Glossary

An access control model that grants permissions based on a combination of user, resource, and environmental attributes.

The process of restricting or granting access to systems, applications, and data based on defined policies.

An Access Control Entry (ACE) is a single rule within an access control list that allows, denies, or audits a specific type of access for a specific user, group, or security principal.

Microsoft's directory service used to manage users, devices, and permissions across a corporate network.

Adaptive access control adjusts access decisions using signals such as identity, device security, location, behavior, and resource sensitivity. It allows organizations to apply additional safeguards when circumstances indicate greater risk.

A risk-based login method that adjusts verification requirements based on the context of each access attempt.

The discipline of securing autonomous AI agents that can plan, take actions, access systems, and make decisions on their own, where a compromised agent can cause real-world damage.

The policies, controls, and oversight that ensure artificial intelligence is developed and used safely, ethically, and in line with regulations across its full lifecycle.

Access and identity management is the set of policies, processes, and technologies used to manage digital identities and control their access to applications, systems, and data.

The use of artificial intelligence and machine learning to automate and improve how IT operations are monitored and managed, turning a flood of telemetry into clear, actionable insight.

The use of analytics and machine learning to identify unusual patterns in data that deviate from normal behavior and may signal a performance issue or security threat.

The practice of protecting application programming interfaces from unauthorized access, abuse, and data exposure.

The process of verifying that a user or system is who or what it claims to be before granting access.

The process of determining what actions or resources an authenticated user is permitted to access.

The monitoring and analysis of user and device behavior patterns to detect anomalies that may indicate a security threat.

A method of verifying identity using unique physical or behavioral characteristics such as fingerprints, facial recognition, or voice patterns.

A botnet is a network of malware-infected computers, servers, mobile devices, or Internet of Things (IoT) devices that an attacker controls remotely to perform coordinated malicious activity.

A security incident in which unauthorisedWhat is a Breach? individuals gain access to protected systems, networks, or data.

Brute force is a trial-and-error method that repeatedly tests passwords, encryption keys, access codes, or other possible values until it finds one that works. In cybersecurity, unauthorized use of this method is known as a brute force attack.

A security tool that sits between users and cloud services to monitor activity, enforce policies, and protect data.

IAM solutions designed specifically to manage the identities and access of external customers rather than internal employees.

An integrated platform that combines cloud posture, workload, and identity security into a single solution, protecting cloud-native applications from development through runtime.

The process of adhering to laws, regulations, and internal policies that govern how organizations protect data and manage security risk.

A policy framework that grants or blocks access to resources based on real-time conditions such as device health, location, and risk level.

Tools that continuously detect and remediate misconfigurations and compliance risks across cloud environments, helping prevent the breaches that often start with a simple setup error.

A security solution that protects workloads such as VMs, containers, and serverless functions across cloud environments, focusing on the compute layer where applications actually run.

A widely used privileged access management platform used to secure, manage, and monitor accounts with elevated permissions.

The practice of protecting systems, networks, applications, and data from digital attacks, unauthorized access, and damage.

Technologies and policies that prevent sensitive data from being shared, transferred, or accessed without proper authorization.

An attack that corrupts the data used to train an AI model in order to degrade its accuracy or insert hidden malicious behavior such as a backdoor.

Centralized systems that store, organize, and provide access to information about users, devices, and resources within a network.

An EU regulation requiring financial entities to ensure the resilience of their ICT systems and manage technology-related risks effectively.

A real-time access control approach that evaluates policies at the moment of each request rather than relying on pre-assigned static permissions.

A security solution that continuously monitors and records endpoint activity to detect, investigate, and respond to suspicious behavior and threats that traditional antivirus often misses.

The practice of protecting end-user devices such as laptops, smartphones, and tablets from cyber threats.

The process of defining, assigning, reviewing, and revoking the specific permissions that users hold across systems and applications.

A trust relationship between separate identity systems that allows users to authenticate once and access resources across multiple organizations or platforms.

A U.S. government program that standardizes the security assessment, authorization, and continuous monitoring of cloud services so federal agencies can adopt them with confidence.

An open authentication standard that enables secure passwordless login using biometrics or hardware security keys.

The General Data Protection Regulation (GDPR) is a European Union law that governs how organizations collect, process, and protect the personal data of individuals in the EU. It was adopted in 2016 and took effect on 25 May 2018, replacing the older 1995 Data Protection Directive. It gives people stronger control over their data and places strict, provable obligations on the organizations that handle it.

An integrated framework for managing organizational governance, enterprise risk, and regulatory compliance in a coordinated way.

A U.S. federal law that establishes standards for protecting sensitive patient health information from unauthorized disclosure or misuse.

A honeypot is a decoy system or resource designed to attract suspicious activity so security teams can detect intrusion attempts and study attacker behavior.

A framework of policies and technologies that ensures the right people access the right resources at the right time.

A discipline that combines identity lifecycle management with access governance to ensure users have appropriate access and that access is regularly reviewed.

A structured process for detecting, containing, investigating, and recovering from cybersecurity incidents.

A piece of forensic evidence, such as a malicious IP address or file hash, that signals a system or network may have already been breached.

The world's leading international standard that specifies the requirements for establishing, maintaining, and continually improving an information security management system (ISMS).

Identity Security Posture Management (ISPM) is the practice of continuously assessing identities, permissions, and identity-related configurations to identify security weaknesses and guide remediation.

A security practice that grants users elevated privileges only when needed for a specific task and automatically revokes them once the task is complete.

