Tech talk.
Translated.

A criminal actor who sells or transfers access to compromised organisations, accounts or systems.

Microsoft directory technology used to manage identities, devices, permissions and policy across an organisation.

Security testing in which AI agents can plan, execute and adapt actions as evidence changes, within an explicitly authorised scope.

Penetration-testing activity that uses AI to increase coverage, speed or repeatability while people retain control of scope and assurance decisions.

A login check that requires two different forms of proof.

A defined way for software systems to exchange data or actions.

The ongoing process of finding, understanding and reducing assets an attacker could reach.

A company approved by the PCI Security Standards Council to perform required external vulnerability scans.

A widely used knowledge base describing how real adversaries behave.

A connected sequence of weaknesses, permissions or actions that could let an attacker reach an objective.

A test that begins from a controlled internal foothold or compromised identity rather than proving the initial entry route.

A defined user type tested with authorised credentials, such as a standard user, administrator or separate tenant.

Fraud that abuses email accounts or impersonation to trick people into sending money or information.

An API flaw that lets a user access another user's data by changing an object identifier.

The rules and workflows that determine how an application should behave for different users and transactions.

Infrastructure an attacker uses to communicate with compromised systems.

A consolidated view of assets and security data from multiple internal sources.

A Bank of England framework for intelligence-led security testing of important financial institutions.

A distributed service that delivers web content from locations closer to users and may provide traffic filtering or caching.

Public logs that record issued TLS certificates so domain owners and researchers can identify certificates associated with internet services.

A prioritised set of safeguards for reducing common cyber risk.

A record confirming the status of reported findings after remediation and retesting.

Software used to create and manage website content, such as WordPress or Drupal.

Three core goals used to think about information security.

The senior leader accountable for an organisation's information-security programme.

Systems and assets whose disruption could seriously affect essential national services.

Continuous checks for insecure cloud configuration and policy drift.

An international not-for-profit accreditation and certification body for the cyber-security industry.

A continuous programme for discovering, prioritising, validating and mobilising action on exposure.

A UK government-backed certification scheme focused on five technical controls that reduce common cyber attacks.

The independently tested level of Cyber Essentials covering the same five technical controls.

A public identifier for a specific disclosed security vulnerability.

Matching observed software and versions to relevant published vulnerability records.

A standard way to express the technical severity of a vulnerability, usually from 0 to 10.

Testing a running application from the outside to find security weaknesses.

An attack that floods a service with traffic from many sources to make it unavailable.

The internet service that maps readable domain names to technical destinations.

Monitoring selected criminal forums, marketplaces, leak sites and closed sources for authorised organisational identifiers.

Technology that monitors laptops, servers and other endpoints for suspicious activity.

Continuous discovery and monitoring of an organisation's internet-facing assets and exposure.

Microsoft's cloud identity and access-management service, formerly called Azure Active Directory.

A probability estimate for whether a published vulnerability is likely to be exploited in the wild soon.

Policies and systems that control who can access which resources.

A reported issue that appears to be a security weakness but is not present or exploitable when properly checked.

An API query language and runtime that lets clients request specific data through a structured schema.

A web-security policy that tells browsers to use encrypted HTTPS connections for a domain.

Review by a qualified tester who checks evidence and investigates important paths within an AI-led or automated scope.

An access-control flaw where changing an identifier exposes another user's object or data.

Evidence that may suggest a system or account has been compromised.

Physical devices that connect to networks and exchange data.

An international standard for establishing, operating and improving an information security management system.

Techniques used to move from one compromised system, identity or service to others within an environment.

Giving people, accounts and systems only the access required to perform their authorised purpose.

The organised process for preparing for, detecting, containing and recovering from security incidents.

Authentication using two or more different factors, such as a password and a device.

Monitoring and analysis used to identify suspicious behaviour across network traffic.

A framework for managing cybersecurity risk using outcomes organised around Govern, Identify, Protect, Detect, Respond and Recover.

European Union legislation that strengthens cybersecurity risk-management and incident-reporting duties for covered organisations.

Information collected legally from publicly available sources.

A nonprofit community that publishes widely used application-security guidance and tools.

A security standard for organisations that store, process or transmit payment-card data.

A delivery model that manages scoping, testing, findings, remediation and retesting through an ongoing platform.

Gaining permissions beyond those originally available to an account or compromised system.

A collaborative security exercise in which offensive testers and defenders work through attack techniques together.

A controlled, objective-led simulation of a credible attacker used to test prevention, detection and response across people, process and technology.

A common architectural style for APIs that operate on resources using standard web methods.

Testing reported weaknesses again after remediation to confirm that the fix works and the material attack path is closed.

A method for expressing the relative urgency of an asset, exposure or finding using technical and contextual evidence.

An organisation-owned base domain used as a starting point for discovering related internet-facing assets.

The authorised objectives, scope, techniques, exclusions, contacts, safety controls and stop conditions for a security test.

A vulnerability that can allow an attacker to run code on a target system from elsewhere.

The target maximum time for restoring a service after disruption.

The maximum acceptable amount of data loss measured in time.

Analysis of source code or compiled code to identify possible security weaknesses without running the application.

An inventory of the software components and dependencies used in a product.

A platform that collects and analyses security logs and events from multiple systems.

A structured messaging protocol commonly used by enterprise web services.

The people, processes and technology responsible for monitoring and responding to security events.

An assurance-reporting framework covering controls relevant to security, availability, processing integrity, confidentiality and privacy.

The older name still commonly used for encrypted web connections and certificates, although modern systems use TLS.

Records created by information-stealing malware that may contain credentials, cookies, device details or other captured data.

Pre-agreed events that require testing activity to pause or end immediately.

Penetration testing shaped by the tactics and objectives of threat actors relevant to the organisation.

A European framework for controlled intelligence-led testing of critical financial entities.

The modern protocol used to encrypt data between services, including HTTPS web connections.

A small authorised control group that governs a covert or sensitive security exercise.

An injection flaw where unsafe input changes a database query.

A flaw that tricks a server into making requests chosen by an attacker.

A defined commitment for service performance, such as response or remediation times.

Patterns describing an adversary's goals, methods and detailed ways of operating.

A systematic process for identifying and evaluating possible weaknesses.

A broad label combining vulnerability identification with manual penetration testing.

A control that filters web traffic to block or limit malicious requests.

Detection and investigation across several security data sources, often endpoints, identity, email and cloud.

A web flaw that allows attacker-controlled script to run in another user's browser.

A vulnerability that is being exploited, or becomes known, before an effective fix is available to defenders.

A security approach that removes inherent network trust and verifies each access request using context and policy.