Resources
Cybersecurity Glossary
Plain-language definitions for security, threat-intelligence, and dark web terminology, curated by the SOCRadar research team.
A
A
Advanced Persistent Threat (APT)
APT groups conduct targeted, long-term operations for espionage, theft, or disruption. Learn their lifecycle, key warning signs, detection, and defenses.
→
A
Adware
Adware displays unwanted advertising and may track users, redirect browsers, or install software. Learn its warning signs, risks, removal, and prevention.
→
A
Agentic Threat Detection
Agentic threat detection uses autonomous AI agents to find, judge, and act on threats. See how agentic AI for threat detection works, where it fits, and how to apply it safely…
→
A
Agentic Threat Intelligence (ATI)
Agentic Threat Intelligence (ATI) is threat intelligence carried out by autonomous AI agents that pursue a goal rather than follow a fixed playbook….
→
A
AI Adoption
AI adoption in cybersecurity improves detection and triage when teams start with clear use cases, governed data, measurable outcomes, and human oversight.
→
A
AI Adoption Barriers Cybersecurity
Understand the main AI adoption barriers in cybersecurity, from poor data and integration gaps to governance, skills, trust, cost, and security risks.
→
A
AI Brand Protection
AI brand protection uses automation and analysis to detect impersonation, phishing, counterfeit activity, and harmful brand abuse across digital channels.
→
A
AI Development Lifecycle
The AI development lifecycle covers planning, data, development, validation, deployment, monitoring, and retirement with security at every stage.
→
A
AI Hallucinations
AI hallucinations are plausible but unsupported outputs. Learn why they occur, how they affect cybersecurity, and how grounding and review reduce risk.
→
A
AI Prompt Security
AI prompt security protects instructions, data, tools, and outputs from prompt injection, leakage, jailbreaks, insecure actions, and poisoned context.
→
A
AI Threat Detection
AI threat detection applies machine learning, language models, and automated reasoning to identify, correlate, and prioritize suspicious security activity.
→
A
Antidetect Browsers
Antidetect browsers alter device fingerprints to manage multiple identities and evade fraud controls. Learn common uses, detection signals, and defenses.
→
A
API Attack
API attacks target authentication, authorization, data, and business logic. Learn common attacks, warning signs, testing priorities, and defenses.
→
B
B
Backdoor Attack
Backdoor attacks create hidden access that bypasses normal controls. Learn how backdoors work, where they persist, how to detect them, and how to respond.
→
B
Black Box AI
Black box AI describes an artificial-intelligence system whose internal reasoning cannot be fully inspected or reliably explained, even when its inputs an.
→
B
Botnet
A botnet is a network of compromised devices controlled for DDoS, fraud, spam, malware delivery, or proxying. Learn its lifecycle, signs, and defenses.
→
B
Business Email Compromise (BEC)
Business email compromise uses impersonation or account takeover to redirect payments and steal data. Learn warning signs, response, and prevention. now.
→
C
C
CAASM
Cyber Asset Attack Surface Management (CAASM) consolidates asset data from existing security and IT systems to create a normalized view of devices, identi.
→
C
Carding Fraud
Carding fraud tests and uses stolen payment-card data for purchases, resale, or cash-out. Learn attack methods, warning signs, impact, and defenses. now.
→
C
Cashout (Cybercrime)
Cybercrime cashout converts stolen access, data, or funds into usable value. Learn common methods, participants, warning signs, and defensive controls.
→
C
Clear Web
The clear web contains public pages indexed by standard search engines. Learn how it differs from the deep and dark web and why security teams monitor it.
→
C
Cloud-Native Application Protection Platforms (CNAPP)
A Cloud-Native Application Protection Platform (CNAPP) combines cloud security capabilities across development, deployment, posture, identities, workloads.
→
C
Cloud Incident Response
Cloud incident response is the coordinated process of detecting, containing, investigating, eradicating, and recovering from security incidents in cloud e.
→
C
Cloud Infrastructure Security
Cloud infrastructure security protects cloud identities, networks, workloads, data, management planes, and configurations from unauthorized access, misuse.
→
C
Cloud Network Firewall
A cloud network firewall controls network traffic between cloud resources, networks, users, and external destinations according to defined security policy.
→
C
Cloud Security
Cloud security is the set of people, processes, and technologies used to protect cloud identities, data, applications, workloads, networks, and management.
→
C
Cloud Security Gateway
A cloud security gateway is a policy-enforcement layer that inspects and controls access between users, devices, applications, cloud services, and the int.
→
C
Cloud Security Posture Management (CSPM)
Cloud Security Posture Management (CSPM) continuously discovers cloud resources and evaluates their configurations against security, compliance, and organ.
