Glossary

TCP

TCP is a transport protocol that creates reliable, ordered communication between systems.

TCP/IP Model

The layered conceptual model behind internet networking, network access, internet, transport, and application layers, that organizes how data moves end to end across networks.

TEF Estimation

In FAIR, estimating Threat Event Frequency, how often a threat event of interest could occur in a year, by combining contact frequency with probability of action.

TI Analyst Role

The threat-intelligence analyst role: producing and curating intelligence about adversaries and threats to support SOC, IR, and leadership decisions. A distinct path within security analysis.

TI Community

The community of practice around threat intelligence, ISACs, vendor analyst groups, public researchers, that practitioners participate in to share intelligence, sharpen craft, and build reputation.

TI Skills

The skills threat-intelligence analysts develop, source evaluation, structured analytic techniques, writing, attribution, language and OSINT, that are distinct from general SOC analyst skills.

TI Specializations

The areas TI analysts specialize in, threat-actor tracking, malware analysis, geopolitical/strategic, technical/tactical, that let the team cover the breadth of intelligence work in depth.

TI to Adjacent Roles

How threat-intelligence experience leads to adjacent careers, detection engineering, hunting, IR, security research, that use TI skills in different contexts.

TLD

Top-Level Domain, the rightmost component of a domain name like .com, .org, or country-code TLDs like .uk. Defenders track TLDs because some are heavily abused by attackers.

TLP (Traffic Light Protocol)

A simple labeling scheme for intelligence sharing, RED, AMBER, GREEN, CLEAR, that tells recipients who they may share information with, used widely across threat-intelligence communities.

TLS

TLS is a protocol that encrypts network communication and helps verify the identity of the service being contacted.

TOTP

Time-based One-Time Password, a code generated from a shared secret and the current time that changes every 30 seconds. The MFA factor used by Google Authenticator and similar apps.

TPRM Applied

Applying third-party risk management in practice end to end, vendor inventory, tiering, due diligence, contracts, monitoring, that builds a working TPRM function rather than a paper one.

TPRM Lifecycle

The end-to-end lifecycle of third-party risk management, identification, due diligence, contracting, monitoring, offboarding, that the GRC analyst manages through each stage.

TTP Mapping

Mapping observed activity (during a hunt or incident) to specific ATT&CK tactics, techniques, and procedures, so findings tie back to a shared framework for coverage, sharing, and analysis.

TTP-Based Hunting

Threat hunting organized around specific TTPs rather than indicators, looking for adversary behavior (credential dumping, lateral movement patterns) in telemetry to catch threats indicator-based detection misses.

TTPs

Tactics, Techniques, and Procedures: the patterned ways an adversary operates, more durable signals than indicators because attackers tend to keep their methods even when they rotate infrastructure.

TXT Record

A DNS record type that holds arbitrary text. Heavily used for security purposes: SPF, DKIM, DMARC, and domain-ownership verification all rely on TXT records.

Tabletop Exercise

A discussion-based exercise where teams walk through a hypothetical incident scenario, decisions, communications, actions, to test plans and build readiness without touching real systems.

Tabletop Exercise Design

Designing tabletop exercises deliberately, scenario, participants, injects, facilitation, learning objectives, so the exercise actually tests what matters and produces durable improvements.

Tactic

In MITRE ATT&CK terms, the why of an adversary action, the high-level objective like Initial Access, Persistence, or Exfiltration, under which specific techniques sit.

Tactical Intelligence

Intelligence about specific adversary techniques and immediate indicators, useful for hunters and detection engineers writing rules and looking for matches in current telemetry.

Tagging

Labeling alerts, tickets, or cases with structured tags for techniques, severity, source, status, that makes analyst data searchable, reportable, and useful for metrics over time.

Tamper Protection

Hardening that prevents users or malware from disabling or weakening security controls, like turning off antivirus, EDR, or logging. A core defense against well-known attacker tradecraft.

Team Capability

The team's collective skills, depth, and breadth to operate cloud workload protection effectively, recognized as a critical input alongside tools and process when designing a CWP program.

Technical Compliance Metrics

Compliance metrics derived from technical sources, configuration scans, vulnerability data, control telemetry, that make compliance measurable in real time rather than only via point-in-time audits.

Technical Controls

Controls implemented through technology, firewalls, MFA, encryption, EDR, that automate enforcement of security requirements. One of three foundational control categories alongside administrative and physical.

Technical Debt

Accumulated shortcuts, deferred work, and aging components in technology, that create risk over time, security gaps, fragile dependencies, hard-to-fix exposures, that compound until addressed.

Technical Intelligence

Intelligence focused on technical indicators and details, hashes, IPs, vulnerabilities, exploit code, that defenders use directly in tools and rules. Closely related to tactical intelligence.

Technical Skills

The technical capabilities a SOC analyst builds, networking, OS, scripting, SIEM querying, EDR, that enable effective investigation and detection work. Distinct from but complementary to soft skills.

Technique

In ATT&CK terms, the how of an adversary action, the specific method used to achieve a tactic, like Phishing for Initial Access or Process Injection for Defense Evasion.

Telemetry

The data systems generate about their behavior, logs, metrics, traces, events, that defenders collect, store, and analyze to detect threats, investigate incidents, and run security operations.