Knowledge Base
Cybersecurity Glossary
Clear definitions of the terms, frameworks, and techniques that matter in adversarial exposure validation, threat-informed defense, and security operations.
Security Testing
Adversarial Exposure Validation (AEV)
Adversarial Exposure Validation is a security testing approach that measures how exposed an organization is to real attacker behavior by safely validating exploitable paths, weak controls, and detection gaps.
Read definition →Security TestingAutomated Penetration Testing
Automated penetration testing uses software-driven attack workflows to identify exploitable weaknesses and validate parts of an attack path without requiring every step to be executed manually by a human tester.
Read definition →Security TestingContinuous Automated Red Teaming (CART)
Continuous Automated Red Teaming is an automated security testing model that repeatedly emulates realistic adversary behavior to measure how well an organization detects, blocks, and responds to attacks over time.
Read definition →Security TestingSecurity Control Validation
Security control validation is the process of verifying that preventive, detective, and response controls work as intended against relevant attack techniques.
Read definition →Security TestingPenetration Testing
Penetration testing is an authorized security assessment in which testers attempt to exploit weaknesses in systems, applications, or processes to identify real security risk.
Read definition →Security TestingPenetration Testing as a Service (PTaaS)
Penetration Testing as a Service is a delivery model that combines penetration testing expertise with an ongoing platform for collaboration, tracking, retesting, and reporting.
Read definition →Security TestingBreach and Attack Simulation (BAS)
Breach and Attack Simulation is an advanced security testing approach that uses automation to continuously simulate real-world attack techniques against an organization's infrastructure, providing ongoing validation of security controls.
Read definition →Security TestingSecurity Validation
Security validation is the ongoing practice of testing, measuring, and verifying that an organization's security controls, tools, and processes are functioning correctly and effectively against real-world threats.
Read definition →Security Concepts
Continuous Threat Exposure Management (CTEM)
Continuous Threat Exposure Management is a continuous program for discovering, validating, prioritizing, and reducing the security exposures that matter most to the business.
Read definition →Security ConceptsExposure Assessment Platform (EAP)
An Exposure Assessment Platform is a security platform that combines exposure discovery, prioritization, and validation data to help teams understand which weaknesses are most likely to lead to compromise.
Read definition →Security ConceptsAttack Path
An attack path is the sequence of weaknesses, access points, and privilege transitions an attacker can use to move from an initial foothold to a high-value objective.
Read definition →Security ConceptsCyber Asset Attack Surface Management (CAASM)
Cyber Asset Attack Surface Management is the practice of unifying asset data from many systems so security teams can see what they own, what is exposed, and where control gaps exist across the environment.
Read definition →Security ConceptsCyber Risk Quantification (CRQ)
Cyber risk quantification is the process of translating cybersecurity exposure into measurable business impact, often using financial, operational, or loss-based models.
Read definition →Security ConceptsDwell Time
Dwell time is the amount of time an attacker remains in an environment before being detected, contained, or removed.
Read definition →Security ConceptsExternal Attack Surface Management (EASM)
External Attack Surface Management is the practice of continuously discovering and monitoring internet-facing assets and exposures that attackers can see from outside the organization.
Read definition →Security ConceptsSecurity Posture Management
Security posture management is the continuous process of measuring, improving, and governing an organization's overall security condition across assets, controls, identities, and exposures.
Read definition →Security ConceptsCyber Resilience
Cyber resilience is an organization's ability to anticipate, withstand, respond to, and recover from cyber incidents while continuing critical operations.
Read definition →Security ConceptsAttack Surface
An organization's attack surface is the complete set of vulnerabilities, entry points, and exposure points through which a threat actor can attempt to gain unauthorized access to systems, data, or networks.
Read definition →Security ConceptsAttack Surface Management (ASM)
Attack Surface Management is the continuous, automated process of discovering, inventorying, classifying, assessing, and monitoring all external-facing assets and exposure points across an organization's digital footprint.
Read definition →Security ConceptsSecurity Posture
Security posture refers to the overall cybersecurity strength and readiness of an organization — encompassing the collective state of its networks, information, systems, data, processes, and people.
Read definition →Security ConceptsVulnerability Management
Vulnerability management is the ongoing, systematic process of discovering, evaluating, prioritizing, and addressing security vulnerabilities across an organization's technology ecosystem.
Read definition →Security Operations
Mean Time to Detect (MTTD)
Mean time to detect is the average amount of time it takes an organization to identify suspicious or malicious activity after it begins.
Read definition →Security OperationsMTTD and MTTR
MTTD and MTTR are security operations metrics that measure how quickly a team detects malicious activity and how quickly it responds to or remediates the issue.
Read definition →Security OperationsDetection Engineering
Detection engineering is the systematic discipline of creating, testing, deploying, and maintaining detection logic that identifies malicious or suspicious activity within an organization's environment.
Read definition →Security OperationsEndpoint Detection and Response (EDR)
EDR (Endpoint Detection and Response) is a security solution that continuously monitors endpoint devices to detect suspicious activity, investigate threats, and enable rapid incident response.
Read definition →Security OperationsExtended Detection and Response (XDR)
XDR is a security platform that unifies detection, investigation, and response across endpoints, network, email, cloud, and identity through correlated data and integrated workflows.
