unavailable. Distinct from a disaster recovery plan, which is about restoring the technology; continuity is about running the business meanwhile.

Business Email Compromise. Fraud carried out by impersonating a trusted sender — a supplier, an executive, a lawyer — to redirect a payment. It relies on process and authority rather than malware, which is why technical controls alone rarely stop it.

Border Gateway Protocol, which decides how traffic finds its way between networks on the internet. A wrong announcement can silently pull another organization's traffic through the wrong path.

How far a single compromise can reach before something stops it: which systems, which data, which accounts. Shrinking it is the point of segmentation and of least privilege, and it is the honest way to answer 'how bad would this be' before it happens.

The principle that senior leadership and the board bear ultimate responsibility for the organization's cyber risk posture. Under NIS2 and GDPR, board members can face personal liability for security failures.

The degree to which board and executives trust the security program and understand the organization's risk posture. Low board confidence signals gaps in communication, metrics, or strategy.

A Binding Operational Directive from CISA: a compulsory instruction to US federal agencies, for example to patch a listed vulnerability within a deadline. Private organisations are not bound by one, but a BOD is a strong public signal about what is being exploited.

Broken Object Level Authorization. The #1 OWASP API Security vulnerability. An API returns data objects without checking if the requesting user has permission to see that specific object. Caused the 2023 T-Mobile API breach (37 million records).

A network of compromised computers (bots) under attacker control, used for DDoS attacks, spam campaigns, or credential stuffing. The Mirai botnet (2016) consisted entirely of compromised IoT devices.

The legal requirement to report data breaches to authorities and affected individuals. GDPR: report to the supervisory authority within 72 hours. NIS2: initial notification within 24 hours, full report within 72 hours.

A documented, deliberately awkward way to get emergency access when the normal path is unavailable — a sealed credential, a second approver, an audited account that is otherwise dormant. Awkward on purpose, because the same door is what an attacker wants.

How long an attacker takes to move from the first machine they compromise to a second one. It is the window a defender actually has: once an intrusion spreads, containment becomes recovery. Measured in minutes in recent reporting, not hours.

Bundesamt für Sicherheit in der Informationstechnik, Germany's federal cyber security authority. Its IT-Grundschutz catalogs and technical guidelines are a common baseline for German-speaking organizations.

A fraud category where attackers impersonate executives, vendors, or partners via email, or increasingly via deepfake voice and video, to authorize fraudulent wire transfers, credential sharing, or sensitive data disclosure. BEC causes more total financial damage than any other cybercrime category, USD 2.9B of reported US losses in 2023 alone (FBI IC3). AI-generated voice has dramatically lowered the detection difficulty for targets.

Plans and procedures that ensure critical business functions continue during and after a security incident. Includes BCP (Business Continuity Plan) and DRP (Disaster Recovery Plan). Tested regularly through tabletop exercises and drills.

A fraud category where attackers impersonate executives, vendors, or partners via email, or increasingly via deepfake voice and video, to authorize fraudulent wire transfers, credential sharing, or sensitive data disclosure. BEC causes more total financial damage than any other cybercrime category, USD 2.9B of reported US losses in 2023 alone (FBI IC3). AI-generated voice has dramatically lowered the detection difficulty for targets.

Bring your own device: staff using personal phones and laptops for work. It removes hardware cost and removes control at the same time, and it is where privacy law and security policy collide most directly, because the device also holds the employee's own life.

Command and control: the infrastructure an attacker uses to issue instructions to malware already inside a network. Detecting the outbound connection to it is often the first reliable sign of a compromise.

The US Communications Assistance for Law Enforcement Act, which requires telecommunications providers to build lawful intercept capability into their networks. It matters here because that mandated capability is itself a target: an attacker who reaches it inherits a purpose-built surveillance system.

Verifying an instruction by contacting the requester through a channel you already had, not the one the request arrived on. The single control that defeats most payment fraud, and the one people skip because it feels like distrust.

A cloud access security broker: a control point between staff and cloud services that shows which services are actually in use and can block or restrict them. The usual first answer to shadow IT, because it turns an unknown into an inventory.

Canada's Critical Cyber Systems Protection Act, the Canadian counterpart to NIS2 for operators of critical systems. Cited in the course as evidence that the obligations arriving in Europe are not a European peculiarity.

A content delivery network: a distributed set of servers that caches content close to users and absorbs traffic spikes. It also concentrates dependency, so a CDN outage takes a great many unrelated sites down at once.

A computer emergency response team: the standing team, national or organisational, that coordinates response to incidents and publishes advisories. National CERTs are often the fastest credible source that an exploit is being used in your country.

Austria's national Computer Emergency Response Team, operated by NIC.at under mandate from the Austrian government. Issues free, CVSS-rated security advisories in German for the DACH region, typically within hours of active exploitation being confirmed. Directly relevant to NIS2 compliance for Austrian organizations: subscription to CERT.at advisories is a documented risk management measure under NIS2 Article 21. Free advisory subscription available at cert.at/de/services/mailinglisten.

Continuous Integration and Continuous Delivery: the automated pipeline that builds, tests and ships software. It holds credentials for everything it deploys, which makes it a high-value target rather than plumbing.

Integrating security checks into Continuous Integration and Continuous Deployment pipelines. Automated vulnerability scanning and secret detection run before code is deployed, catching issues when they are cheapest to fix.

The Center for Internet Security, a non-profit that publishes the CIS Controls and hardening benchmarks. Its appeal for a small team is prioritisation: the controls are ordered so that the first handful remove the most risk per unit of effort.

The Cybersecurity and Infrastructure Security Agency, the United States federal body responsible for critical-infrastructure cyber defense. Its Known Exploited Vulnerabilities catalog and emergency directives are widely used as a patching priority list well outside the US.

Chief Information Security Officer. The executive responsible for an organization's information and data security strategy. The CISO reports to the board or CEO and owns the security roadmap, incident response authority, and budget.

The principle that senior leadership and the board bear ultimate responsibility for the organization's cyber risk posture. Under NIS2 and GDPR, board members can face personal liability for security failures.

The exposure created when many unrelated systems depend on the same provider, region or identity service. Each dependency looks reasonable alone; together they mean one outage elsewhere becomes your outage, with nothing you can do but wait.

Incorrect settings in cloud environments that expose data or systems. Examples: public S3 buckets, overly permissive IAM roles, disabled audit logging. The leading cause of cloud data breaches, not sophisticated hacking but simple configuration errors.

Several incidents arriving at once and interacting — an outage during a ransomware recovery, a disinformation campaign during a regulatory deadline. It is harder than the sum of its parts because the same few people are needed in every room.

