Knowledge Base
Cybersecurity Glossary
Clear definitions of the terms, frameworks, and techniques that matter in agentic security operations, threat hunting, and adversarial exposure validation.
AI Security Operations
Agentic SecOps
Agentic SecOps is the use of AI agents that plan and carry out multi-step security operations work, such as triage, hunting and testing, under human approval.
Read definition →AI Security OperationsAgentic SOC
An agentic SOC is a security operations center where AI agents investigate alerts, hunt and test controls, while analysts set scope and approve changes.
Read definition →AI Security OperationsAI Agents in Cybersecurity
AI agents in cybersecurity are AI systems that run multi-step security tasks, such as searches, tests and analysis, by calling tools and reading results.
Read definition →AI Security OperationsAI SOC Analyst
An AI SOC analyst is an AI agent that investigates alerts and threats the way a human analyst would, running queries and reporting findings with evidence.
Read definition →AI Security OperationsAI Threat Hunting
AI threat hunting is the use of AI agents to turn threat intelligence into searches, run them across security tools, and report findings and coverage gaps.
Read definition →AI Security OperationsHuman-in-the-Loop Security Automation
Human-in-the-loop security automation is a design where tools and AI agents do the work, but a person approves decisions that change systems or carry risk.
Read definition →Security Testing
Adversarial Exposure Validation (AEV)
Adversarial Exposure Validation is a security testing approach that measures how exposed an organization is to real attacker behavior by safely validating exploitable paths, weak controls, and detection gaps.
Read definition →Security TestingAutomated Penetration Testing
Automated penetration testing uses software-driven attack workflows to identify exploitable weaknesses and validate parts of an attack path without requiring every step to be executed manually by a human tester.
Read definition →Security TestingContinuous Automated Red Teaming (CART)
Continuous Automated Red Teaming is an automated security testing model that repeatedly emulates realistic adversary behavior to measure how well an organization detects, blocks, and responds to attacks over time.
Read definition →Security TestingSecurity Control Validation
Security control validation is the process of verifying that preventive, detective, and response controls work as intended against relevant attack techniques.
Read definition →Security TestingPenetration Testing
Penetration testing is an authorized security assessment in which testers attempt to exploit weaknesses in systems, applications, or processes to identify real security risk.
Read definition →Security TestingPenetration Testing as a Service (PTaaS)
Penetration Testing as a Service is a delivery model that combines penetration testing expertise with an ongoing platform for collaboration, tracking, retesting, and reporting.
Read definition →Security TestingBreach and Attack Simulation (BAS)
Breach and Attack Simulation is an advanced security testing approach that uses automation to continuously simulate real-world attack techniques against an organization's infrastructure, providing ongoing validation of security controls.
Read definition →Security TestingSecurity Validation
Security validation is the ongoing practice of testing, measuring, and verifying that an organization's security controls, tools, and processes are functioning correctly and effectively against real-world threats.
Read definition →Security Concepts
Continuous Threat Exposure Management (CTEM)
Continuous Threat Exposure Management is a continuous program for discovering, validating, prioritizing, and reducing the security exposures that matter most to the business.
Read definition →Security ConceptsExposure Assessment Platform (EAP)
An Exposure Assessment Platform is a security platform that combines exposure discovery, prioritization, and validation data to help teams understand which weaknesses are most likely to lead to compromise.
Read definition →Security ConceptsAttack Path
An attack path is the sequence of weaknesses, access points, and privilege transitions an attacker can use to move from an initial foothold to a high-value objective.
Read definition →Security ConceptsCyber Asset Attack Surface Management (CAASM)
Cyber Asset Attack Surface Management is the practice of unifying asset data from many systems so security teams can see what they own, what is exposed, and where control gaps exist across the environment.
Read definition →Security ConceptsCyber Risk Quantification (CRQ)
Cyber risk quantification is the process of translating cybersecurity exposure into measurable business impact, often using financial, operational, or loss-based models.
Read definition →Security ConceptsDwell Time
Dwell time is the amount of time an attacker remains in an environment before being detected, contained, or removed.
Read definition →Security ConceptsExternal Attack Surface Management (EASM)
External Attack Surface Management is the practice of continuously discovering and monitoring internet-facing assets and exposures that attackers can see from outside the organization.
Read definition →Security ConceptsSecurity Posture Management
Security posture management is the continuous process of measuring, improving, and governing an organization's overall security condition across assets, controls, identities, and exposures.
