Security intelligence terminology, explained
Clear, plain-English definitions of the vulnerability and threat-intelligence terms that matter, from CTEM and EASM to EPSS, CISA KEV, and MITRE ATT&CK.
CTEM (Continuous Threat Exposure Management)
Continuous Threat Exposure Management (CTEM) is a Gartner-defined five-stage programme (scoping, discovery, prioritisation, validation and mobilisation) that continuously reduces exploitable exposure across an organisation’s attack surface, rather than relying on point-in-time scans or annual tests.
Read definitionEASM (External Attack Surface Management)
External Attack Surface Management (EASM) is the continuous discovery, attribution and assessment of an organisation’s internet-facing assets (domains, subdomains, certificates, exposed services and cloud surfaces) from an attacker’s outside-in perspective, using the same public sources an attacker would.
Read definitionAttack Surface Management (ASM)
Attack surface management (ASM) is the practice of continuously discovering, inventorying and assessing everything an organisation exposes that an attacker could reach, then prioritising what matters. External ASM (EASM) focuses on internet-facing assets discovered from outside the perimeter.
Read definitionEPSS (Exploit Prediction Scoring System)
EPSS (Exploit Prediction Scoring System) is a FIRST.org model that outputs, for each CVE, the probability it will be exploited in the wild within the next 30 days: a 0 to 1 score updated daily. It predicts likelihood of exploitation, where CVSS measures technical severity.
Read definitionCISA KEV (Known Exploited Vulnerabilities)
The CISA Known Exploited Vulnerabilities (KEV) catalogue is a curated list of CVEs that CISA has confirmed are being actively exploited in the wild. It is a high-signal patch-first list, but it is not exhaustive. Many mass-exploited CVEs are never added.
Read definitionMCP Server (for security)
A security MCP server is a Model Context Protocol server that lets AI assistants such as Claude, Cursor and Zed query security data directly (for example CVE, EPSS, CISA KEV and threat-actor intelligence) so an agent can reason about a threat and act, without leaving the conversation.
Read definitionCVSS (Common Vulnerability Scoring System)
CVSS (Common Vulnerability Scoring System) is an open framework that scores the technical severity of a vulnerability from 0.0 to 10.0 based on how it can be exploited and its impact. CVSS measures severity, not the likelihood a vulnerability will actually be exploited.
Read definitionVulnerability Management
Vulnerability management is the continuous process of identifying, assessing, prioritising and remediating security vulnerabilities across an organisation’s systems. Risk-based vulnerability management (RBVM) prioritises by real-world exploitability rather than raw severity, so teams fix what attackers actually use.
Read definitionThreat Intelligence
Threat intelligence is evidence-based knowledge about adversaries (their tools, techniques, infrastructure and targets) used to inform security decisions. Operational threat intelligence maps indicators and TTPs to frameworks like MITRE ATT&CK so defenders can detect and pre-empt attacks.
Read definitionRansomware
Ransomware is malware that encrypts or steals an organisation’s data and demands payment for its return or non-publication. Modern ransomware operates as an affiliate ecosystem (RaaS), often gaining initial access by exploiting internet-facing vulnerabilities before deploying the payload.
Read definitionMITRE ATT&CK
MITRE ATT&CK is a free, globally used knowledge base of adversary tactics and techniques based on real-world observations. It organises attacker behaviour into tactics (the goal) and techniques (how it is achieved), giving defenders a common language to map detections and threat activity.
Read definitionDigital Risk Protection (DRP)
Digital risk protection (DRP) is the monitoring of an organisation’s digital footprint beyond its perimeter (brand impersonation, lookalike domains, leaked credentials, and exposure on the surface, deep and dark web) to detect and disrupt external threats before they cause harm.
Read definitionMCP (Model Context Protocol)
The Model Context Protocol (MCP) is an open standard that connects AI assistants and agents to external tools, data sources and services through a common interface. It lets an assistant like Claude call live tools (such as a security data server) instead of relying only on its training data.
Read definitionCAASM (Cyber Asset Attack Surface Management)
Cyber Asset Attack Surface Management (CAASM) gives security teams a single, queryable inventory of all their assets by aggregating data from existing tools through APIs, so they can find coverage gaps, unmanaged assets and policy violations without deploying new agents or scanning the network.