The EU Cyber Resilience Act. It obliges manufacturers of products with digital elements to build security in, to publish a software bill of materials, and to supply security updates for a defined support period. It shifts liability towards whoever ships the product rather than whoever deploys it.

Using large lists of stolen username/password combinations (from previous breaches) to attempt logins across many sites. Effective because people reuse passwords. Defeated by MFA and password managers.

The agreed structure for who decides what during an incident: one person accountable for decisions, named deputies, and a rule for when to escalate. Its absence is discovered at the worst possible moment, usually as an argument about authority while a clock runs.

The strategy and messaging for communicating with customers, press, regulators, and staff during and after a security incident. Poor communication (delayed, evasive, or incomplete) consistently amplifies reputational damage beyond the technical impact.

Customer Relationship Management: the system holding customer records and sales history. A rich target, because it concentrates personal data that is useful for both fraud and extortion.

Handling one incident under several jurisdictions at once, where notification deadlines, authorities and even the definition of the reportable event differ. The practical failure is not legal but clerical: the same facts due in different forms on different clocks.

Cryptographically Relevant Quantum Computer, a quantum computer with sufficient qubit count and error correction to break classical asymmetric cryptography (RSA, ECDSA, DH). NIST estimates CRQC capability emerging 2030 to 2035. The HNDL threat means organizations must begin PQC migration well before CRQCs arrive.

The ability of a system to quickly switch between cryptographic algorithms without major re-engineering. Critical for post-quantum migration: organizations with cryptoagile systems can adopt new algorithms as standards evolve.

The ability of a system to quickly switch between cryptographic algorithms without major re-engineering. Critical for post-quantum migration: organizations with cryptoagile systems can adopt new algorithms as standards evolve.

The NIST Cybersecurity Framework. Version 2.0 organises security work into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is a common language for reporting posture to a board rather than a checklist of controls.

Computer Security Incident Response Team. The standing team that takes over when an incident is declared. NIS2 requires entities to report significant incidents to their national CSIRT.

Cloud Security Posture Management, automated continuous scanning of cloud infrastructure configurations against security best practices and compliance frameworks (CIS Benchmarks, NIST CSF). CSPM tools detect misconfigurations, overly permissive IAM roles, public S3 buckets, unencrypted databases, before attackers find them. The Capital One breach (2019) was a misconfigured WAF rule; CSPM would have flagged it within hours.

Common Vulnerabilities and Exposures. A publicly maintained list of known cybersecurity vulnerabilities, each with a unique identifier (e.g., CVE-2021-44228 for Log4Shell) and a CVSS severity score.

Common Vulnerability Scoring System. A numeric score (0 to 10) rating the severity of a security vulnerability. Scores above 9 are 'Critical'. Used to prioritize patching, but CISA's KEV catalog is a more reliable indicator of actual exploitation risk.

Insurance covering financial losses from cyberattacks including ransom payments, business interruption, legal costs, and breach notification. Premiums tripled between 2020 and 2023. Insurers now mandate MFA, EDR, and immutable backups.

The ability to prepare for, respond to, and recover from cyber incidents while maintaining essential business functions. Goes beyond prevention, accepts that breaches will happen and focuses on recovery speed.

The EU regulation establishing shared detection infrastructure and a reserve of incident response capacity that member states can call on. It matters in a cross-border incident, where the practical question is who helps and on what authority.

MITRE's companion catalog to ATT&CK, listing defensive countermeasures and mapping them to the techniques they blunt. Used in this simulation to tag what an option actually mitigates.

Collecting and keeping only what is needed for a stated purpose, a GDPR principle and the cheapest security control available: data you never held cannot be stolen, and data you deleted on schedule cannot appear in a leak years later.

A contract required under GDPR when sharing personal data with a third-party processor. Defines data processing purposes, security requirements, breach notification obligations, and deletion timelines.

Under GDPR, any third party that processes personal data on behalf of a data controller. Must be governed by a Data Processing Agreement defining security requirements, breach notification timelines, and deletion obligations.

Verizon's Data Breach Investigations Report, published annually since 2008 from tens of thousands of real incidents. The course cites it for base rates, for example what share of breaches begin with stolen credentials, so that a team argues from evidence rather than intuition.

Distributed Denial of Service attack. Overwhelming a server, network, or service with traffic from many sources (a botnet) until it becomes unavailable. The 2016 Mirai botnet attack (1.2 Tbps via IoT devices) took down major parts of the internet.

AI-generated synthetic media, video, audio, or images, that convincingly impersonates a real person. Created using generative adversarial networks or diffusion models trained on publicly available recordings. In security: used for CEO fraud (deepfake voice calls), FIMI campaigns, and identity verification bypass. Detection tools exist but lag behind generation capability.

Publishing a package to a public registry under the same name as one of a company's internal packages, so the build system fetches the attacker's version because it looks newer. The fix is configuration, not vigilance: pin the source as well as the name.

Tracking and updating third-party libraries and packages to eliminate known vulnerabilities. Log4Shell demonstrated that a single widely-used indirect dependency can simultaneously affect thousands of systems globally.

Software composition analysis: tooling that inventories the open-source components inside an application and flags the ones with known vulnerabilities. It answers 'what are we built out of', which is the question a supply chain incident asks at short notice.

Digital Operational Resilience Act. EU regulation for financial sector organizations requiring ICT risk management, incident reporting to regulators within 4 hours, third-party risk controls, and annual resilience testing (effective January 2025).

The plans and processes for restoring IT systems and data after a major disruption. RTO (Recovery Time Objective) defines how quickly systems must be back; RPO (Recovery Point Objective) defines how much data loss is acceptable.

DomainKeys Identified Mail: a cryptographic signature on outgoing mail that lets a receiving server verify the message really came from your domain and was not altered.

Data Loss Prevention. Tooling that inspects content leaving the organization and blocks what matches a rule. Effective against accidents and careless staff, weak against anyone who intends to get data out.

Domain-based Message Authentication, Reporting and Conformance: the policy that tells receiving mail servers what to do when SPF and DKIM checks fail, and sends you reports on attempts to spoof your domain. The reports are the part organisations forget to read.

A demilitarised zone: a network segment holding systems that must be reachable from the internet, kept apart from internal systems so that a compromise there does not immediately reach everything else.

The Domain Name System: the directory that turns a name into an address. It is a security concern twice over, because attackers use it to reach their own infrastructure and because whoever controls your DNS records can redirect your customers.

Digital Operational Resilience Act. EU regulation for financial sector organizations requiring ICT risk management, incident reporting to regulators within 4 hours, third-party risk controls, and annual resilience testing (effective January 2025).

A ransomware tactic that combines encrypting the victim's data (blocking operations) with threatening to publish stolen data. Makes backups less effective as a defense because the data leak threat remains even after restoration.

