Glossary
Security terms, defined plainly
The vocabulary that turns up in assessment reports, audit findings and vendor proposals — written out once, without the marketing. Each term links to the service where we do that work.
Autonomous SOC
also AI-driven or AI-native security operations
- A security operations model in which AI performs the first pass of triage and investigation and analysts review the result and decide. The term is used loosely by vendors: nearly every real deployment still keeps a person in the loop before anything is contained, so the useful question is which decisions have actually been delegated, not whether the label fits.
Cloud misconfiguration
- A cloud resource left in a state that exposes it — storage readable by anyone, a role granted far more than it needs, a management port open to the internet. It is a configuration error rather than a software flaw, which is why it carries no CVE and has no patch: it is found by reviewing settings, not by scanning for versions.
Configuration management plan
- The document that states how a system’s configuration is defined, changed and verified — what the approved baseline is, who may depart from it, and how drift is detected. Auditors ask for it because most of the controls they go on to test are configuration settings that somebody is able to change.
CVE
Common Vulnerabilities and Exposures
- A public identifier assigned to one specific vulnerability in one specific product, written as CVE-2026-12345. It exists so that two parties discussing a flaw can be certain they mean the same one. The identifier carries no severity of its own — that is what CVSS is for.
CVSS
Common Vulnerability Scoring System
- A method for expressing how severe a vulnerability is on a scale to ten, derived from how it can be reached and what it yields. The base score describes the flaw in isolation and deliberately knows nothing about your environment, so a high score is a reason to assess rather than a statement of your risk.
DSPM
Data Security Posture Management
- Tooling that discovers where data actually lives across cloud services, classifies it, and reports who is able to reach it. It answers the question an asset inventory misses: not which systems exist, but which of them hold something that would matter if it leaked.
ISMS
Information Security Management System
- The documented set of policies, roles, risk decisions and review cycles through which an organisation manages security. ISO/IEC 27001 certifies the management system rather than the technology, which is why an ISMS consists mostly of recorded decisions and evidence that they were reviewed.
MDR
Managed Detection and Response
- A service that supplies the detection and response capability of a SOC without the client building one. The provider monitors telemetry, investigates what the tooling raises, and either contains the threat directly or hands over a verified incident with the evidence already assembled.
MSSP
Managed Security Service Provider
- The older outsourcing model, in which a provider manages security devices — firewalls, gateways, sometimes a SIEM — and forwards what they raise. The practical difference from MDR is where the work stops: an MSSP typically passes an alert on, while MDR is expected to investigate it and act.
MTTD
Mean Time to Detect
- The average time between a compromise beginning and the defenders noticing it. It should be measured from the earliest evidence found afterwards rather than from the first alert, because an intrusion that generated no alert at all still has to count against the number.
MTTR
Mean Time to Respond
- The average time between detecting a threat and containing it. The same abbreviation is also used for mean time to recover, which measures something different — the return to normal service — so a reported figure is only meaningful once it says which of the two it is.
OSINT
Open Source Intelligence
- Intelligence assembled from sources anyone can reach: public registries, breached credential dumps, code repositories, social platforms and criminal forums. Used defensively, it establishes what an attacker could learn about an organisation before touching anything the organisation owns.
OT security
Operational Technology security
- The security of systems that run physical processes — production lines, building services, energy and water. It differs from IT security mainly in its constraints: equipment can have a service life measured in decades, patching may mean stopping production, and availability usually outranks confidentiality.
OWASP Top 10 for LLM Applications
- A community-maintained list of the most significant security risks specific to applications built on large language models — prompt injection, insecure handling of model output, training-data poisoning and related failures. It is a checklist to review a design against, not a standard anybody certifies against.
Purple team
- An exercise in which the attacking side and the defending side work together in the same room instead of against each other. The attackers narrate each technique as they run it and the defenders check whether their tooling saw it, so the output is a list of detection gaps rather than a win or a loss.
SIEM
Security Information and Event Management
- A platform that collects log and event data from across an estate, normalises it into a common shape, and runs detection rules against it. A SIEM is where detection logic lives and where an investigation is reconstructed; it does not decide anything or act by itself.
SOAR
Security Orchestration, Automation and Response
- Tooling that carries out the repeatable parts of a response — enriching an alert, isolating a host, raising a ticket — so that analyst time goes on judgement rather than on steps. It is normally deployed alongside a SIEM rather than instead of one.
SOC
Security Operations Centre
- The people, process and tooling that watch an organisation’s systems for signs of attack and respond when they find one. A SOC may be staffed in-house, bought as a service, or run as a hybrid in which an external team covers nights and weekends. What makes it a SOC rather than a monitoring product is the escalation path behind the alerts.
VAPT
Vulnerability Assessment and Penetration Testing
- Two activities usually bought together. The assessment enumerates known weaknesses across an agreed scope, largely through automated scanning; the penetration test has a tester attempt to exploit them and chain them into something worse. The assessment tells you what is exposed, the test tells you what an attacker could do with it.
Zero trust
- An architectural principle: no request is trusted on account of where it came from. Every access decision is taken at the point of use against identity, device state and context, rather than being inherited from having already reached the inside of a network.
Where we do this: Managed Detection & Response
Where we do this: Cybersecurity Advisory
Where we do this: Implementation Services
Where we do this: Vulnerability Alerts
Where we do this: Vulnerability Alerts
Where we do this: Cybersecurity Advisory
Where we do this: Compliance Frameworks
Where we do this: Managed Detection & Response
Where we do this: Managed Detection & Response
Where we do this: Managed Detection & Response
Where we do this: Managed Detection & Response
Where we do this: Digital Risk Protection
Where we do this: Incident Response
Where we do this: Implementation Services
Where we do this: Implementation Services
Where we do this: Managed Detection & Response
Where we do this: Implementation Services
Not sure which of these applies to you?
Tell us what is being asked of you — by an auditor, a customer, or your own board — and we will say which of these matters for your situation and which does not.