Cybersecurity Concepts & Terminology

A foundational, vendor-neutral reference to the core concepts, technologies, and threats that make up cybersecurity — the "what is it" layer beneath the market and deal analysis in the rest of this wiki. Definitions are original and written in plain terms for a business reader; they are organized into eight domains. For finance and deal acronyms, see Glossary; for how these categories are bought, sold, and consolidated, follow the cross-links into the segment pages.

Core concepts

Cybersecurity — the practice of protecting systems, networks, data, and identities from unauthorized access, disruption, or theft. As a discipline it spans people, process, and technology; as an industry it is analyzed throughout this wiki as an economy (see Overview).

The CIA triad — the three properties security aims to preserve: confidentiality (only authorized parties can read data), integrity (data is not altered without authorization), and availability (systems and data are accessible when needed).

Threat, vulnerability, risk — a threat is a potential cause of harm (an actor or event); a vulnerability is a weakness that a threat can exploit; risk is the combination of how likely exploitation is and how much damage it would do. Security programs manage risk, not just vulnerabilities.

Attack surface — the sum of all points where an attacker could try to enter or extract data (exposed services, accounts, devices, applications, third parties). Reducing and monitoring it is a central goal; attack surface management (ASM) is the discipline of discovering and tracking it.

Defense in depth — layering multiple, independent controls so that the failure of any one does not lead to compromise. The opposite of relying on a single perimeter.

Least privilege — granting any user, device, or workload only the access it needs to do its job, and no more. Limits the "blast radius" if an account is compromised.

Zero Trust — a security model that assumes no user, device, or request is inherently trusted, even inside the network. Every access request is continuously verified against identity, device posture, and context, and granted at least privilege. It is an architecture and strategy, not a single product (related: ZTNA, below).

Encryption — encoding data so only holders of a key can read it, protecting it at rest (in storage) and in transit (moving across a network). Post-quantum cryptography refers to algorithms designed to resist future quantum-computer attacks (see Post-Quantum Migration).

Authentication vs. authorization — authentication verifies who (or what) you are; authorization decides what you are allowed to do. Multi-factor authentication (MFA) strengthens the first by requiring two or more independent proofs (something you know, have, or are).

Signature-based vs. behavior-based detection — signature methods match known-bad patterns (a specific malware fingerprint); behavior/anomaly methods flag activity that deviates from normal, catching novel attacks at the cost of more false positives. Modern tools combine both.

Network security

Firewall — a control that filters traffic between networks based on rules. Generations range from simple packet filters and stateful firewalls to next-generation firewalls (NGFW) that add application awareness, intrusion prevention, and threat inspection.

IDS / IPS — an intrusion detection system alerts on suspicious network activity; an intrusion prevention system also blocks it inline.

VPN — a virtual private network creates an encrypted tunnel over a public network, historically used for remote access. Increasingly replaced by ZTNA for granular, per-application access.

Network segmentation / microsegmentation — dividing a network into zones so a compromise in one cannot spread freely; microsegmentation applies this at the level of individual workloads.

Secure web gateway / URL filtering — inspects and controls users' web traffic, blocking malicious or disallowed sites and content.

DNS security — protecting the domain name system, which attackers abuse for command-and-control and data theft (see DNS tunneling under Threats).

DDoS — a distributed denial-of-service attack overwhelms a system with traffic from many sources to make it unavailable; DDoS protection absorbs or filters that traffic.

NAC — network access control enforces policy on which devices may connect to a network and under what conditions.

SASE / SSE / ZTNA — Secure Access Service Edge converges networking and security into a cloud-delivered service; Security Service Edge is its security half; Zero Trust Network Access grants per-application access based on verified identity and context rather than network location (see Go-to-Market & Channels for how these are sold).

Cloud security

Shared responsibility model — in cloud computing the provider secures the underlying infrastructure while the customer secures its own data, identities, configurations, and applications. Most cloud breaches stem from customer-side misconfiguration, not provider failure.

IaaS / PaaS / SaaS — cloud service models: Infrastructure (raw compute/storage/network), Platform (managed runtime for building apps), and Software (finished applications delivered over the web). Each shifts more responsibility to the provider.