A data protection impact assessment: a documented analysis, required by GDPR Article 35 before high-risk processing, of what could go wrong for the people whose data it is. Done early it changes designs; done late it is paperwork attached to a decision already made.

Data Protection Officer. A role mandatory under GDPR for organizations processing large volumes of personal data or special category data. The DPO must be independent, expert in data protection law, and report directly to top management.

The time an attacker spends inside a network before being detected and removed. Mandiant's 2024 report found a global median of 10 days. Longer dwell time means more data exfiltrated, more systems compromised, and higher recovery cost.

Elliptic Curve Diffie–Hellman: the elliptic-curve method by which two parties agree a shared secret over an open channel. It protects most TLS traffic today and is the piece ML-KEM replaces in a post-quantum migration.

Elliptic Curve Digital Signature Algorithm: the elliptic-curve method of signing, widely used because it gives strong security with small keys. Like RSA it is broken by a sufficiently large quantum computer, which is why signatures are migrating to ML-DSA.

Electronic data interchange: the long-established format for exchanging structured business documents such as orders and invoices directly between companies. Old, deeply embedded in logistics, and rarely designed with authentication in mind.

The European Data Protection Board: the body where national data protection authorities coordinate. Its guidelines settle how GDPR is read across member states, which is why a single national fine can reset expectations everywhere.

Endpoint Detection and Response. Security software that monitors endpoint devices (laptops, servers) for suspicious activity in real time, records detailed telemetry, and enables security teams to investigate and contain threats.

The European Economic Area: the EU plus Iceland, Liechtenstein and Norway. It is why the Icelandic and Norwegian companies in this simulation carry GDPR and NIS2 obligations despite neither being an EU member state.

The process of converting data into a format that can only be read by someone with the correct decryption key. Encryption protects data at rest (stored) and in transit (transmitted). Required by GDPR and most security frameworks.

EDR (Endpoint Detection and Response) software installed on devices to monitor for suspicious behavior, detect threats in real time, and enable rapid response. Replaces traditional signature-based antivirus.

The European Union Agency for Cybersecurity. Publishes the annual Threat Landscape report, issues technical guidance, and supports member states in implementing NIS2. It advises and coordinates; it does not fine anyone.

Enterprise Resource Planning: the central system running finance, inventory and orders. When it stops, the business stops, which is why its availability is an executive concern rather than an IT one.

The world's first comprehensive AI regulation (Regulation 2024/1689, effective 2024). Uses a risk-based approach: high-risk AI systems (used in critical infrastructure, law enforcement, healthcare) must meet cybersecurity, transparency, and human oversight requirements.

The EU Cyber Resilience Act. It obliges manufacturers of products with digital elements to build security in, to publish a software bill of materials, and to supply security updates for a defined support period. It shifts liability towards whoever ships the product rather than whoever deploys it.

Attack surface management: continuously discovering what of yours is reachable from the internet, including the things nobody remembered deploying. Most organisations find their inventory is wrong the first time they measure it.

Fast Identity Online 2. An open standard for passwordless and phishing-resistant authentication using hardware security keys (e.g., YubiKey) or device biometrics. Unlike push-based MFA, FIDO2 cannot be bypassed by credential phishing.

Foreign Information Manipulation and Interference, coordinated campaigns by state or state-aligned actors to spread disinformation, manipulate public narratives, and interfere in democratic processes using synthetic media (deepfakes), sockpuppet networks, and amplification infrastructure. ENISA's FIMI threat landscape identifies AI-generated content as the primary accelerator since 2023.

Federal Information Processing Standards, the US government's published requirements for cryptography and security. FIPS 203, 204 and 205 are the standardized post-quantum algorithms.

Collecting and preserving digital evidence after an incident in a legally defensible way. Required for law enforcement cooperation, insurance claims, and regulatory investigations. Includes memory capture, disk imaging, and chain of custody.

General Data Protection Regulation. EU law (effective May 2018) governing the collection, processing, and storage of personal data. Fines up to €20M or 4% of global annual turnover. Applies to any organization processing EU residents' data.

The legal requirement to report data breaches to authorities and affected individuals. GDPR: report to the supervisory authority within 72 hours. NIS2: initial notification within 24 hours, full report within 72 hours.

The framework of rules, practices, and processes by which security is directed and controlled. Governance answers: who owns risk, who sets policy, who is accountable when things go wrong.

Attacks motivated by a political or ideological point rather than money. It changes the risk calculus, because the goal is attention: a defacement or a leak timed to a news cycle can cost more in reputation than the technical damage suggests.

Have I Been Pwned, a public service that indexes email addresses appearing in known breach dumps. Useful for showing a workforce concretely that credentials reused from a personal account are already in circulation.

Health Insurance Portability and Accountability Act. US law requiring healthcare organizations to protect electronic protected health information (ePHI). Breach notification mandatory; fines up to $1.9M per violation category per year.

A human-machine interface: the screen through which an operator watches and controls an industrial process. Compromising it lets an attacker show the operator a normal reading while the plant does something else.

Harvest Now, Decrypt Later, a nation-state strategy of intercepting and storing encrypted internet traffic today, to decrypt it retrospectively once cryptographically relevant quantum computers (CRQCs) become available. Organizations that completed post-quantum cryptography migration before CRQCs arrive have no HNDL exposure. Those that deferred face retrospective exposure of all traffic captured since interception programs began.

Identity and Access Management. The systems and processes that control who can access which resources and under what conditions. Core IAM controls: single sign-on, role-based access, MFA, and privileged account management.

An international bank account number. It appears here because payment fraud usually comes down to a changed IBAN on a real invoice, and because verifying a change out of band is the control that stops it.

The FBI's Internet Crime Complaint Center. Its annual report is the most cited source for reported losses to business email compromise and ransomware in the United States.

Operational Technology: the systems that run physical processes — turbines, pumps, production lines — as opposed to IT, which runs information. OT prizes availability and safety over confidentiality, which is why an OT patch window is measured in months.

Information and Communications Technology. The term DORA uses for everything digital an organization depends on, including services bought from third parties.

A security architecture that treats identity as the primary perimeter, rather than network location. In a Zero Trust model, 'who are you?' replaces 'where are you?' as the core security question.

Insecure direct object reference: an application that hands out a record because the request asked for it, without checking whether this user is allowed it. Changing an id in a URL from your own to someone else's is the whole attack, which is why it is so often found in APIs.

An identity provider: the service that authenticates users once and then vouches for them to every application behind it. Convenient and concentrated in the same breath, because a compromise or an outage there reaches everything at once.

The standards series for security in industrial automation and control systems, written around zones and conduits rather than around servers. It is the reference an OT team cites when arguing that IT controls cannot simply be copied onto a plant floor.

