Resources · Glossary
Cyber security glossary
The acronyms and terms you come across in security reports, standards and contracts, explained in a few lines and linked to where they really matter.
A
- Attack Surface ManagementThe continuous process that discovers, inventories and watches everything a company exposes, starting from the internet.
B
- BIAThe analysis that establishes which business processes are critical, what it costs to stop them and how quickly they must be restored.
- Business continuityAn organisation's ability to keep delivering its essential services during and after an event that disrupts it.
C
- CSIRTThe team in charge of handling cyber incidents: it coordinates analysis, containment, recovery and communications.
- CVEThe unique, public code used to catalogue a known vulnerability, in the format CVE-year-number.
- CVSSThe standard that measures the technical severity of a vulnerability with a score from 0 to 10, split into ratings from low to critical.
D
- Dark webThe part of the internet reachable only with dedicated software such as Tor, where credentials and data stolen from companies also circulate.
- Data breachA security breach leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
- DPOThe role set out in the GDPR that monitors compliance with personal data rules and acts as the contact point for the supervisory authority.
E
- EDRThe technology that continuously watches the behaviour of PCs and servers, detects malicious activity and lets you block and investigate it.
F
- File Integrity MonitoringThe control that compares critical files and configurations with a reference state and flags every unexpected change.
H
I
- Indicators of compromiseThe technical traces that reveal an intrusion that has happened or is under way: file hashes, IP addresses, domains, registry keys.
M
- MDRA managed service in which an external team of analysts watches the alerts, investigates threats and leads incident response.
- MITRE ATT&CKThe public knowledge base cataloguing the tactics and techniques of real attackers, used by defenders as a common language.
- Multi-factor authentication (MFA)A sign-in method that asks for two or more proofs of identity of different kinds, for example a password and a code from an app.
N
- NIS2The European cybersecurity directive, transposed in Italy by D.Lgs. 138/2024, that places obligations on thousands of companies.
P
- Patch managementThe process that finds, assesses, tests and installs security updates on systems and software, within set timeframes.
- Penetration testAn authorised, simulated attack carried out by specialists to check how far a real attacker would get.
- PhishingThe attack that uses deceptive messages to get someone to click a link, open an attachment or hand over credentials or payments.
R
- RansomwareMalware that encrypts data and systems to demand a ransom, often also threatening to publish the stolen data.
- Residual riskThe risk that remains after treatment measures have been applied, to be measured, formally accepted and reviewed.
- RTO and RPORTO is the maximum time to restore a service; RPO is the maximum acceptable data loss, measured in time.
S
- SIEMThe system that centralises security logs, correlates them and raises an alert when it recognises a suspicious sequence of events.
- SOCThe combination of people, processes and tools that watches over an organisation's security and responds to incidents.
- Statement of ApplicabilityThe ISO/IEC 27001 document that lists the Annex A controls, states which apply and why, and whether they are implemented.
- Supply chain attackThe attack that reaches a company through a supplier: a piece of software, a managed service or a partner with access to its systems.
- System administratorWhoever manages systems, networks and databases with elevated privileges, subject to the specific measures of the Italian Garante's 2008 order.
T
- Threat huntingThe proactive, hypothesis-driven search for threats already inside the network that have not triggered any alert.
- Threat intelligenceInformation about threats, collected, analysed and put into context to help an organisation decide how to defend itself.
- TLPThe colour-coded convention that says who a piece of security information may be shared with: RED, AMBER, GREEN or CLEAR.
V
- Vulnerability assessmentThe systematic, largely automated analysis that finds and classifies the known vulnerabilities of networks, systems and applications.
X
- XDRThe extension of EDR that correlates signals from endpoints, identities, email, network and cloud to detect and respond from one place.
Z
- Zero-dayA vulnerability exploited or disclosed before the vendor has a fix: defenders have had "zero days".
Do you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.