Read definition →Security OperationsIncident Response
Incident response is the organized approach to addressing and managing the aftermath of a cybersecurity incident, with the goals of limiting damage, reducing recovery time and costs, and learning from the event.
Read definition →Security OperationsSecurity Operations Center (SOC)
A Security Operations Center (SOC) is a centralized unit staffed by security analysts and engineers who continuously monitor, detect, investigate, and respond to cybersecurity incidents.
Read definition →Security OperationsSIEM
SIEM (Security Information and Event Management) is a security solution that collects, aggregates, and analyzes log and event data across an organization's IT environment to detect threats, support investigations, and enable compliance reporting.
Read definition →Security OperationsSOAR
SOAR (Security Orchestration, Automation and Response) is a security technology category that enables organizations to collect security data from multiple sources and automate incident analysis and response through orchestrated workflows.
Read definition →Threat Emulation
Adversary Emulation Plan
An adversary emulation plan is a structured document that defines how a team will reproduce the observed behavior of a specific threat actor or campaign during a controlled security exercise.
Read definition →Threat EmulationAdversary Simulation
Adversary simulation is a security testing methodology where defenders mimic the behavior of real-world threat actors to evaluate the effectiveness of an organization's detection and response capabilities.
Read definition →Threat EmulationPurple Teaming
Purple teaming is a collaborative security exercise where offensive (red team) and defensive (blue team) personnel work together in real-time to maximize the effectiveness of attack simulation and detection improvement.
Read definition →Threat EmulationRed Teaming
Red teaming is an adversarial security assessment where a skilled team simulates realistic attacks against an organization to test technical controls, people, processes, and physical security.
Read definition →Threat Analysis
Indicator of Attack (IOA)
An indicator of attack is a behavioral signal that suggests an attack is underway, even if no confirmed compromise artifact has been observed yet.
Read definition →Threat AnalysisIndicator of Compromise (IOC)
An indicator of compromise is a forensic artifact or observable signal that suggests a system, account, or network may already have been compromised.
Read definition →Threat AnalysisThreat Hunting
Threat hunting is the proactive, human-driven practice of searching through networks, endpoints, and datasets to detect and isolate advanced threats that have evaded automated security solutions.
Read definition →Threat AnalysisThreat Intelligence
Threat intelligence is actionable, evidence-based knowledge about cybersecurity threats — including context, mechanisms, indicators, and implications — that helps organizations make informed security decisions.
Read definition →Attack Techniques
Command and Control (C2)
Command and control is the communication channel an attacker uses to issue instructions to compromised systems and receive data or execution results from them.
Read definition →Attack TechniquesData Exfiltration
Data exfiltration is the unauthorized transfer of sensitive data from an organization to a location controlled by an attacker.
Read definition →Attack TechniquesInitial Access
Initial access encompasses the techniques adversaries use to gain their first foothold in a target environment — the critical entry point that all subsequent attack activities depend on.
Read definition →Attack TechniquesLateral Movement
Lateral movement refers to the techniques adversaries use to progressively move through a network after gaining initial access, escalating privileges and expanding their reach to high-value systems.
Read definition →Attack TechniquesPhishing
Phishing is a social engineering attack where threat actors use deceptive communications to trick victims into revealing credentials, clicking malicious links, or downloading malware.
Read definition →Attack TechniquesPrivilege Escalation
Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight to gain elevated access to resources that are normally protected from an application or user.
Read definition →Frameworks
Cyber Kill Chain
The cyber kill chain is a framework that breaks an intrusion into sequential stages so defenders can understand, detect, and disrupt attacker activity at multiple points.
Read definition →FrameworksTactics, Techniques, and Procedures (TTPs)
Tactics, techniques, and procedures describe how threat actors pursue objectives, what methods they use, and how those methods are operationalized during an intrusion.
Read definition →FrameworksThreat-Informed Defense
Threat-informed defense is a security approach that uses real adversary behavior and threat intelligence to guide what defenses to build, tune, validate, and prioritize.
Read definition →FrameworksMITRE ATT&CK
MITRE ATT&CK is a comprehensive knowledge base and framework that catalogues cyber adversary behavior across the entire attack lifecycle, providing a common language for describing adversary actions.
Read definition →Compliance Frameworks
NCA ECC (Essential Cybersecurity Controls)
NCA ECC is Saudi Arabia's Essential Cybersecurity Controls framework, published by the National Cybersecurity Authority to define baseline security requirements for in-scope organizations.
Read definition →Compliance FrameworksSEBI CSCRF Compliance Guide 2026 | FourCore ATTACK
Complete guide to SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF). Understand VAPT, BAS, and Cyber Capability Index (CCI) requirements, deadlines, and penalties. See how FourCore ATTACK automates continuous CSCRF compliance validation.
Read definition →Threat Types
Advanced Persistent Threat (APT)
An advanced persistent threat is a skilled, well-resourced threat actor or campaign that maintains long-term access to a target in pursuit of espionage, disruption, or strategic objectives.
Read definition →Threat TypesRansomware
Ransomware is a category of malicious software designed to block access to a computer system or data, typically by encryption, until a ransom is paid to the attacker.
Read definition →