Backup data that cannot be modified, deleted, or encrypted, even by ransomware or an attacker with admin credentials. The 3-2-1-1 rule: 3 copies, 2 media types, 1 offsite, 1 immutable.

The agreed structure for who decides what during an incident: one person accountable for decisions, named deputies, and a rule for when to escalate. Its absence is discovered at the worst possible moment, usually as an argument about authority while a clock runs.

The organized process for detecting, containing, eradicating, and recovering from security incidents. The NIST lifecycle: Prepare → Detect → Analyze → Contain → Eradicate → Recover → Learn. Speed of response determines total breach cost.

Malware that silently extracts credentials, session cookies, browser-saved passwords, and sensitive files from an infected device. Widely sold on criminal marketplaces and often the first step before a larger breach.

A criminal who breaks in and then sells the foothold rather than using it. It is why a cheap intrusion becomes an expensive ransomware event weeks later, and why 'nothing happened' after a small incident is not evidence that nothing was taken.

The discipline of securing Internet of Things devices, sensors, cameras, HVAC controllers, industrial equipment, medical devices, building management systems. IoT devices are frequently shipped with default credentials, no patch mechanism, and no encryption. In operational environments, they often share network segments with IT or OT systems, creating lateral movement paths for attackers.

Incident Response Readiness, the degree to which an organization can detect, respond to, and recover from security incidents. Measured by tabletop exercise results, documented runbooks, retainer agreements with IR firms, and backup integrity tests.

Incident Response Readiness, the degree to which an organization can detect, respond to, and recover from security incidents. Measured by tabletop exercise results, documented runbooks, retainer agreements with IR firms, and backup integrity tests.

The standards series for security in industrial automation and control systems, written around zones and conduits rather than around servers. It is the reference an OT team cites when arguing that IT controls cannot simply be copied onto a plant floor.

An information sharing and analysis centre: a sector-specific body where competitors exchange threat intelligence under agreed handling rules. The value is early warning from an organisation that looks like you and was attacked first.

The International Organization for Standardization. In this course it usually appears as ISO 27001, the certifiable standard for an information security management system. Certification proves a management process exists and is audited; it does not by itself prove any specific control is effective.

An international standard for information security management systems (ISMS). Organizations can be certified to ISO 27001, demonstrating a systematic approach to managing sensitive information. Widely required by enterprise customers and procurement.

Operational Technology: the systems that run physical processes — turbines, pumps, production lines — as opposed to IT, which runs information. OT prizes availability and safety over confidentiality, which is why an OT patch window is measured in months.

Just-in-time access: privileges granted for a task and expiring on their own, instead of standing rights that accumulate. It shrinks the window in which a stolen account is useful, and it removes the annual audit question of why an account still has access it once needed.

The mechanism behind Log4Shell: a logging library, asked to log a string, treated part of it as an instruction to fetch and run remote code. It is the canonical example of untrusted input reaching a component nobody thought of as an attack surface.

Just-in-time access: privileges granted for a task and expiring on their own, instead of standing rights that accumulate. It shrinks the window in which a stolen account is useful, and it removes the annual audit question of why an account still has access it once needed.

CISA's Known Exploited Vulnerabilities catalogue: a public list of vulnerabilities that are being exploited in the wild right now, not merely rated dangerous in theory. It matters because it changes the patching question from 'how severe is this' to 'is someone using it today', and US federal agencies are bound to remediate KEV entries within a fixed deadline.

Software or hardware that records every keystroke a user types, capturing passwords, messages, and sensitive data without the user's knowledge. Often deployed as part of infostealer malware.

The technique attackers use to move through a network after gaining initial access, seeking high-value targets like domain controllers and sensitive data stores. Stopped by network segmentation, least-privilege access, and monitoring.

Under GDPR, all personal data processing requires a legal justification from six options: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Processing without a lawful basis is a GDPR violation.

Post-incident analysis identifying what went wrong, what worked, and what must change. A mandatory part of mature incident response and a key driver of continuous improvement.

Attacking with the tools already installed — PowerShell, remote administration software, scheduled tasks — so that nothing malicious has to be dropped on disk. It defeats antivirus by design, which is why detection has to look at behaviour rather than files.

A large language model: the kind of AI system behind tools such as ChatGPT and Claude. It creates three distinct problems in this course: staff pasting confidential data into one, attackers using one to write convincing lures at scale, and the organisation depending on one inside its own products.

A critical vulnerability (CVE-2021-44228) in Apache Log4j, a Java logging library present in millions of systems. A single crafted string in any logged user input triggered remote code execution. CISA called it 'the most serious vulnerability in a decade.'

Short for living off the land: an intrusion carried out with software that is already present and legitimately installed, leaving no malicious file for signature-based tools to find.

The Local Security Authority Subsystem Service: the Windows process that holds credentials in memory while a user is logged in. Attackers dump it to harvest the credentials of everyone who has recently used the machine, which turns one compromised workstation into many accounts.

Mobile application management: controlling the work app and its data rather than the whole device. The usual compromise on personal hardware, because a company can wipe its own container without touching family photographs.

An attack where the attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly with each other. TLS certificates and certificate pinning defend against this.

Mobile device management: central control over the phones and laptops that reach company data — enforcing encryption, pushing updates, wiping a lost device. On personally owned hardware it is also where security policy meets an employee's private life.

Multi-Factor Authentication. Requires two or more verification factors to access a system: something you know (password), something you have (phone), and something you are (biometric). Blocks over 99% of automated credential attacks.

An attack technique that sends repeated MFA push notification requests to a target, hoping they approve one by accident or frustration, a technique known as push bombing. Exploited in the Uber (2022) and Microsoft (2022) breaches: in the Uber case, an attacker sent repeated pushes at 1am until the target approved, then gained full network access within minutes. Defeated by number-matching MFA (the app requires the user to type a code displayed on screen, preventing blind approval) or, most reliably, FIDO2 hardware keys, which cannot be triggered remotely at all.

A public catalog of the tactics and techniques attackers actually use, each with an identifier such as T1566 for phishing. Gives defenders and reports a shared vocabulary for what happened, and it is where the technique codes on the resolution screen come from.

Module-Lattice Digital Signature Algorithm, standardised as FIPS 204. The post-quantum replacement for today's digital signatures, which is what proves a message or a software update really came from who it claims.

Module-Lattice Key Encapsulation Mechanism, standardised as FIPS 203. The post-quantum replacement for today's key exchange, meaning the step where two parties agree on a shared secret. This is the algorithm that protects traffic recorded now from being decrypted later by a quantum computer.

Detection built for phones and tablets: spotting a malicious profile, a sideloaded app or a network that is intercepting traffic. Distinct from device management, which enforces policy but does not watch for an attack in progress.

