Security Glossary

Security Glossary

Plain definitions for the terms that appear throughout CVEDaily coverage — written for practitioners, without marketing language. Where a term has an official definition from NIST, MITRE, or CISA, we follow it.

APT (Advanced Persistent Threat)

A threat actor — usually state-sponsored or state-aligned — that maintains long-term, stealthy access to a target rather than seeking immediate financial gain. APT groups are tracked under numbered or named designations (APT29, Lazarus) that differ between vendors, since each research team names what it observes independently.

Attack Surface

The complete set of points where an unauthorized actor could attempt to enter or extract data from a system: exposed services, APIs, credentials, third-party integrations, and the people with access. Reducing attack surface means removing what is not needed, not just defending what is there.

C2 (Command and Control)

The infrastructure an attacker uses to communicate with compromised machines — issuing commands and receiving stolen data. C2 traffic is often disguised as normal HTTPS, DNS, or traffic to legitimate cloud services, which is why detection focuses on behavior and destination reputation rather than payload alone.

Credential Stuffing

Automated login attempts using username and password pairs leaked from an unrelated breach, exploiting password reuse. It is not a brute-force attack: the credentials are already valid somewhere. Rate limiting alone is a weak defense; MFA and breached-password screening are effective ones.

CVE (Common Vulnerabilities and Exposures)

A unique public identifier for a specific vulnerability, formatted as CVE-YEAR-NUMBER, assigned by MITRE or an authorized CNA. A CVE ID is a label for tracking, not a severity rating — it says a flaw exists and has been catalogued, nothing about how urgent it is.

CVSS (Common Vulnerability Scoring System)

An open standard that scores a vulnerability’s technical severity from 0.0 to 10.0 based on how it can be exploited and what it compromises. CVSS measures theoretical severity in isolation — it does not account for whether the flaw is being exploited in the wild, or whether the affected product is critical in your environment. Use it as one input to prioritization, not the answer.

Data Breach

A confirmed incident in which data was accessed or removed by an unauthorized party. CVEDaily distinguishes confirmed breaches — supported by a company statement or regulatory filing — from unverified claims posted by threat actors, which are labeled as such.

Double Extortion

A ransomware tactic that combines encryption with data theft: victims are pressured to pay both to restore systems and to prevent stolen data from being published. It is why reliable backups alone no longer neutralize a ransomware incident.

EDR (Endpoint Detection and Response)

Software on endpoints that records process, file, and network behavior, flags suspicious activity, and lets responders investigate or isolate a machine remotely. It detects behavior rather than known file signatures, which is what separates it from traditional antivirus.

EPSS (Exploit Prediction Scoring System)

A FIRST-maintained model that estimates the probability a given vulnerability will be exploited in the wild within the next 30 days, expressed from 0 to 1. It complements CVSS: severity tells you how bad exploitation would be, EPSS estimates how likely it is.

Exploit

Code or a technique that turns a vulnerability into a working attack. The existence of a vulnerability is not the same as the existence of an exploit, and a public exploit dramatically shortens the time defenders have.

Hardening

Reducing a system’s exposure by disabling unused services, tightening default configurations, restricting privileges, and enforcing secure settings — typically against a published baseline such as the CIS Benchmarks. It reduces what an attacker can reach even when a vulnerability exists.

IOC (Indicator of Compromise)

An observable artifact suggesting a system was compromised: a file hash, a C2 domain or IP, a registry key, an unusual scheduled task. IOCs are useful for hunting past intrusions but age quickly, since attackers rotate infrastructure.

Initial Access Broker

A criminal specialist who breaks into organizations and sells that access — VPN credentials, RDP sessions, web shells — to other actors, typically ransomware operators. Their existence is why a stolen credential from months ago can precede an attack today.

KEV (Known Exploited Vulnerabilities Catalog)

CISA’s authoritative list of vulnerabilities confirmed to be exploited in the wild. A KEV listing carries a binding remediation deadline for U.S. federal civilian agencies, and functions as a strong prioritization signal for everyone else. We track every entry and its patch lag at cvedaily.io/kev.

Lateral Movement

The stage after initial compromise in which an attacker moves from the first machine to more valuable systems, usually with stolen credentials and legitimate administrative tools. Because the tooling looks normal, detection depends on spotting unusual account and access patterns.

MFA (Multi-Factor Authentication)

Requiring more than one type of proof to authenticate — something you know plus something you have or are. It defeats most credential-based attacks, though push-notification MFA remains vulnerable to fatigue attacks; phishing-resistant methods such as FIDO2 hardware keys do not share that weakness.

MITRE ATT&CK

A public knowledge base that catalogues real-world adversary behavior as tactics (the goal) and techniques (the method), each with a stable identifier such as T1566. It gives defenders a shared vocabulary for describing what an attacker did and for measuring detection coverage.