CSPM — cloud security posture management continuously checks cloud configurations against best practices and compliance rules, flagging misconfigurations.

CWPP — cloud workload protection platform secures the running workloads themselves (VMs, containers, serverless).

CNAPP — cloud-native application protection platform consolidates CSPM, CWPP, and related tools into one platform covering cloud apps from code to runtime (see Data Security and cloud segment pages).

CIEM — cloud infrastructure entitlement management governs the sprawl of permissions across cloud accounts, enforcing least privilege.

DSPM — data security posture management discovers and classifies sensitive data across environments and quantifies its exposure.

CASB — cloud access security broker sits between users and cloud apps to enforce security and compliance policy on SaaS usage.

WAF — a web application firewall filters and monitors HTTP traffic to protect web apps from attacks such as injection and cross-site scripting.

Container & Kubernetes security — securing containerized applications and their orchestration, covering images, registries, runtime behavior, and cluster configuration.

CDR — cloud detection and response focuses on detecting and responding to active threats in cloud environments in real time.

Endpoint & security operations (SecOps)

Endpoint / EPP — an endpoint is any device that connects to a network (laptop, server, phone); endpoint protection platform is the preventive software that runs on it (the modern successor to antivirus).

EDR / XDR — endpoint detection and response records endpoint activity to detect, investigate, and respond to threats; extended detection and response correlates signals across endpoint, network, cloud, and identity for a unified view.

SIEM — security information and event management centralizes logs and events from across the environment for correlation, alerting, and compliance reporting.

SOAR — security orchestration, automation, and response automates repetitive investigation and response steps through playbooks, reducing analyst load.

SOC — a security operations center is the team (and tooling) that monitors, detects, and responds to threats, often 24/7. The SOC is the most labor-intensive cost center in security, which is why automation and AI target it directly (see AI Security).

MDR / MSSP — managed detection and response and managed security service providers deliver SOC capability as an outsourced service — the core of the security services economy (see MDR and VAR/SI/MSP).

Threat hunting — proactively searching for undetected threats in an environment rather than waiting for alerts.

Vulnerability management — the ongoing cycle of discovering, prioritizing, and remediating weaknesses. As discovery is automated by AI, prioritization — deciding which findings actually matter — becomes the bottleneck.

Incident response (IR) — the structured process of preparing for, containing, eradicating, and recovering from a security incident, followed by lessons learned (see Incident Response).

MITRE ATT&CK — a widely used, freely available knowledge base of real-world attacker tactics and techniques, used to describe, detect, and test defenses.

Identity security

IAM — identity and access management is the framework for managing digital identities and controlling their access to resources.

SSO — single sign-on lets a user authenticate once and access many applications, improving usability and centralizing control.

PAM — privileged access management secures, monitors, and controls the powerful accounts (administrators, root, service accounts) that attackers prize most.

IGA — identity governance and administration manages the lifecycle of identities and entitlements — provisioning, access reviews, and compliance certification.

Identity lifecycle management — automating the joiner-mover-leaver process so access is granted, changed, and revoked as roles change, closing the gap of orphaned accounts.

CIAM — customer identity and access management handles authentication and profile management for external users (customers) at scale, balancing security with user experience.

Machine / non-human identity (NHI) — identities belonging to workloads, services, devices, and increasingly AI agents rather than people. They now vastly outnumber human identities and are a fast-growing security gap (see Identity and MCP & Agent Identity).

Workload identity — the identity and credentials a running application or service uses to authenticate to other systems, central to securing cloud and microservice architectures.

Secrets management — securely storing and controlling access to credentials, API keys, tokens, and certificates that applications use, rather than hard-coding them.

ITDR — identity threat detection and response monitors identity systems for attacks such as credential misuse, privilege escalation, and account takeover.

Threats

Malware — malicious software, an umbrella term covering viruses (attach to files), worms (self-propagate), trojans (masquerade as legitimate software), spyware, and more.