A managed service provider: an outside firm that runs parts of your IT. Because one provider holds administrative access to many clients, attackers target the provider to reach all of them at once.

A managed security service provider: an outside firm that runs security monitoring for you, typically a 24/7 detection and response service. It buys night and weekend coverage a small team cannot staff, at the cost of an outsider holding privileged access to your estate.

Mean Time To Detect. The average time between a breach occurring and the organization discovering it. IBM research found the 2024 industry average was 194 days. Reducing MTTD directly limits the blast radius of any attack.

Mean Time To Detect. The average time between a breach occurring and the organization discovering it. IBM research found the 2024 industry average was 194 days. Reducing MTTD directly limits the blast radius of any attack.

Mean Time To Respond. The average time from detecting a security incident to containing it. Together with MTTD, it determines the total exposure window. Automation (SOAR) significantly reduces MTTR.

One campaign pressing on several fronts at once — encryption in the office network, disruption on the plant floor, a disinformation push in public — so that responders must split attention and authority.

National Cyber Security Centre. Several countries run one; the briefings usually mean the United Kingdom's, part of GCHQ, which issues alerts and incident guidance for organizations.

Dividing a network into isolated zones to prevent attackers from moving laterally. If an attacker compromises one segment, segmentation limits what they can reach. Critical for OT/IT separation in industrial environments.

The EU Network and Information Security Directive, the first EU-wide cyber law for operators of essential services. Its successor NIS2 widened the sectors covered, added management accountability and set fixed incident reporting deadlines.

Network and Information Security Directive 2. EU law (enforceable from October 2024) expanding mandatory cybersecurity obligations to 18 sectors. Introduces personal liability for C-suite executives and fines up to €10M or 2% of global turnover.

The legal requirement to report data breaches to authorities and affected individuals. GDPR: report to the supervisory authority within 72 hours. NIS2: initial notification within 24 hours, full report within 72 hours.

The United States National Institute of Standards and Technology. Author of the Cybersecurity Framework and of the post-quantum cryptography standards, and the reason so much of the world's security vocabulary is American.

NIST Cybersecurity Framework. A voluntary US framework (version 2.0 published 2024) organizing security activities around six functions: Govern, Identify, Protect, Detect, Respond, Recover. Widely adopted globally as a security program baseline.

Machine accounts, service accounts, API keys, OAuth tokens, CI/CD credentials, and AI agent identities, as distinct from human user accounts. NHIs outnumber human identities by 45:1 in the average enterprise (CyberArk 2024). They are frequently over-privileged, rarely rotated, and difficult to monitor. NHI sprawl is the primary attack surface in agentic AI environments.

Machine accounts, service accounts, API keys, OAuth tokens, CI/CD credentials, and AI agent identities, as distinct from human user accounts. NHIs outnumber human identities by 45:1 in the average enterprise (CyberArk 2024). They are frequently over-privileged, rarely rotated, and difficult to monitor. NHI sprawl is the primary attack surface in agentic AI environments.

A destructive 2017 cyberattack disguised as ransomware, attributed to Russia's GRU military intelligence. Spread via a Ukrainian accounting software update and caused $10B+ in global damage. Maersk, Merck, and FedEx were among the hardest hit.

The US National Telecommunications and Information Administration, which defined the minimum data fields a software bill of materials must contain. Its list is the usual answer to the question of what makes an SBOM acceptable rather than merely present.

Security vulnerabilities introduced via open-source libraries and components embedded in commercial and internal software. Log4Shell demonstrated how a single widely used open-source library can simultaneously affect millions of systems globally.

Operational Technology: the systems that run physical processes — turbines, pumps, production lines — as opposed to IT, which runs information. OT prizes availability and safety over confidentiality, which is why an OT patch window is measured in months.

Operational Technology: the systems that run physical processes — turbines, pumps, production lines — as opposed to IT, which runs information. OT prizes availability and safety over confidentiality, which is why an OT patch window is measured in months.

The Open Worldwide Application Security Project, a non-profit community that publishes the best-known lists of application security risks, including the OWASP Top 10 for web applications and separate top tens for APIs and for large language models. Widely used as a baseline in procurement and testing.

The OWASP Agent Observability Standard: guidance on making AI agents auditable — bounding what an agent may do, and being able to trace any action it took back to the task that started it. The answer to 'who authorised that' when the actor was not a person.

The OWASP API Security Top 10 (2023 edition) lists the most critical API vulnerabilities including BOLA (Broken Object Level Authorization), Broken Authentication, and Excessive Data Exposure. APIs are now the most common attack surface in web applications.

The Open Worldwide Application Security Project's list of the 10 most critical web application security risks. Updated every 3 to 4 years. A baseline requirement for secure application development and procurement.

Privileged Access Management. Security controls specifically for high-privilege accounts (domain admins, database admins, root). PAM systems vault credentials, record sessions, and enforce just-in-time access.

FIDO2-based cryptographic credentials stored on a device, replacing passwords entirely. Backed by Apple, Google, and Microsoft since 2023. Passkeys cannot be phished or stolen from a remote server because the private key never leaves the device.

The systematic process of acquiring, testing, and deploying software patches to fix vulnerabilities. WannaCry (2017) and Equifax (2017) showed that delayed patching of known critical vulnerabilities remains one of the most common causes of major breaches.

A Service Level Agreement defining how quickly security patches must be applied. Common example: critical patches within 24 hours, high severity within 7 days, medium within 30 days. SLA compliance is a key audit finding.

Payment Card Industry Data Security Standard. A security standard mandatory for any organization that stores, processes, or transmits payment card data. Non-compliance results in fines, higher transaction fees, and loss of card processing rights.

The Payment Card Industry Data Security Standard: the contractual rules an organisation must meet to handle card data. It is enforced by the card brands and acquiring banks rather than by a regulator, and non-compliance can cost the right to process payments at all, which for a payments company is existential.

The written agreement defining exactly what systems, networks, and methods are authorized for a penetration test. Essential to prevent misunderstanding and ensure the test is legally authorized and operationally safe.

An authorized simulated attack on a system to find vulnerabilities before real attackers do. A penetration tester ('pen tester') uses the same techniques as attackers but with explicit permission and a defined scope.

Legal exposure for individual executives when security obligations are neglected. Under NIS2, C-suite officers who approve non-compliant security programs can face personal fines of up to €10M.

Fraudulent messages impersonating trusted entities to steal credentials or install malware. The most common initial attack vector. Business Email Compromise (BEC) is a targeted phishing variant focused on financial fraud, costing organizations $2.9B annually (FBI 2023). By 2024, LLM-powered tools generate grammatically flawless, individually personalized spear-phishing referencing real colleagues and recent events, rendering traditional heuristics (grammar errors, suspicious tone) unreliable. IBM X-Force reports AI-generated phishing achieves 3 to 5× higher click rates than traditional templates.

