Technical Glossary
The coordinated execution of defensive security activities including monitoring, detection, analysis, and response to protect organizational networks and information systems from cyber threats. Defense operations integrate people, processes, and technology across security operations centers to maintain continuous situational awareness and rapid incident response capabilities. Effective operations require standardized procedures, trained personnel, and integrated tooling that enables coordinated defensive action. NIST SP 800-61 provides the incident handling framework that underpins structured cyber defense operations.
A defensive architecture strategy that divides networks into isolated segments to limit lateral movement, contain breaches, and enforce granular access controls between organizational network zones. Microsegmentation extends this concept to individual workloads and applications using software-defined networking policies that restrict communication to only authorized paths. Effective segmentation reduces the attack surface and blast radius of successful intrusions by preventing unrestricted east-west traffic flow. NIST zero trust architecture guidelines identify microsegmentation as a foundational control for implementing least-privilege network access.
A security technology category that continuously monitors endpoint devices to detect suspicious activities, provide investigation capabilities, and enable rapid response actions against identified threats. EDR solutions collect telemetry data from endpoints including process execution, file modifications, network connections, and registry changes to build comprehensive activity timelines. Advanced EDR platforms incorporate machine learning for behavioral detection and automated containment of confirmed threats. NIST guidelines on endpoint security recommend EDR as a critical component of enterprise threat detection and incident response capabilities.
A systematic evaluation of the current and emerging cyber threats facing an organization based on industry sector, geographic presence, technology stack, and adversary targeting patterns. Assessments analyze threat actor capabilities, motivations, and historical attack patterns to produce risk-ranked threat profiles that inform defensive prioritization decisions. AI-enhanced assessment tools continuously update threat landscapes by correlating global threat intelligence feeds with organizational exposure data. NIST and ENISA publish periodic threat landscape reports that serve as authoritative references for organizational security planning.
The automated coordination of security tools, workflows, and team actions during cyber incident response to ensure consistent, rapid, and effective containment and remediation. Orchestration platforms execute predefined playbooks that automate evidence collection, stakeholder notification, containment actions, and recovery procedures across integrated security infrastructure. Machine learning optimizes orchestration by learning from past incidents to recommend improved response sequences and resource allocation. NIST SP 800-61 Rev 2 provides the incident handling lifecycle that orchestration platforms operationalize through automation.
A continuous process of assessing, measuring, and improving an organization's overall cybersecurity readiness through automated configuration monitoring, vulnerability management, and compliance validation across all IT assets. Cloud security posture management extends these capabilities to infrastructure-as-a-service, platform-as-a-service, and software-as-a-service environments. AI analytics provide risk-scored dashboards that aggregate security metrics from multiple domains into unified organizational risk views. NIST Cybersecurity Framework functions of Identify, Protect, Detect, Respond, and Recover provide the structural foundation for comprehensive posture management programs.
A layered security approach that deploys multiple overlapping defensive controls across network, host, application, and data layers to ensure that the failure of any single control does not result in a complete security breach. Each layer provides independent detection and prevention capabilities so that threats must overcome multiple barriers to achieve their objectives. AI enhances defense in depth by enabling intelligent coordination between layers and dynamic adjustment of defensive postures based on threat conditions. NIST and NSA have published guidance establishing defense in depth as a fundamental principle of information assurance architecture.
An AI-driven approach to ranking and prioritizing software vulnerabilities based on contextual risk factors including exploitability, asset criticality, threat actor activity, and environmental exposure rather than relying solely on static CVSS scores. Prioritization systems integrate data from vulnerability scanners, threat intelligence feeds, and asset management databases to calculate dynamic risk scores that reflect actual organizational exposure. Machine learning models predict which vulnerabilities are most likely to be exploited based on historical exploit development patterns and dark web chatter. The CISA Known Exploited Vulnerabilities catalog provides a critical input for evidence-based vulnerability prioritization.
An AI-powered educational platform that delivers personalized cybersecurity training, phishing simulations, and risk assessments to employees based on their roles, behavior patterns, and demonstrated knowledge gaps. Adaptive learning engines adjust training content difficulty and frequency based on individual performance metrics and departmental risk profiles. These platforms measure human risk reduction through behavioral analytics that track click rates, reporting rates, and policy compliance over time. NIST SP 800-50 provides guidelines for building information security awareness and training programs within organizations.
Security solutions that protect cloud-native workloads including containers, serverless functions, and virtual machines through runtime monitoring, vulnerability scanning, and behavioral analysis across hybrid and multi-cloud environments. These platforms provide visibility into workload configurations, network communications, and process execution to detect threats that exploit cloud-specific attack surfaces. AI-driven workload protection adapts security policies based on workload behavior profiles and automatically responds to detected anomalies. NIST SP 800-190 provides specific guidance on container security, a core component of modern cloud workload protection.
Advanced defensive operations that deploy AI-managed networks of honeypots, honeynets, and synthetic personas to detect adversary reconnaissance, manipulate attacker decision-making, and gather intelligence on threat actor techniques and objectives. Deception operations create controlled environments where adversary interactions are closely monitored to extract indicators of compromise and behavioral signatures without risking production systems. Machine learning dynamically adjusts deception environments to maintain credibility as attackers probe for authenticity indicators. MITRE Shield and NIST research frameworks document deception as a legitimate active defense technique for cyber operations.
The policies, procedures, and technology infrastructure for generating, distributing, storing, rotating, and revoking cryptographic keys used to protect data confidentiality, integrity, and authenticity across enterprise systems. Effective key management ensures that encryption provides meaningful security by preventing unauthorized access to key material throughout its lifecycle. Hardware security modules, key management interoperability protocols, and automated rotation systems form the technical foundation of enterprise key management programs. NIST SP 800-57 provides the comprehensive three-part framework for cryptographic key management recommendations.
An ongoing surveillance program that maintains real-time awareness of security threats, vulnerabilities, and policy compliance across an organization's information systems through automated data collection and analysis. Continuous monitoring systems provide persistent visibility into configuration changes, access patterns, and threat indicators that enable timely detection of security events and deviations from baseline security postures. AI analytics enhance monitoring by reducing alert noise, correlating events across data sources, and identifying emerging threat patterns. NIST SP 800-137 provides the authoritative guidance for implementing information security continuous monitoring programs.
A continuous process of discovering, inventorying, classifying, and monitoring all externally facing digital assets to identify and reduce potential entry points that adversaries could exploit to gain unauthorized access. Attack surface management platforms use automated reconnaissance techniques including DNS enumeration, certificate transparency monitoring, and port scanning to maintain comprehensive asset inventories. AI-driven analysis correlates discovered assets with vulnerability data and threat intelligence to prioritize remediation of the highest-risk exposure points. NIST cybersecurity framework functions support attack surface management as a core element of the Identify and Protect functions.
A cloud-native network architecture that converges wide-area networking capabilities with security functions including secure web gateway, cloud access security broker, zero trust network access, and firewall-as-a-service into a unified platform delivered from the network edge. SASE reduces complexity by eliminating the need for multiple standalone security appliances while providing consistent policy enforcement for users regardless of their location or device. AI-powered SASE implementations optimize traffic routing, detect threats at the edge, and enforce context-aware access policies based on user identity, device posture, and data sensitivity. NIST zero trust architecture principles align closely with the SASE model for securing distributed enterprise environments.