Glossary

Event-Triggered Review

Reviewing and updating a policy in response to a triggering event, a breach, regulatory change, audit finding, or major business shift, rather than waiting for the scheduled review cycle, so policies stay current with reality.

Events

Individual records of something that happened on a system or network, a logon, a connection, a file change, that are logged and analyzed. Events are the raw units of telemetry that detection and investigation are built on.

Evidence Collection

Gathering and preserving the data that supports an investigation, logs, artifacts, screenshots, and records, in a sound, documented way so it accurately reflects what happened and can support decisions or later review.

Evidence Management

The GRC practice of organizing, storing, and maintaining compliance evidence, control proof, logs, records, so it is current, traceable, and readily available for audits, rather than scrambled together at the last minute.

Evidence Practices

The end-to-end practices for handling compliance evidence in a security program, how it is collected, organized, validated, and presented, applied as part of building and running a coherent program in the capstone context.

Evidence Repository

A central, organized store where compliance evidence is kept, control proof, logs, policies, and records, so it is preserved, version-tracked, and easy to retrieve for audits and ongoing compliance.

Evidence Retention

Keeping compliance evidence for the required length of time, set by frameworks, regulations, or audit needs, so it remains available to demonstrate that controls operated over the relevant period, then disposing of it appropriately.

Evidence Strategy

In threat hunting, the plan for what data and evidence a hunt will examine to test its hypothesis, which sources, fields, and time ranges, so the hunt actually has the visibility to confirm or refute what it is looking for.

Evidence Types

The different forms compliance evidence can take, such as configuration exports, logs, screenshots, policies, tickets, and attestations, each suited to proving different kinds of controls. Knowing the types helps gather the right proof per control.

Evidence-Based Assessment

A security analyst practice of grounding every finding in concrete, verifiable evidence rather than assumption, so assessment conclusions are accurate, defensible, and credible to the people who must act on them.

Exception Abuse Patterns

The recurring ways policy exceptions get misused, such as permanent 'temporary' exceptions, stacking exceptions to bypass a control entirely, or using them to avoid rather than manage risk, that undermine policy if left unchecked.

Exception Escalation

Routing a policy exception request to the appropriate level of authority for review and approval based on its risk, so higher-risk exceptions get senior scrutiny rather than being rubber-stamped at a low level.

Exception Process Design

Designing how policy exceptions are requested, reviewed, approved, tracked, and expired, so deviations from policy are managed as deliberate, time-bound, accountable risk decisions rather than uncontrolled loopholes.

Excessive Permissions

A cloud misconfiguration where an identity or resource is granted far more access than it needs, violating least privilege and giving an attacker who compromises it broad reach. It is one of the most common and dangerous cloud weaknesses.

Exclusion

A deliberately defined condition under which a detection will not fire, used to suppress known-benign activity that would otherwise be a false positive, narrowing a detection without weakening its ability to catch real threats.

Executable Path

The full filesystem location a program runs from, which is valuable security context: legitimate software usually runs from expected directories, so a process running from an unusual path is a strong signal of suspicious activity.

Execution

The attacker tactic of running malicious code on a target system, the step where a payload, script, or command actually runs, turning access into action. It is a pivotal stage that detections heavily target.

Executive Communication

Briefing executives during an incident in clear, business-focused terms, what is happening, the impact, what decisions are needed, without technical jargon, so leadership can make timely decisions and fulfill their responsibilities.

Executive Crisis Communication

How incident leadership communicates with and on behalf of executives during a major incident, coordinating leadership messaging, decisions, and external statements at the highest level, often with legal and board involvement.

Executive Risk Communication

Conveying risk to executives in a way they can act on, framing it in business and financial terms, focusing on decisions and trends rather than technical detail, so leaders can govern risk and set direction.

Exfiltration

Unauthorized movement of data out of an environment.

Exposed Databases

A cloud misconfiguration where a database is reachable from the public internet or lacks proper access controls, exposing potentially sensitive data. It is a frequent and high-impact cause of cloud data breaches.

Exposure

A condition where a system, service, data, or weakness can be reached or affected.

External Audit Cycles

The recurring schedule and phases of external audits, planning, fieldwork, testing, reporting, and follow-up, that organizations and audit firms move through, often annually, to provide independent assurance over controls.

External Audit Firm Career

A career path working as an auditor within an external audit or accounting firm, progressing from staff auditor through senior, manager, and partner, building assurance skills across many client engagements.

External Communication

Communicating with parties outside the organization during an incident, customers, partners, regulators, and the public, in a coordinated, accurate way that meets obligations and protects trust while avoiding premature or damaging statements.

External IR Coordination

Coordinating with outside parties during a major incident from a leadership standpoint, external responders, forensics firms, law enforcement, regulators, and partners, so their involvement is managed coherently rather than ad hoc.

External IR Support

Outside help brought in during an incident, such as incident-response retainers, forensics specialists, or threat-intelligence providers, when an incident exceeds the internal team's capacity, expertise, or capacity for objectivity.

External Risk Sources

Risks that originate outside the organization, such as threat-actor activity, regulatory change, supply-chain and vendor risk, economic shifts, and geopolitical events, that risk identification must look beyond internal assets to capture.

External Secrets

A pattern for managing secrets in cloud-native systems where applications fetch credentials from an external secrets manager at runtime, rather than storing them in the cluster, keeping sensitive values out of manifests and source control.

eBPF-Based Observability

Using eBPF, a technology that safely runs custom programs inside the Linux kernel, to observe system and network activity at a deep level for security, capturing process, file, and network events with low overhead.