Ransomware / RaaS — malware that encrypts a victim's data and demands payment for the key, often paired with data theft and extortion. Ransomware-as-a-service is the criminal business model in which operators lease their toolkit to affiliates for a cut (see Ransomware-as-a-Service).

Phishing / spear phishing / BEC — fraudulent messages that trick recipients into revealing credentials or running malware. Spear phishing targets specific individuals; business email compromise impersonates trusted parties to redirect payments or data (see BEC & Social Engineering).

Social engineering — manipulating people rather than technology to gain access — pretexting, baiting, impersonation, and help-desk deception.

Command and control (C2) — the channel an attacker uses to communicate with and direct compromised machines after intrusion.

Lateral movement — techniques attackers use to move from an initial foothold to other systems in pursuit of higher-value targets.

APT — an advanced persistent threat is a well-resourced adversary (often nation-state) that maintains long-term, stealthy access to a target (see Nation-State APTs).

Zero-day — a vulnerability unknown to the vendor (and thus unpatched) at the time it is exploited, leaving defenders no lead time.

Supply-chain attack — compromising a trusted vendor, software update, or dependency to reach that vendor's many downstream customers at once.

Insider threat — risk from people with legitimate access — malicious, negligent, or compromised.

Initial access broker (IAB) — a criminal specialist that breaks into organizations and sells that access to others, such as ransomware affiliates (see Initial Access Brokers).

DNS tunneling — smuggling data or command-and-control traffic inside DNS queries to evade controls that overlook DNS.

AI and cybersecurity

Two directions matter and are often confused (see AI Security and Core Concepts).

AI for security — using AI to improve defense: accelerating threat detection, triage, investigation, and response, and increasingly running as autonomous "agentic" workflows in the SOC. Value shifts toward whoever owns the data and workflow the models run on (see AI for Security).

Security for AI — protecting AI systems themselves: the models, the data, the applications, and the agents. A new budget line with no established incumbent.

Adversarial AI / attacks on ML — techniques that manipulate machine-learning systems — evasion (crafted inputs that fool a model), data poisoning (corrupting training data), and model extraction/inversion.

Prompt injection — hiding instructions in content an AI agent reads (a document, ticket, or web page) to hijack its behavior — the signature attack against language-model applications and agents.

Jailbreak — prompting a model to bypass its safety guardrails.

AI-SPM — AI security posture management discovers an organization's AI usage, models, and data pipelines and flags misconfiguration and exposure.

AI governance — the policies and controls ensuring AI is used safely, legally, and ethically — inventory, risk assessment, monitoring, and accountability (see AI Security Standards).

Data poisoning / model provenance — poisoning corrupts a model via manipulated training data; provenance is the practice of tracking a model's and data's origin and integrity to counter it.

Compliance and governance

Regulation is a primary demand engine for security spending (see Regulation).

GRC — governance, risk, and compliance, the discipline (and tooling) for managing policies, assessing risk, and demonstrating adherence to requirements.

GDPR — the EU's General Data Protection Regulation, governing personal-data privacy with significant penalties for violations.

HIPAA — US law setting privacy and security requirements for protected health information.

PCI DSS — the Payment Card Industry Data Security Standard for organizations that handle payment-card data.

SOC 2 — an attestation report on a service organization's controls for security, availability, processing integrity, confidentiality, and privacy — commonly requested of software vendors.

ISO/IEC 27001 — an international standard for establishing and certifying an information-security management system (ISMS).

NIST Cybersecurity Framework — a widely adopted, voluntary US framework organizing security activities into core functions (Govern, Identify, Protect, Detect, Respond, Recover).

SBOM — a software bill of materials, an inventory of the components in a piece of software, used to manage supply-chain and vulnerability risk.

Certifications as moats — regimes such as FedRAMP (US government cloud) and CMMC (US defense contractors) turn compliance into a gate for market access, a recurring theme in how regulation shapes demand (see Certifications as Moats).

This reference defines concepts in original, vendor-neutral terms; it names no specific vendor's products. For the business dynamics behind each category — who builds it, who buys it, and how it consolidates — follow the cross-links into the segment and capital pages.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.