→
C
Computer Worm
Computer worms spread automatically across systems and networks. Learn how worms propagate, the damage they cause, warning signs, response, and prevention.
→
C
Credential Stuffing
Credential stuffing uses stolen username and password pairs against other services. Learn the attack process, warning signs, impact, and defenses.
→
C
Cross-Site Request Forgery (CSRF)
Cross-site request forgery tricks an authenticated browser into sending an unwanted request. Learn CSRF mechanics, impact, testing, and prevention.
→
C
Cryptojacking
Cryptojacking hijacks devices or cloud resources to mine cryptocurrency. Learn infection paths, warning signs, business impact, response, and prevention.
→
C
Cyber Attack
A cyber attack attempts to disrupt systems, steal data, commit fraud, or gain unauthorized access. Learn common types, lifecycle stages, and defenses.
→
C
Cybercriminal
Cybercriminals use digital systems for theft, fraud, extortion, and unauthorized access. Learn actor types, motivations, tactics, and practical defenses.
→
C
Cyber Espionage
Cyber espionage uses covert digital operations to steal sensitive intelligence. Learn its lifecycle, targets, warning signs, and defensive controls. today.
→
C
Cyber Fusion Center
A cyber fusion center integrates security operations, threat intelligence, fraud, risk, incident response, and relevant business teams around shared data.
→
C
Cybersecurity
Cybersecurity protects systems, networks, applications, identities, and data from unauthorized access, misuse, disruption, alteration, and destruction. Le.
→
C
Cybersecurity Platformization
Cybersecurity platformization consolidates related security capabilities, data, policy, and workflows into a smaller number of integrated platforms. Learn.
→
C
Cybersecurity Sandbox
A cybersecurity sandbox is an isolated environment used to execute or inspect suspicious files, URLs, scripts, documents, and code without exposing produc.
→
D
D
Darknet
A darknet is an overlay network designed for restricted or anonymous communication. Learn darknets, legitimate uses, risks, and security monitoring. now.
→
D
Dark Web
The dark web uses overlay networks and specialized software to host hidden services. Learn legitimate uses, cybercrime risks, access, and monitoring. now.
→
D
Dark Web Monitoring
Dark web monitoring finds credentials, leaked data, access sales, and attack signals. Learn collection, validation, response, and integration practices.
→
D
Dark Web Scan
A dark web scan checks available breach and criminal-source data for exposed domains, emails, and credentials. Learn its limits, results, and next steps.
→
D
Data Breach
A data breach exposes protected information to unauthorized access or disclosure. Learn common causes, warning signs, response steps, and prevention. now.
→
D
Data Broker
Data brokers collect, combine, and sell information about people or organizations. Learn common data sources, uses, privacy risks, and protective steps.
→
D
Data Integrity
Data integrity is the accuracy, completeness, consistency, and trustworthiness of data throughout its creation, storage, processing, transmission, and use.
→
D
Data Lake
A data lake is a centralized repository designed to store large volumes of structured, semi-structured, and unstructured data in its original or lightly p.
→
D
Data Loss Prevention (DLP)
Data Loss Prevention (DLP) is a set of policies and controls that discovers, classifies, monitors, and restricts sensitive data at rest, in motion, and in.
→
D
Data Masking
Data masking replaces or obscures sensitive values so people and systems can use a dataset without seeing the original information. Learn the risks, warni.
→
D
Deepfakes
Deepfakes use synthetic or manipulated audio, video, and images to impersonate people. Learn fraud risks, detection limits, response, and prevention. now.
→
D
Deep Web
The deep web includes online content not indexed by standard search engines, such as accounts, databases, and private portals. Learn its uses and risks.
→
D
Device Fingerprinting
Device fingerprinting uses browser, hardware, network, and behavior signals to recognize devices. Learn security use, evasion, privacy risks, and controls.
→
D
Digital Asset Management
Digital asset management organizes and governs media, documents, and brand files. Learn its core functions, security risks, workflows, and controls. now.
→
D
Digital Footprint
A digital footprint is the data and exposure created by online activity, accounts, devices, and services. Learn its types, risks, discovery, and reduction.
→
D
Digital Forensics
Digital forensics identifies, preserves, collects, examines, and reports digital evidence in a defensible and repeatable manner. Learn the primary risks.
→
D
Digital Risk Management
Digital risk management identifies, assesses, treats, and monitors risks created by digital assets, services, identities, data, suppliers, and external ex.