A security principle that grants users only the minimum level of access required to perform their job, and nothing more.

The automated process of managing a user's identity and access rights from the moment they join an organization through role changes to the day they leave.

The practice of protecting large language models and the applications built on them from threats such as prompt injection, data leakage, and manipulation that traditional tools were not designed to catch.

Our managed cybersecurity service uses advanced detection tools and expert analysts to monitor threats 24/7. We investigate and respond fast, without the cost of building an in-house SOC.

A security method that requires users to verify their identity using two or more independent factors before accessing a system.

A network security technique that divides infrastructure into small, isolated zones to prevent attackers from moving laterally after a breach.

Microsoft's cloud-based identity and access management platform, formerly known as Azure Active Directory.

A security technology that analyzes network traffic to detect and respond to threats that endpoint and log-based tools miss, including activity on unmanaged and IoT devices.

The practice of dividing a network into separate, isolated zones to limit access and contain the spread of threats, making it harder for attackers to move once inside.

A firewall that adds capabilities such as application awareness, intrusion prevention, and threat intelligence to traditional filtering, inspecting traffic far more deeply than older firewalls.

An EU directive that strengthens cybersecurity requirements for organizations operating critical infrastructure and essential services.

A widely used U.S. framework that provides voluntary guidelines to help organizations of any size manage and reduce cybersecurity risk, organized around six core functions.

A centralized team and facility that monitors and maintains the performance, availability, and health of an organization's IT infrastructure, working to keep systems running around the clock.

A non-human identity (NHI) is a digital identity assigned to software, a workload, service, device, bot, API, or AI agent so it can authenticate and access protected systems without acting as a human user.

An open authorization framework that enables applications to access resources on behalf of users without exposing their credentials.

The ability to understand a system's internal state by analyzing the data it produces, such as logs, metrics, and traces, so teams can see not just that something broke but why.

A widely used cloud-based identity platform providing workforce and customer IAM including SSO, MFA, and lifecycle management.

A security discipline focused on controlling, monitoring, and protecting accounts with elevated or administrative access rights.

Authentication methods that verify user identity without requiring a traditional password, using biometrics, hardware keys, or magic links instead.

A set of security standards designed to ensure that all organizations that process, store, or transmit payment card data maintain a secure environment.

PKI, or public key infrastructure, is a framework of technologies, policies, and processes that manages digital certificates and cryptographic keys. It helps systems verify identities and supports secure communication.

An attack that manipulates an AI system's instructions through crafted input, causing it to ignore its rules, leak data, or take unintended actions. It is the top risk for LLM applications.

An access control model that grants permissions to users based on their defined role within the organization.

Incident root cause analysis is the evidence-based process of identifying why a security incident occurred, which conditions enabled it, and what changes could reduce the likelihood or impact of a similar incident.

RCA examines technical weaknesses, access decisions, operational processes, and control failures. An incident may have several contributing causes rather than one isolated root cause.

The process of identifying, analyzing, and prioritizing risks to an organization's systems, data, and operations, so leaders can decide where to focus their resources.

A structured process for identifying the underlying cause of an incident, rather than just its symptoms, so the same problem can be prevented from happening again.

An identity governance platform that manages access certifications, provisioning, and compliance across complex environments.

An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider.

A cloud-delivered model that combines networking and security functions into one service to securely connect users to applications anywhere, replacing fragmented point solutions.

The unsanctioned use of AI tools by employees without the knowledge or approval of IT and security teams, creating hidden data, compliance, and security risks.

A platform that collects, aggregates, and analyzes security data from across an organization's environment to detect and respond to threats in real time.

A contract that defines the level of service a provider commits to deliver, including measures such as uptime and response times, and the penalties if those levels are not met.

A platform that connects security tools, automates repetitive tasks, and coordinates incident response through predefined playbooks, making detection and response faster and more consistent.

A centralized team and function that continuously monitors, detects, investigates, and responds to an organization's security threats, usually staffed around the clock.

An auditing standard that verifies an organization's controls around security, availability, processing integrity, confidentiality, and privacy.

An authentication process that allows users to log in once and access multiple applications and systems without re-entering credentials.

The proactive, human-led practice of searching through systems and data to find attackers who have slipped past automated defenses, instead of waiting for an alert.

Collected and analyzed information about current and emerging cyber threats that gives defenders the context to anticipate, prioritize, and respond to attacks more effectively.

A threat surface is the collection of exposed assets, access points, and interactions through which an organization could face security threats. In cybersecurity discussions, the term often overlaps with the more established term attack surface.

A Trojan horse, also called a Trojan, is a type of malware that disguises itself as legitimate software or a harmless file. It tricks a user into downloading, installing, or running it. Once activated, the Trojan may steal information, give an attacker remote access, install other malware, or damage the affected system.

User and entity behavior analytics (UEBA) is a cybersecurity approach that analyzes how users, accounts, devices, applications, and other entities normally behave, then identifies activity that may indicate a security threat.

A unified security platform that collects and correlates data across endpoints, networks, cloud, email, and identity to detect and respond to threats that single tools miss.

Cross-site scripting (XSS) is a web application vulnerability that allows attacker-controlled code to run in another user’s browser as though it came from a trusted website.

A security model based on the principle of "never trust, always verify" no user, device, or network connection is trusted by default, regardless of location.

The overall system design and infrastructure built to implement Zero Trust principles across identity, devices, network, applications, and data.

A technology that provides secure remote access to applications based on identity and context rather than network location.