Personally identifiable information: data that identifies a person, alone or combined with something else. The category matters because it is what triggers breach notification duties and what determines the size of a fine.

Public Key Infrastructure. A system of digital certificates and certificate authorities that establishes trust on the internet. TLS certificates, code signing, S/MIME email encryption, and client authentication all rely on PKI.

Cryptographic algorithms designed to be secure against future quantum computers. NIST finalized the first standards (FIPS 203, 204, 205) in 2024. Organizations should begin migration planning now because of 'Harvest Now, Decrypt Later' threats.

Post-Quantum Cryptography: algorithms believed to resist attack by a large quantum computer. The migration matters now because encrypted traffic captured today can be stored and decrypted later.

Post-Quantum Cryptography: algorithms believed to resist attack by a large quantum computer. The migration matters now because encrypted traffic captured today can be stored and decrypted later.

A data protection impact assessment: a documented analysis, required by GDPR Article 35 before high-risk processing, of what could go wrong for the people whose data it is. Done early it changes designs; done late it is paperwork attached to a decision already made.

The act of exploiting a vulnerability or misconfiguration to gain higher access privileges than originally authorized. Attackers use it to move from a low-privilege foothold to domain administrator control.

An attack against AI language model systems where malicious instructions embedded in external content (emails, documents, web pages) override or redirect an AI agent's intended behavior. In agentic AI systems with broad permissions, prompt injection can cause exfiltration, unauthorized actions, or privilege escalation. OWASP lists it as the top security risk for LLM applications.

The reference layering for industrial networks, from field devices at level 0 up to enterprise IT at levels 4 and 5, with the plant floor separated from the office. It is the map an OT security argument is usually drawn on, and 'flat network' means the map was never followed.

QR-code phishing. Attackers embed malicious URLs in QR codes delivered via email (including PDF attachments containing QR codes), printed lobby posters, replacement parking payment notices, and fake package delivery slips, physical materials that bypass every email security gateway. Widespread campaigns emerged in 2023, documented in the Hornetsecurity DACH Cyber Security Report 2024. The false-security problem is acute: organizations measuring a 9% phishing click rate (considered excellent) had no equivalent metric for QR code scanning, leaving a training gap invisible to their security programs. Standard phishing simulations do not include QR code scenarios, so click-rate improvements do not transfer to quishing resistance.

Ransomware as a Service. A criminal business model where ransomware developers license their tools and infrastructure to affiliates who conduct attacks in exchange for a share of ransom payments. LockBit, BlackCat/ALPHV, and Cl0P operated as RaaS groups.

Choosing to disclose more than the minimum, earlier than required, and in plain language. A reputational bet: it costs control of the story in the first hours and can buy credibility that a drip of corrections destroys.

The process of communicating with ransomware attackers, often through specialist negotiators, to reduce payment demands or obtain decryption keys. Legal in most jurisdictions but paying OFAC-sanctioned groups is illegal in the US.

Malware that encrypts victim data and demands payment for decryption. Modern ransomware uses double extortion, stealing data first, then encrypting it, to ensure leverage even if backups exist. RaaS groups operate as criminal franchises.

Ransomware as a Service. A criminal business model where ransomware developers license their tools and infrastructure to affiliates who conduct attacks in exchange for a share of ransom payments. LockBit, BlackCat/ALPHV, and Cl0P operated as RaaS groups.

Remote code execution: a flaw that lets an attacker run their own code on your system over the network, without needing an account. The most serious class of vulnerability, because it hands over control rather than merely leaking data.

Remote Desktop Protocol. A Microsoft protocol for remotely controlling another Windows computer. Widely exploited in ransomware attacks when exposed to the internet without MFA or proper access controls.

A group that simulates real-world attackers to test an organization's defenses. Goes beyond pen testing by using full attack scenarios including social engineering, physical access, and multi-stage intrusions.

The risk of fines, enforcement actions, or mandatory audits due to non-compliance. Under GDPR and NIS2, regulators can impose fines that are existential for mid-sized organizations.

Technologies enabling work outside office networks, VPN, Zero Trust Network Access (ZTNA), and RDP. The COVID-19 shift to remote work dramatically expanded remote access attack surface and accelerated Zero Trust adoption.

The convention by which a finder reports a vulnerability to the vendor and waits an agreed period before going public. It works only if the vendor answers, which is why a published disclosure policy is the other half of the arrangement.

General Data Protection Regulation. EU law (effective May 2018) governing the collection, processing, and storage of personal data. Fines up to €20M or 4% of global annual turnover. Applies to any organization processing EU residents' data.

The level of risk an organization is willing to accept before action is required. Set by the board. A low risk appetite means even small risks trigger investment; a high appetite means the organization accepts more exposure to reduce cost.

A structured evaluation of security risks: identifying threats, estimating their likelihood and impact, and determining what controls are needed. The output drives investment decisions and security roadmaps.

The systematic process of identifying, analyzing, evaluating, and treating risks to an acceptable level. In cybersecurity, risk management connects technical threats to business impact and drives investment decisions.

A formal document listing identified risks, their likelihood, potential impact, and current mitigation status. The foundation of defensible information security governance.

A Risk Management Framework. In the later years this is the NIST AI Risk Management Framework, which organises AI governance into Govern, Map, Measure and Manage, and gives a board a way to ask about AI risk without asking about model internals.

Record of Processing Activities. A document required under GDPR Article 30 mapping what personal data your organization holds, how it is used, who receives it, how long it is kept, and what security measures protect it.

Rivest–Shamir–Adleman: the long-standing public key algorithm behind much of today's encryption and signing. Its security rests on factoring being hard for classical computers, which is precisely the assumption a large quantum computer would break.

Recovery time objective: how long a system may be down before the harm is unacceptable. Paired with the recovery point objective, how much data you can afford to lose. Both are business decisions that are usually discovered, rather than decided, during an incident.

A safety instrumented system: the independent controls in an industrial plant whose only job is to bring the process to a safe state, for example shutting a valve before pressure becomes dangerous. Security work must not disturb it, because its failure mode is physical harm rather than downtime.

Security Assertion Markup Language: the older standard by which an identity provider tells an application that a user is who they claim. It underpins much enterprise single sign-on, which is why a compromised identity provider grants access to every application behind it at once.

A subject access request: an individual asking an organisation for a copy of the personal data it holds about them, a right under GDPR Article 15. Deadlines are short, and a poorly mapped data estate turns an ordinary request into a month of manual work.

Static Application Security Testing. Automated analysis of source code to find security vulnerabilities before the application is deployed. Part of DevSecOps and shift-left security practices.