→
D
DNS Leak Test
A DNS leak test checks whether your DNS queries are exposed while a VPN is active. Learn how leaks happen and how to fix them…
→
D
DNS Monitoring
DNS monitoring collects and analyzes domain-name queries, responses, records, infrastructure, and changes to detect security threats, configuration proble.
→
D
DNS Server
A Domain Name System (DNS) server answers or forwards queries that map domain names to records such as IP addresses, mail servers, and service locations.
→
D
Doxxing
Doxxing exposes personal information without consent to harass, intimidate, or enable harm. Learn common methods, warning signs, response, and prevention.
→
E
E
E-Skimming
E-skimming steals payment data from online checkout pages. Learn how Magecart attacks work, warning signs, incident response, and defensive controls. now.
→
E
Endpoint Security
Endpoint security protects laptops, desktops, servers, mobile devices, and other connected systems from compromise, misuse, and data loss. Learn the prima.
→
E
Enumeration in Cybersecurity
Enumeration actively queries systems for users, services, shares, and resources. Learn common methods, warning signs, risks, and defensive controls. today.
→
E
Exploit Kit
Exploit kits automate vulnerability testing and malware delivery through web traffic. Learn their attack flow, warning signs, risks, and prevention. today.
→
E
External Attack Surface Management (EASM)
External Attack Surface Management (EASM) continuously discovers, validates, monitors, and helps reduce internet-facing assets and exposures from an attac.
→
E
External Cybersecurity
External cybersecurity protects an organization against risks visible or originating beyond its controlled internal environment. Learn the primary risks.
→
E
Extranet Access Control
Extranet access control governs how external parties such as suppliers, customers, contractors, and partners reach selected organizational resources. Lear.
→
F
F
Firewall
A firewall evaluates network traffic against security policy and allows, blocks, rejects, or records connections between systems or trust zones. Learn the.
→
F
Firewall-as-a-Service (FWaaS)
Firewall as a Service (FWaaS) delivers firewall inspection and policy enforcement through a cloud-based service rather than relying only on appliances at.
→
G
G
GoldDigger (GoldFactory Android Trojan)
GoldDigger is an Android banking trojan linked to the GoldFactory family. Learn its delivery, capabilities, warning signs, response, and prevention. today.
→
G
Google Dorks
Google dorking uses advanced search operators to locate exposed files, pages, and systems. Learn common uses, security risks, monitoring, and prevention.
→
H
H
Hacktivism
Hacktivism uses digital attacks or disruption to advance political or social causes. Learn common tactics, warning signs, risks, and defensive steps. now.
→
H
Hardware Firewall
A hardware firewall is a dedicated physical appliance that inspects and controls traffic between networks or security zones. Learn the primary risks, warn.
→
H
Honeypots
A honeypot is a decoy system, service, account, file, or resource designed to attract unauthorized activity and produce high-value detection and research.
→
I
I
Identity And Access Management (IAM)
Identity and Access Management (IAM) ensures that the right human and machine identities receive appropriate access to resources for an authorized purpose.
→
I
Incident Response Plan
An incident response plan defines how an organization prepares for, detects, assesses, contains, eradicates, and recovers from cybersecurity incidents. Le.
→
I
Indicators of Compromise (IoCs)
Indicators of Compromise (IOCs) are observable artifacts that may show malicious activity or a security breach. Learn the primary risks, warning signs, us.
→
I
Insider Threats
Insider threats involve trusted access used maliciously, negligently, or after compromise. Learn common types, indicators, response, and prevention. today.
→
K
K
Kerberoasting Attack
Kerberoasting targets Active Directory service accounts by cracking Kerberos tickets offline. Learn the attack steps, warning signs, and best defenses.
→
K
Keyloggers
Keyloggers record keyboard input to steal credentials and sensitive data. Learn software and hardware types, warning signs, response steps, and prevention.
→
K
Kill Switch
A kill switch is a control that rapidly stops, disables, isolates, or limits a system, process, connection, credential, or operation when a defined risk c.
→
L
L
LAN (Local Area Network)
A Local Area Network (LAN) connects devices within a limited area such as a home, office, school, branch, or data-center segment. Learn the primary risks.
→
L
Loader
Malware loaders establish access and deliver additional payloads. Learn how loaders work, common techniques, warning signs, investigation, and prevention.
→
M
M
Magecart
Magecart attacks compromise online checkout flows to steal payment data. Learn access paths, skimming methods, warning signs, response, and prevention.
→
M
Malvertising
Malvertising abuses online ads to redirect users, deliver malware, or support fraud. Learn techniques, warning signs, response, and prevention steps. now.
→
M
Malware
Malware is software designed to steal, disrupt, spy, or gain unauthorized access. Learn types, infection paths, warning signs, and defensive controls.