Read definitionAttack Surface Reduction
Attack surface reduction is the practice of shrinking the number of ways an attacker can reach and exploit an organisation: removing unused services, closing exposed ports, decommissioning forgotten assets, and hardening what remains. It is the action that follows attack surface discovery and prioritisation.
Read definitionVulnerability Assessment
A vulnerability assessment is the systematic identification, classification and prioritisation of security weaknesses across an organisation’s systems, networks and applications. It uses automated scanning and manual review to produce a ranked list of vulnerabilities with remediation guidance, without necessarily exploiting them as a penetration test would.
Read definitionRed Teaming
Red teaming is a goal-oriented, adversarial security assessment in which specialists emulate a real threat actor to achieve a defined objective, such as reaching sensitive data, using realistic tactics across people, process and technology. Unlike a scoped penetration test, red teaming tests an organisation’s detection and response capability, not just its vulnerabilities.
Read definitionBlack Box Testing
In security testing, black box testing means assessing a system with no prior knowledge of its internals, emulating an external attacker. White box testing provides full knowledge, including source code and architecture, for maximum coverage. Grey box testing sits between the two, with partial knowledge such as user credentials, and is the most common approach for penetration testing.
Read definitionKerberoasting
Kerberoasting is an Active Directory attack in which an authenticated user requests Kerberos service tickets for accounts with a Service Principal Name, then cracks the tickets offline to recover the service account password. Because any domain user can request these tickets, kerberoasting is a common and low-noise privilege-escalation technique on Windows networks.
Read definitionRemote Code Execution (RCE)
Remote code execution (RCE) is a vulnerability class that lets an attacker run arbitrary commands or code on a target system over a network, without physical access. RCE is among the most severe vulnerability types because it can give an attacker full control of the affected system, and it is frequently the objective of exploit development.
Read definitionPass-the-Hash
Pass-the-hash is a credential-theft attack in which an attacker authenticates to a Windows system using the NTLM password hash of a valid account, without ever needing the plaintext password. Because Windows accepts the hash directly for NTLM authentication, stolen hashes can be reused to move laterally across a network.
Read definitionBroken Access Control
Broken access control is a vulnerability class where an application fails to enforce restrictions on what authenticated or unauthenticated users are allowed to do, letting them access data or functions that should be off-limits. It ranks first in the OWASP Top 10 and includes flaws such as insecure direct object references and privilege escalation within an application.
Read definitionIDOR (Insecure Direct Object Reference)
An insecure direct object reference (IDOR) is an access-control flaw where an application exposes a reference to an internal object, such as a database key in a URL, and fails to verify that the requesting user is authorised to access it. By altering the reference, an attacker can retrieve or modify data belonging to other users.
Read definitionPTaaS (Penetration Testing as a Service)
Penetration testing as a service (PTaaS) is a delivery model that combines human-led penetration testing with a software platform for scheduling, real-time findings, retesting and continuous scoping. It replaces the once-a-year PDF report with an ongoing service, so organisations can test more frequently and track remediation over time.
Read definitionSecurity Vulnerability
A security vulnerability is a weakness in a system, application or process that an attacker can exploit to compromise confidentiality, integrity or availability. Vulnerabilities arise from software flaws, misconfigurations, weak credentials or design errors, and are catalogued publicly as CVEs with severity scored by CVSS.
Read definitionMDR (Managed Detection and Response)
Managed detection and response (MDR) is a security service that combines technology and human analysts to monitor an organisation’s environment around the clock, detect threats, and respond to them on the customer’s behalf. MDR delivers 24/7 threat detection, investigation and guided or hands-on response as an outsourced service, rather than as software the customer must staff themselves.
Read definitionSOC (Security Operations Centre)
A security operations centre (SOC) is the team, processes and technology responsible for continuously monitoring an organisation’s environment, detecting security threats, investigating them and coordinating response. A SOC can be built in-house, outsourced, or run as a hybrid, and typically operates 24/7 using a SIEM and other detection tooling.
Read definitionMTTR and MTTD (Mean Time to Respond and Detect)
Mean time to detect (MTTD) is the average time taken to identify a security incident after it begins. Mean time to respond (MTTR) is the average time taken to contain or remediate it once detected. Together they are core metrics for measuring the effectiveness of a security operations centre or detection and response programme: lower is better.