Read definition →Security ConceptsCyber Resilience
Cyber resilience is an organization's ability to anticipate, withstand, respond to, and recover from cyber incidents while continuing critical operations.
Read definition →Security ConceptsAttack Surface
An organization's attack surface is the complete set of vulnerabilities, entry points, and exposure points through which a threat actor can attempt to gain unauthorized access to systems, data, or networks.
Read definition →Security ConceptsAttack Surface Management (ASM)
Attack Surface Management is the continuous, automated process of discovering, inventorying, classifying, assessing, and monitoring all external-facing assets and exposure points across an organization's digital footprint.
Read definition →Security ConceptsSecurity Posture
Security posture refers to the overall cybersecurity strength and readiness of an organization — encompassing the collective state of its networks, information, systems, data, processes, and people.
Read definition →Security ConceptsVulnerability Management
Vulnerability management is the ongoing, systematic process of discovering, evaluating, prioritizing, and addressing security vulnerabilities across an organization's technology ecosystem.
Read definition →Security Operations
Alert Fatigue
Alert fatigue is what happens when security analysts see so many alerts, most of them benign, that they start missing, skimming or ignoring the ones that matter.
Read definition →Security OperationsDetection Tuning
Detection tuning is adjusting detection rules so they fire on real attacker behavior and stay quiet on normal activity, tested against past telemetry.
Read definition →Security OperationsFalse Positive (Security Alerts)
A false positive is a security alert that fires on activity that is not malicious, such as a detection rule flagging a normal admin script as an attack.
Read definition →Security OperationsFederated Search (Security)
Federated search in security is querying data where it already lives, in each SIEM, EDR or data lake, instead of copying everything into one central store first.
Read definition →Security OperationsMean Time to Detect (MTTD)
Mean time to detect is the average amount of time it takes an organization to identify suspicious or malicious activity after it begins.
Read definition →Security OperationsMTTD and MTTR
MTTD and MTTR are security operations metrics that measure how quickly a team detects malicious activity and how quickly it responds to or remediates the issue.
Read definition →Security OperationsDetection Engineering
Detection engineering is the systematic discipline of creating, testing, deploying, and maintaining detection logic that identifies malicious or suspicious activity within an organization's environment.
Read definition →Security OperationsEndpoint Detection and Response (EDR)
EDR (Endpoint Detection and Response) is a security solution that continuously monitors endpoint devices to detect suspicious activity, investigate threats, and enable rapid incident response.
Read definition →Security OperationsExtended Detection and Response (XDR)
XDR is a security platform that unifies detection, investigation, and response across endpoints, network, email, cloud, and identity through correlated data and integrated workflows.
Read definition →Security OperationsIncident Response
Incident response is the organized approach to addressing and managing the aftermath of a cybersecurity incident, with the goals of limiting damage, reducing recovery time and costs, and learning from the event.
Read definition →Security OperationsSecurity Operations Center (SOC)
A Security Operations Center (SOC) is a centralized unit staffed by security analysts and engineers who continuously monitor, detect, investigate, and respond to cybersecurity incidents.
Read definition →Security OperationsSIEM
SIEM (Security Information and Event Management) is a security solution that collects, aggregates, and analyzes log and event data across an organization's IT environment to detect threats, support investigations, and enable compliance reporting.
Read definition →Security OperationsSOAR
SOAR (Security Orchestration, Automation and Response) is a security technology category that enables organizations to collect security data from multiple sources and automate incident analysis and response through orchestrated workflows.
Read definition →Threat Emulation
What Is Adversary Emulation? Definition and Uses
Adversary emulation replicates documented threat actor behavior to test security controls, detections, and response using MITRE ATT&CK techniques.
Read definition →Threat EmulationAdversary Simulation
Adversary simulation is a security testing methodology where defenders mimic the behavior of real-world threat actors to evaluate the effectiveness of an organization's detection and response capabilities.
Read definition →Threat EmulationPurple Teaming Definition: How Purple Team Exercises Work
Purple teaming brings red and blue teams together to test attack techniques, measure detection outcomes, and improve security controls with evidence.
Read definition →Threat EmulationRed Teaming
Red teaming is an adversarial security assessment where a skilled team simulates realistic attacks against an organization to test technical controls, people, processes, and physical security.
Read definition →Threat Analysis
Emerging Threat Hunting
Emerging threat hunting is searching your environment for signs of a newly reported campaign, malware or exploit, usually within hours or days of the report.