→
M
Money Mules
Money mules receive and move criminal proceeds through bank, payment, or crypto accounts. Learn recruitment tactics, warning signs, risks, and response.
→
N
N
Network Access Control (NAC)
Network Access Control (NAC) determines which users and devices may join a network and what resources they can reach after admission. Learn the key risks.
→
N
Network Firewall
A network firewall filters traffic between networks or security zones according to rules that define permitted sources, destinations, protocols, applicati.
→
N
Network Traffic Analysis (NTA)
Network Traffic Analysis (NTA) examines network communications and metadata to identify suspicious behavior, operational anomalies, and threats that other.
→
N
Next-Generation Firewall (NGFW)
A Next-Generation Firewall (NGFW) combines stateful traffic control with deeper application, identity, content, and threat inspection. Learn the key risks.
→
O
O
OpenClaw
OpenClaw is described as a cybersecurity framework intended to support threat detection, analysis, and response through integrated security data and autom.
→
O
OSINT
Open-source intelligence turns publicly or commercially available information into assessed intelligence. Learn sources, methods, limits, ethics, and uses.
→
O
OSINT Framework
The OSINT Framework is a free directory of open source intelligence tools, organized by category. See how it works and who uses it…
→
O
OTP Bots
OTP bots automate calls or messages that trick victims into revealing one-time passcodes. Learn attack steps, warning signs, response, and prevention.
→
P
P
Password Hashing
Password hashing transforms a password into a one-way value so systems can verify it without storing the original secret. Learn the key risks, warning sig.
→
P
Patch Management
Patch management is the controlled process of identifying, evaluating, testing, deploying, verifying, and documenting software and firmware updates. Learn.
→
P
Phishing
Phishing impersonates trusted people or services to steal credentials, deliver malware, or trigger fraud. Learn common types, warning signs, and defenses.
→
P
PII
Personally identifiable information can identify or be linked to a person. Learn direct and indirect identifiers, security risks, handling, and protection.
→
P
Proxy Firewall (Application-Level Gateways)
A proxy firewall, also called an application-level gateway, terminates a client connection and creates a separate connection to the destination while enfo.
→
R
R
Ransomware
Ransomware encrypts data or steals it for extortion. Learn common attack stages, warning signs, incident response priorities, and prevention measures.
→
R
Remote Access Trojan (RAT)
Remote access Trojans give attackers covert control of infected devices. Learn common capabilities, delivery methods, warning signs, and defensive steps.
→
R
Remote Code Execution (RCE)
Remote code execution lets an attacker run code on another system. Learn common causes, attack paths, impact, detection, remediation, and prevention. now.
→
S
S
Shadow AI
Shadow AI is the use of artificial-intelligence tools, models, agents, or integrations without organizational approval, visibility, or governance. Learn t.
→
S
SIEM
Master the fundamentals of SIEM (Security Information and Event Management). Learn how modern SIEMs integrate AI, SOAR, and XDR to detect threats in real-time…
→
S
Smishing
Smishing uses false text messages to steal credentials, deliver malware, or trigger fraud. Learn common pretexts, warning signs, response, and defenses.
→
S
SMS Bombing
SMS bombing is a malicious cyber attack where perpetrators flood a target's mobile phone with hundreds or thousands of unwanted text messages in a short period. Learn more at SOCRadar!
→
S
SOAR
Security Orchestration, Automation, and Response (SOAR) combines integrations, case management, and playbooks to coordinate security investigation and res.
→
S
SOC
A Security Operations Center (SOC) monitors, detects, investigates, and coordinates response to cybersecurity threats affecting an organization. Learn the.
→
S
Software-Defined Wide Area Network (SD-WAN)
Software-Defined Wide Area Network (SD-WAN) uses centralized software policy to route traffic across multiple wide-area links according to application, pe.
→
S
Software Firewall
A software firewall runs on an endpoint, server, or virtual system and controls traffic entering or leaving that individual host. Learn the key risks, war.
→
S
Spear Phishing
Spear phishing is a targeted social-engineering attack tailored to a specific person, role, or organization. Learn the methods, risks, warning signs, and.
→
S
Spoof Email Address
Email address spoofing makes a message appear to come from a sender other than its true source. Learn the methods, risks, warning signs, and defensive con.
→
S
SQL Injection (SQLi)
SQL injection manipulates database queries through unsafe input handling. Learn common SQLi types, business impact, detection, testing, and prevention.
→
S
State-Sponsored Cyber Attack
State-sponsored cyber attacks pursue national objectives through espionage, disruption, or influence. Learn common tactics, targets, signs, and defenses.