Software Bill of Materials. A formal, machine-readable inventory of all components in a software product, including open-source libraries and their versions. Enables organizations to immediately identify exposure when a new vulnerability is disclosed.

Software composition analysis: tooling that inventories the open-source components inside an application and flags the ones with known vulnerabilities. It answers 'what are we built out of', which is the question a supply chain incident asks at short notice.

Supervisory Control and Data Acquisition. The control layer that monitors and commands industrial equipment. Much of it was designed before networks were hostile and assumes every message on the wire is legitimate.

A software development kit: a package of code a supplier ships so others can build against their service. It is code you did not write running inside your product, so an SDK compromise is a supply chain compromise.

Legal exposure for individual executives when security obligations are neglected. Under NIS2, C-suite officers who approve non-compliant security programs can face personal fines of up to €10M.

Misleading investors, including by understating a known cyber incident in a disclosure. It is the mechanism that turned a security decision into a personal legal exposure for executives, independent of any data protection fine.

A formal evaluation of an organization's security controls, policies, and practices against a standard (ISO 27001, NIST CSF, PCI DSS). Can be internal or by an independent third party. Results drive remediation roadmaps.

Training and culture-building programs that help employees recognize and respond to threats. Research consistently shows human behavior is the primary attack vector in over 80% of breaches.

The annual financial allocation for security programs, tools, personnel, and incident response. Gartner benchmarks suggest 5 to 15% of IT budget for mature organizations, but most SMEs spend far less.

The shared values, behaviors, and attitudes toward security within an organization. Strong security culture means employees report suspicious activity rather than ignore it. Built over years, not through annual training.

Quantitative measures of security program performance and risk level. Effective metrics translate technical data (MTTD, patch SLA compliance, phishing click rates) into business impact terms that boards can act on.

AI agents running with real permissions that no inventory records — spun up for a task, given a token, never retired. The 2020s version of shadow IT, with the difference that an agent acts continuously and does not notice its own scope creeping.

Organizational use of AI tools (ChatGPT, Claude, Gemini, Copilot) by employees without IT or security approval or oversight. Shadow AI parallels Shadow IT: employees use consumer AI to increase productivity, unknowingly uploading confidential data to services with permissive data retention terms. ENISA and ICO have both issued guidance on organizational AI tool governance.

Unauthorized software, cloud services, or devices used by employees without IT knowledge or approval. Bypasses security controls and creates data flows invisible to the organization. Remote work dramatically increased Shadow IT adoption.

Security Information and Event Management. A platform that collects, correlates, and analyzes security logs from across an organization's systems to detect threats. SIEM generates alerts for security analysts to investigate.

Social engineering of a mobile carrier to transfer a victim's phone number to an attacker-controlled SIM card, used to bypass SMS-based MFA and take over accounts. The Lapsus$ group combined SIM swapping with insider access at telco providers. Authenticator app or hardware key MFA is not vulnerable to SIM swapping; SMS-based MFA is.

A safety instrumented system: the independent controls in an industrial plant whose only job is to bring the process to a safe state, for example shutting a valve before pressure becomes dangerous. Security work must not disturb it, because its failure mode is physical harm rather than downtime.

Stateless Hash-Based Digital Signature Algorithm, standardised as FIPS 205. A slower post-quantum signature scheme built on hashing rather than lattices, kept as a conservative fallback for long-lived uses such as signing firmware and code.

Server Message Block: the Windows protocol for sharing files and printers across a network. Historically the route ransomware used to spread from one machine to a whole estate, which is why exposing it between network segments is treated as a serious finding.

Security Orchestration, Automation and Response. A platform that automates repetitive SOC tasks, alert triage, ticket creation, threat containment, freeing analysts for high-judgment work. Addresses alert fatigue.

Security Operations Center. A team (internal or outsourced) responsible for monitoring, detecting, and responding to security incidents around the clock. Uses SIEM, EDR, and threat intelligence to triage alerts.

Manipulating people into taking actions or revealing information that compromises security. Exploits psychology rather than technical vulnerabilities. Includes phishing, vishing, pretexting, and impersonation. Responsible for the majority of successful breaches.

Software Bill of Materials. A formal, machine-readable inventory of all components in a software product, including open-source libraries and their versions. Enables organizations to immediately identify exposure when a new vulnerability is disclosed.

Compromising software, hardware, or a trusted vendor to attack downstream targets. SolarWinds (2020), Log4Shell (2021), XZ Utils (2024), and Polyfill.io (2024) are landmark examples. The victim organization's defenses are bypassed because the attack enters through a trusted channel. Framework-level supply chain attacks affect every organization using that framework regardless of their own security posture. CVE-2025-55182 (React2Shell, CVSS 10.0), a critical vulnerability in React Server Components, affected all organizations running applications built on that framework, not just organizations with weak security programs.

A NIST Special Publication: the numbered guidance documents the US standards body issues, such as SP 800-53 on controls or SP 800-161 on supply chain risk. They are not law, but regulators and auditors treat them as the reference for what good practice looks like.

Software Package Data Exchange, an ISO-standardized format for a software bill of materials. Choosing a standard format is what makes an SBOM machine-readable across suppliers.

A targeted phishing attack personalizing content for a specific individual or organization using researched details (name, role, recent activities). Far more effective than generic phishing. Often the first step in APT intrusions.

Sender Policy Framework: a DNS record naming which mail servers may send on behalf of your domain. The first of the three email authentication controls, and on its own the weakest.

Structured Query Language: the language used to query databases. It appears here mainly in SQL injection, where input is passed into a query unchecked and an attacker rewrites the question the database is being asked.

Inserting malicious SQL code into a web form or API input to manipulate or extract database content. One of the oldest and most persistent web vulnerabilities. OWASP Top 10 fixture for two decades.

Secure Shell: the standard encrypted protocol for logging into a server remotely and running commands. Access is usually by cryptographic key rather than password, which makes a stolen or backdoored key equivalent to administrative access.

Secure Sockets Layer, the original protocol for encrypting traffic between a browser and a server. It is obsolete and replaced by TLS; the name survives in product names such as SSL-VPN, which is why an appliance can be called SSL and still be current.

Single sign-on: one login that grants access to many applications. It reduces password reuse and raises the stakes on that one login, which is why it belongs with strong authentication rather than instead of it.

Server-Side Request Forgery, an attack where an attacker causes a server to make HTTP requests to internal resources the attacker cannot directly reach. In cloud environments, SSRF against the instance metadata service can expose IAM credentials with broad permissions. The Capital One breach (2019) combined a misconfigured WAF with SSRF against AWS IMDS.

The integration of cybersecurity into long-term business planning. Treats security investment as a strategic risk management decision rather than a technical cost center.