Mitigation vs. Remediation

Remediation removes the vulnerability — typically by applying a vendor patch. Mitigation reduces exposure without fixing the underlying flaw: disabling a feature, blocking a port, adding a WAF rule. Mitigations buy time when a patch is unavailable or cannot be deployed immediately; they are not a permanent substitute.

NVD (National Vulnerability Database)

The U.S. government repository, maintained by NIST, that enriches published CVE records with CVSS scores, affected version ranges (CPE), and references. It is the standard machine-readable source for vulnerability data, though enrichment can lag disclosure.

Patch Tuesday

The second Tuesday of each month, when Microsoft and several other vendors release scheduled security updates. Out-of-band releases fall outside this cycle and usually signal something urgent, such as active exploitation.

Phishing

Deceiving a person into revealing credentials, approving an authentication prompt, or running attacker-supplied code, usually by impersonating a trusted party. Targeted variants aimed at specific individuals are called spear phishing; those aimed at executives, whaling.

PoC (Proof of Concept)

Code demonstrating that a vulnerability is genuinely exploitable, often published by researchers after disclosure. Public PoC release is a reliable predictor of a jump in exploitation attempts. CVEDaily reports that a PoC exists and what it means for urgency, but does not publish exploit code.

Privilege Escalation

Gaining rights beyond those originally granted — from a standard user to administrator (vertical), or to another user’s data at the same level (horizontal). Chained with a low-severity entry point, a privilege escalation flaw often turns a minor foothold into full compromise.

RCE (Remote Code Execution)

A vulnerability class allowing an attacker to run arbitrary code on a target over the network. Unauthenticated RCE on an internet-facing service is the most urgent category in vulnerability management, because it requires no credentials and no user interaction.

Ransomware

Malware that encrypts data and demands payment for the decryption key, now typically paired with data theft (see double extortion). Most modern operations run as ransomware-as-a-service, where affiliates conduct intrusions using another group’s tooling and split the proceeds.

SBOM (Software Bill of Materials)

A machine-readable inventory of the components and dependencies inside a piece of software. Its practical value appears when a widely used library is found vulnerable: an SBOM answers “where do we run this?” in minutes instead of weeks.

SIEM (Security Information and Event Management)

A platform that centralizes logs from across an environment, correlates them against detection rules, and raises alerts for investigation. Its usefulness depends entirely on log coverage and rule quality — a SIEM without the right data sources detects nothing.

SOC (Security Operations Center)

The team responsible for monitoring, triaging, and responding to security alerts, whether in-house or outsourced to a managed provider. SOC effectiveness is usually measured by time to detect and time to respond.

SQL Injection

Inserting attacker-controlled input into a database query so it executes as SQL, allowing data to be read, modified, or deleted. It is decades old and still routinely found, because it stems from building queries by string concatenation instead of parameterized statements.

SSRF (Server-Side Request Forgery)

Tricking a server into making requests on the attacker’s behalf, reaching internal systems that are not exposed to the internet. In cloud environments it is especially dangerous, since it can be used to reach instance metadata services and steal credentials.

Supply Chain Attack

Compromising an organization through something it trusts and installs — a software update, an open-source dependency, a managed service provider — rather than attacking it directly. One successful compromise upstream reaches every downstream customer at once.

Threat Actor

Any individual or group conducting malicious activity, from criminal ransomware crews to state intelligence services. Attribution is probabilistic and based on overlapping infrastructure, tooling, and behavior — which is why responsible reporting states the confidence level and the source of an attribution claim.

TTP (Tactics, Techniques, and Procedures)

The characteristic behavior of a threat actor: what they aim to achieve, how they achieve it, and the specific way they execute it. TTPs are harder for an attacker to change than infrastructure, which makes behavior-based detection more durable than IOC matching.

Vulnerability Management

The ongoing process of discovering, prioritizing, remediating, and verifying vulnerabilities across an environment. The hard part is not scanning, it is prioritization: deciding which of thousands of findings actually warrant an emergency change, based on exploitation status, exposure, and business impact.

XSS (Cross-Site Scripting)

Injecting script into a web page that then executes in another user’s browser, enabling session theft or actions taken as that user. Stored XSS persists on the server and affects every visitor to the page; reflected XSS requires delivering a crafted link to each target.

Zero-Day

A vulnerability exploited before a patch exists — the vendor has had zero days to fix it. The term is often stretched to mean any new or unpatched flaw; strictly, it refers to exploitation preceding a fix, which is what makes it urgent.

Missing a term?

If you hit a term in our coverage that is not defined here, tell us at contact@cvedaily.io and we will add it. How we source and verify everything we publish is documented in our Editorial & Data Methodology.