→
S
Stateful Firewall
A stateful firewall tracks active network connections and evaluates packets in the context of an established session rather than treating every packet ind.
→
S
Stealer Logs
Stealer logs are collections of data stolen from infected devices by information-stealing malware. Learn the methods, risks, warning signs, and defensive.
→
S
Strategic Threat Intelligence (STI)
Strategic threat intelligence explains how long-term threat trends, geopolitical developments, technologies, industries, and adversary incentives could af.
→
S
Surface Web
The surface web is the publicly accessible and indexable portion of the internet. Learn the methods, risks, warning signs, and defensive controls for secu.
→
T
T
Tactical Cyber Threat Intelligence
Tactical cyber threat intelligence explains how adversaries conduct attacks through their tactics, techniques, procedures, tools, and operational patterns.
→
T
Takedown Services
Protect your brand from phishing, rogue apps, and deepfakes. Learn how modern takedown services use AI-driven automation to eliminate digital threats in minutes…
→
T
Technical Threat Intelligence
Technical threat intelligence provides detailed, machine-actionable artifacts associated with malicious infrastructure, files, messages, vulnerabilities.
→
T
Third Party Cyber Risk Management (TPCRM)
Third-Party Cyber Risk Management (TPCRM) identifies, evaluates, treats, and monitors cybersecurity risks introduced by vendors, suppliers, partners, serv.
→
T
Threat Actors
Threat actors are people or groups that can cause cyber harm. Learn actor types, motivations, tactics, attribution limits, and threat-intelligence uses.
→
T
Threat Intelligence
Threat intelligence is evidence-based knowledge about threats that helps a defined audience make a security or business decision. Learn the primary risks.
→
T
Threat Modeling
Threat modeling is a structured process for identifying what must be protected, how a system could be attacked, and which design changes reduce the most i.
→
T
Traffic Light Protocol (TLP)
The Traffic Light Protocol (TLP) is a labeling system that tells recipients how widely cybersecurity information may be shared. Learn the primary risks, w.
→
T
Transit Gateway
A transit gateway is a cloud networking service that acts as a central routing hub for multiple virtual networks, data centers, and remote connections. Le.
→
T
Types of Malware
Explore major malware types, including ransomware, Trojans, worms, spyware, loaders, and rootkits, with their behaviors, risks, and defensive controls.
→
T
Types of Phishing
Phishing includes deceptive attacks that impersonate trusted people or services to obtain access, data, money, or execution. Learn the methods, risks, war.
→
T
Typosquatting
Typosquatting registers domains that resemble legitimate names and rely on typing mistakes or visual confusion. Learn the methods, risks, warning signs, a.
→
U
V
V
vCISO
A virtual Chief Information Security Officer (vCISO) provides part-time or outsourced security leadership to organizations that need strategic expertise w.
→
V
Vibe Coding
Vibe coding is a software-development approach in which a person describes a desired outcome to an AI coding assistant and iteratively accepts or adjusts.
→
V
Virtual Firewall
A virtual firewall is a software-based firewall deployed as a virtual appliance, cloud service, or distributed control to protect virtual networks and wor.
→
V
Vishing
Vishing is phishing conducted through telephone or voice communication. Learn the methods, risks, warning signs, and defensive controls for security teams.
→
V
VPN (Virtual Private Network)
A Virtual Private Network (VPN) creates an encrypted tunnel that protects traffic between a user, device, site, or network and a VPN endpoint. Learn the m.
→
V
Vulnerability Prioritization Technology (VPT)
Vulnerability Prioritization Technology (VPT) ranks vulnerabilities by the likelihood and potential impact of exploitation in a specific organizational en.
→
W
W
Web Application Firewall (WAF)
A Web Application Firewall (WAF) inspects HTTP and HTTPS traffic to protect web applications and APIs from malicious requests and abusive behavior. Learn.
→
W
Web Shell
Web shells give attackers command access through a compromised web server. Learn delivery methods, warning signs, response steps, and prevention controls.
→
W
Website Defacement Attacks
Website defacement alters public web content without authorization. Learn common causes, warning signs, response, recovery, and prevention steps. today.
→
Y
Z
Z
Zero Day Exploit
A zero-day exploit abuses a vulnerability before an effective fix is available. Learn terminology, risk factors, warning signs, mitigation, and response.
→
Z
Zero Trust
Zero trust is a security strategy that removes implicit trust based on network location and requires explicit, contextual authorization for access to reso.
→
No terms match your search. Try a different keyword or clear filters.
Can't find a term?
Suggest a glossary entry, and our research team publishes new definitions weekly.
Request a Term