Read definitionThreat Detection
Threat detection is the practice of identifying malicious activity, intrusions and security threats within an environment, using a combination of signatures, behavioural analytics, threat intelligence and human analysis. Effective threat detection surfaces genuine threats quickly while controlling the volume of false positives that overwhelm security teams.
Read definitionEDR (Endpoint Detection and Response)
Endpoint detection and response (EDR) is a security technology that continuously monitors endpoints such as laptops, servers and workstations, recording their activity to detect, investigate and respond to threats. EDR goes beyond traditional antivirus by capturing detailed behavioural telemetry, enabling detection of novel attacks and providing tools to contain them, such as isolating a compromised device.
Read definitionXDR (Extended Detection and Response)
Extended detection and response (XDR) is a security approach that unifies detection and response across multiple layers, endpoint, network, identity, email and cloud, correlating signals from all of them into a single view. XDR extends the endpoint-focused model of EDR to give analysts cross-domain visibility and coordinated response across the whole environment.
Read definitionNDR (Network Detection and Response)
Network detection and response (NDR) is a security technology that monitors network traffic to detect suspicious activity, lateral movement and threats that endpoint tools may miss. NDR analyses traffic patterns and metadata using behavioural analytics, providing visibility into activity across the network, including devices that cannot run an endpoint agent.
Read definitionIncident Response
Incident response is the organised process an organisation follows to prepare for, detect, contain, eradicate and recover from a cyber security incident, then learn from it. A structured incident-response process, often based on frameworks from NIST or SANS, limits the damage of a breach and speeds recovery.
Read definitionDFIR (Digital Forensics and Incident Response)
Digital forensics and incident response (DFIR) combines the investigative discipline of digital forensics with the operational discipline of incident response. DFIR practitioners collect and analyse digital evidence to understand how an incident occurred and its scope, while coordinating the containment and recovery activities that limit its impact.
Read definitionUEBA (User and Entity Behaviour Analytics)
User and entity behaviour analytics (UEBA) is a security technique that builds baselines of normal behaviour for users and systems, then uses analytics and machine learning to flag anomalies that may indicate compromise, insider threats or account misuse. UEBA detects threats that signature-based tools miss by focusing on unusual behaviour rather than known-bad indicators.
Read definitionSIEM (Security Information and Event Management)
Security information and event management (SIEM) is a technology that aggregates log and event data from across an organisation’s systems, then normalises, correlates and analyses it to detect security threats and support investigation. A SIEM is the central nervous system of many security operations centres, turning scattered logs into actionable alerts and a searchable record.
Read definitionSOAR (Security Orchestration, Automation and Response)
Security orchestration, automation and response (SOAR) is a technology that automates and coordinates security operations tasks, connecting tools together and running predefined playbooks to handle repetitive investigation and response steps. SOAR reduces manual workload and speeds response by automating routine actions so analysts can focus on decisions that need human judgement.
Read definitionLog Management
Log management is the practice of collecting, storing, normalising and retaining log data from across an organisation’s systems for security, operational and compliance purposes. Effective log management underpins threat detection and incident investigation, because logs are the primary record of what happened, and many regulations mandate that they be retained and reviewed.
Read definitionPurple Teaming
Purple teaming is a collaborative security exercise in which the offensive red team and the defensive blue team work together, replaying attack techniques so the defenders can observe, detect and improve their response in real time. It turns an adversarial red team engagement into a shared improvement exercise that measurably strengthens detection coverage.
Read definitionAlert Fatigue
Alert fatigue is the desensitisation that occurs when security analysts are exposed to a high volume of alerts, many of them false positives or low priority, causing genuine threats to be missed, delayed or dismissed. It is a leading cause of missed breaches and analyst burnout, and reducing it is a central goal of well-run security operations.
Read definitionLateral Movement
Lateral movement is the phase of a cyber attack in which an intruder, having gained an initial foothold, moves through a network from system to system to reach higher-value targets. Attackers use techniques such as stolen credentials, remote services and trust relationships to expand access, and detecting lateral movement early is key to containing a breach before it reaches critical assets.
Read definitionCyber Kill Chain
The Cyber Kill Chain is a model, developed by Lockheed Martin, that describes the stages of a cyber attack from initial reconnaissance through to achieving the attacker’s objective. Its seven stages help defenders understand and disrupt attacks: the earlier in the chain a defender can break it, the less damage the attacker can do.