Read definition →Threat AnalysisIndicator of Attack (IOA)
An indicator of attack is a behavioral signal that suggests an attack is underway, even if no confirmed compromise artifact has been observed yet.
Read definition →Threat AnalysisIndicator of Compromise (IOC)
An indicator of compromise is a forensic artifact or observable signal that suggests a system, account, or network may already have been compromised.
Read definition →Threat AnalysisThreat Hunting Query Languages (KQL, SPL, CQL)
Threat hunting query languages are the search languages of SIEM and EDR tools, such as Splunk SPL, Microsoft KQL and CrowdStrike CQL, used to find attackers.
Read definition →Threat AnalysisHunt Hypothesis
A hunt hypothesis is a testable statement about attacker activity that may be present in an environment, used to decide what a threat hunt searches for.
Read definition →Threat AnalysisIOC Sweep
An IOC sweep searches every connected security tool for a list of indicators of compromise, such as IP addresses, domains, URLs, file hashes and file names.
Read definition →Threat AnalysisRetrohunt
A retrohunt runs a new indicator or detection rule over historical data to find activity that happened before the rule existed.
Read definition →Threat AnalysisSigma Rules
Sigma is an open, vendor-neutral format for writing detection rules once and converting them into the query language of many SIEM and EDR tools.
Read definition →Threat AnalysisThreat Hunting
Threat hunting is the proactive, human-driven practice of searching through networks, endpoints, and datasets to detect and isolate advanced threats that have evaded automated security solutions.
Read definition →Threat AnalysisThreat Intelligence
Threat intelligence is actionable, evidence-based knowledge about cybersecurity threats — including context, mechanisms, indicators, and implications — that helps organizations make informed security decisions.
Read definition →Attack Techniques
Command and Control (C2)
Command and control is the communication channel an attacker uses to issue instructions to compromised systems and receive data or execution results from them.
Read definition →Attack TechniquesData Exfiltration
Data exfiltration is the unauthorized transfer of sensitive data from an organization to a location controlled by an attacker.
Read definition →Attack TechniquesInitial Access
Initial access encompasses the techniques adversaries use to gain their first foothold in a target environment — the critical entry point that all subsequent attack activities depend on.
Read definition →Attack TechniquesLateral Movement
Lateral movement refers to the techniques adversaries use to progressively move through a network after gaining initial access, escalating privileges and expanding their reach to high-value systems.
Read definition →Attack TechniquesPhishing
Phishing is a social engineering attack where threat actors use deceptive communications to trick victims into revealing credentials, clicking malicious links, or downloading malware.
Read definition →Attack TechniquesPrivilege Escalation
Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight to gain elevated access to resources that are normally protected from an application or user.
Read definition →Frameworks
Cyber Kill Chain
The cyber kill chain is a framework that breaks an intrusion into sequential stages so defenders can understand, detect, and disrupt attacker activity at multiple points.
Read definition →FrameworksTactics, Techniques, and Procedures (TTPs)
Tactics, techniques, and procedures describe how threat actors pursue objectives, what methods they use, and how those methods are operationalized during an intrusion.
Read definition →FrameworksThreat-Informed Defense
Threat-informed defense is a security approach that uses real adversary behavior and threat intelligence to guide what defenses to build, tune, validate, and prioritize.
Read definition →FrameworksMITRE ATT&CK
MITRE ATT&CK is a comprehensive knowledge base and framework that catalogues cyber adversary behavior across the entire attack lifecycle, providing a common language for describing adversary actions.
Read definition →Compliance Frameworks
NCA ECC (Essential Cybersecurity Controls)
NCA ECC is Saudi Arabia's Essential Cybersecurity Controls framework, published by the National Cybersecurity Authority to define baseline security requirements for in-scope organizations.
Read definition →Compliance FrameworksSEBI CSCRF Compliance Guide 2026 | FourCore ATTACK
Complete guide to SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF). Understand VAPT, BAS, and Cyber Capability Index (CCI) requirements, deadlines, and penalties. See how FourCore ATTACK automates continuous CSCRF compliance validation.
Read definition →Threat Types
Advanced Persistent Threat (APT)
An advanced persistent threat is a skilled, well-resourced threat actor or campaign that maintains long-term access to a target in pursuit of espionage, disruption, or strategic objectives.
Read definition →Threat TypesRansomware
Ransomware is a category of malicious software designed to block access to a computer system or data, typically by encryption, until a ransom is paid to the attacker.
Read definition →