Compromising software, hardware, or a trusted vendor to attack downstream targets. SolarWinds (2020), Log4Shell (2021), XZ Utils (2024), and Polyfill.io (2024) are landmark examples. The victim organization's defenses are bypassed because the attack enters through a trusted channel. Framework-level supply chain attacks affect every organization using that framework regardless of their own security posture. CVE-2025-55182 (React2Shell, CVSS 10.0), a critical vulnerability in React Server Components, affected all organizations running applications built on that framework, not just organizations with weak security programs.

Compromising software, hardware, or a trusted vendor to attack downstream targets. SolarWinds (2020), Log4Shell (2021), XZ Utils (2024), and Polyfill.io (2024) are landmark examples. The victim organization's defenses are bypassed because the attack enters through a trusted channel. Framework-level supply chain attacks affect every organization using that framework regardless of their own security posture. CVE-2025-55182 (React2Shell, CVSS 10.0), a critical vulnerability in React Server Components, affected all organizations running applications built on that framework, not just organizations with weak security programs.

A discussion-based simulation where stakeholders walk through a hypothetical security incident step by step. Tests response plans, exposes gaps, and builds team coordination without the cost of a live drill.

Accumulated shortcuts, legacy systems, and unpatched vulnerabilities that increase long-term security risk. High technical debt correlates directly with slower incident detection and higher breach probability.

Security risk introduced by external vendors, partners, cloud services, and suppliers who have access to your systems or data. A significant proportion of major breaches now originate through third-party access rather than direct attack.

Analyzed information about current and emerging threats, attacker tactics, techniques, indicators of compromise, that helps defenders prioritize their defenses. Feeds into SIEM and SOAR platforms for automated detection.

A structured analysis of a system to identify potential threats, their likelihood, and mitigations. Conducted during design phases so security is built in rather than added later. Common frameworks: STRIDE, PASTA, LINDDUN.

Traffic Light Protocol. Four labels — CLEAR, GREEN, AMBER, RED — that tell a recipient how far shared information may travel. AMBER+STRICT means the recipient's own organization only.

Transport Layer Security. The cryptographic protocol securing data in transit across the internet. HTTPS uses TLS to encrypt web traffic. TLS 1.3 is the current standard; older versions (SSL, TLS 1.0, TLS 1.2) have known vulnerabilities.

Third-party risk management: the practice of assessing and monitoring the security of suppliers, because their weaknesses become yours the moment you connect to them. Annual questionnaires are the common form and the weakest one, since they describe a supplier on one day of the year.

A structured set of commitments about how an organisation builds and buys AI — what it will not automate, what a human must approve, what it will disclose. In this course it is the artefact a board asks for once AI stops being a pilot.

Registering a name one keystroke away from a real one — a domain, or a package in a public registry — and waiting for the mistake. In supply chain terms it means a single typo in a dependency file can pull an attacker's code into your build.

User acceptance testing: a staging environment where changes are tried before production. In security work it is where firewall and segmentation changes are proven not to break the business, since the alternative is finding out at the same time as customers.

User and Entity Behavior Analytics. Builds a baseline of normal behavior per account and device, then flags departures from it. The usual approach to insider risk, and the usual source of false positives.

A vulnerability disclosure policy: a published route for outsiders to report a security flaw, plus a commitment on how the organisation will respond. Without one, a finder either stays silent or goes public, and neither outcome is the one you want.

The process of identifying, assessing, and mitigating security risks introduced by third-party suppliers, cloud providers, and partners. Required under NIS2. The SolarWinds breach demonstrated the catastrophic potential of vendor trust.

Voice phishing. Social engineering attacks conducted via phone calls. AI voice cloning now enables attackers to convincingly impersonate executives, family members, or IT support with only a few seconds of voice sample.

A virtual local area network: a way of splitting one physical network into separate logical ones, so devices in one segment cannot reach another by default. The cheapest form of network segmentation, and the reason a compromised camera need not reach a payment server.

AI-generated synthetic media, video, audio, or images, that convincingly impersonates a real person. Created using generative adversarial networks or diffusion models trained on publicly available recordings. In security: used for CEO fraud (deepfake voice calls), FIMI campaigns, and identity verification bypass. Detection tools exist but lag behind generation capability.

A state-linked group reported to have pre-positioned quietly inside critical infrastructure networks, using living-off-the-land techniques and holding access rather than acting on it. Cited here as the reason 'we have seen no damage' is not the same as 'we have no intruder'.

Virtual Private Network. Encrypts network traffic between a device and a corporate network, protecting data in transit. During COVID-19 remote work, VPN became critical infrastructure, and a major attack target when credentials were stolen.

The continuous process of identifying, classifying, prioritizing, remediating, and verifying software vulnerabilities. CISA's Known Exploited Vulnerabilities (KEV) catalog provides the most actionable prioritization data.

A web application firewall: a filter in front of a web application that inspects requests and blocks ones matching known attack patterns. It buys time when a vulnerability cannot be patched immediately, which is why regulators treat 'a WAF rule was available and not deployed' as a hard question after an incident.

A 2017 ransomware attack that spread globally using the EternalBlue exploit (an NSA tool leaked by Shadow Brokers). Hit 200,000+ systems in 150 countries in a single day. The UK NHS canceled 19,000 appointments as a result.

Windows Server Update Services: the Microsoft service through which an organisation approves and distributes patches internally. It is also a distribution channel an attacker would very much like to own.

Extended Detection and Response. An evolution of EDR that correlates data across endpoints, network, email, cloud, and identity systems in a single platform. Reduces alert fatigue by connecting signals across the whole environment.

Cross-site scripting: injecting script into a page that other users then load, so the attacker's code runs in their browser with their session. Used to steal session tokens, which is how an attack can bypass a login without ever knowing a password.

A 2024 near-miss in which an attacker spent two years earning maintainer trust in a widely used Linux compression library and inserted a backdoor, caught by an engineer who noticed an unexplained half-second login delay. The case study for social attacks on open-source maintainership.

A security model based on 'never trust, always verify'. No user, device, or network is trusted by default, even inside the corporate perimeter. Every access request is authenticated, authorized, and logged.

A vulnerability that is unknown to the vendor and has no available patch. 'Zero days' refers to the time the vendor has to fix it before exploitation. Zero-days are extremely valuable to attackers and are traded on criminal and government markets. CVSS score alone does not determine response urgency, active exploitation status does. A CVSS 8.2 actively exploited zero-day (CVE-2024-53704, SonicWall SSL-VPN) requires faster response than a CVSS 9.5 theoretical vulnerability with no known exploits. Organizations that filter their patch response by CVSS score without considering exploitation status systematically misprioritize.

Zero Trust Network Access. Grants access to one named application after checking user and device, instead of putting a device on the network the way a VPN does.