Read definitionMITRE ATLAS
MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a knowledge base of adversary tactics and techniques targeting machine learning and AI systems, modelled on the MITRE ATT&CK framework. It catalogues real-world attacks against AI, from data poisoning to model evasion and prompt injection, giving defenders a structured way to understand and test AI-specific threats.
Read definitionAttack Vector
An attack vector is the path or method an attacker uses to gain unauthorised access to a system or network, such as a phishing email, an exposed service, stolen credentials or a software vulnerability. Understanding an organisation’s attack vectors is fundamental to reducing its attack surface and prioritising defences.
Read definitionPrivilege Escalation
Privilege escalation is the act of gaining higher access rights than originally granted, letting an attacker move from a limited account to an administrative or system-level one. Vertical escalation gains higher privileges; horizontal escalation accesses another user’s resources at the same level. It is a critical step in most intrusions, turning a foothold into control.
Read definitionData Exfiltration
Data exfiltration is the unauthorised transfer of data from within an organisation to an external location controlled by an attacker. It is the theft stage of many breaches, in which sensitive information such as customer records, credentials or intellectual property is copied out of the environment. Detecting and preventing exfiltration is a key defence against the damage of a breach.
Read definitionSupply Chain Attack
A supply chain attack compromises an organisation indirectly by targeting a trusted third party, such as a software vendor, dependency or service provider, that has access to or is embedded within the target’s environment. By compromising one supplier, an attacker can reach many downstream victims at once, making these attacks especially damaging.
Read definitionZero-Day Exploit
A zero-day exploit is an attack that targets a vulnerability unknown to the software vendor and for which no patch exists. The name refers to the vendor having had zero days to fix it. Zero-days are highly valuable to attackers because defences based on known signatures cannot detect them and no official fix is yet available.
Read definitionAPT (Advanced Persistent Threat)
An advanced persistent threat (APT) is a sophisticated, well-resourced adversary, often state-sponsored, that gains and maintains long-term access to a target’s network to pursue strategic objectives such as espionage or disruption. APTs are characterised by patience, stealth and advanced techniques, and they prioritise remaining undetected over quick gains.
Read definitionIOC (Indicators of Compromise)
Indicators of compromise (IOCs) are pieces of forensic evidence that suggest a system or network has been breached, such as malicious file hashes, IP addresses, domains, URLs or registry keys. Security teams use IOCs to detect known threats, scope incidents and share threat intelligence, though modern detection increasingly complements them with behavioural indicators.
Read definitionThreat Actor
A threat actor is an individual or group responsible for a cyber security threat or attack. Threat actors range from state-sponsored groups and organised criminals to hacktivists and insiders, each with distinct motivations, capabilities and techniques. Understanding the threat actors relevant to an organisation helps focus defences on the attacks it is actually likely to face.
Read definitionThreat Hunting
Threat hunting is the proactive practice of searching through an environment for signs of malicious activity that has evaded automated detection. Rather than waiting for alerts, threat hunters form hypotheses about how an attacker might operate and investigate for evidence, uncovering intrusions that would otherwise remain hidden and improving detection in the process.
Read definitionPhishing
Phishing is a social engineering attack in which an attacker sends fraudulent messages, usually email, designed to trick recipients into revealing credentials, transferring money, or running malicious content. Phishing is the most common initial-access technique in real-world breaches, and defending against it combines technical controls with security awareness training.
Read definitionBEC (Business Email Compromise)
Business email compromise (BEC) is a targeted attack in which a fraudster impersonates a trusted party, such as an executive, supplier or colleague, over email to trick an organisation into transferring money or sensitive data. BEC relies on social engineering rather than malware, and it is one of the most financially damaging categories of cyber crime.
Read definitionSpoofing Attack
A spoofing attack is one in which an attacker disguises their identity or falsifies data to appear as a trusted source. Spoofing spans email, caller ID, IP addresses, DNS, websites and more, and it underpins many other attacks, from phishing to man-in-the-middle interception, by convincing a system or person that a malicious source is legitimate.
Read definitionWhere these terms apply
Definitions are the starting point. See how exposure management, vulnerability prioritisation and threat intelligence work in practice.