Glossary

VLANs

Virtual LANs: logical segmentation of a physical network into separate broadcast domains, used to isolate traffic and enforce segmentation without separate physical infrastructure.

VM Configuration Management

Managing the configuration of cloud VMs at scale, baselines, drift detection, automated remediation, so workloads stay aligned to expected state instead of diverging silently.

VM Detection Patterns

The patterns that detect threats and misconfigurations on cloud VMs, suspicious processes, lateral-movement signs, configuration drift, runtime anomalies, that cloud-workload-protection programs operationalize.

VM Exception Management

Managing exceptions in vulnerability management, the cases where a vulnerability can't be remediated in the normal window, with documented rationale, compensating controls, and expiration.

VM Integration

Integrating vulnerability management with adjacent functions, asset inventory, patching, ticketing, IR, so VM data flows into operational work rather than sitting in standalone reports.

VM Maturity Model

A model for assessing vulnerability-management program maturity from basic scanning through risk-prioritized, integrated, automated remediation, that helps programs see where they are and where to invest next.

VM Patching at Cloud Scale

Patching cloud VM fleets at scale, often via image rebuilds or scheduled rolling updates, rather than in-place patches, since cloud-native patterns favor replace over update.

VM Program Metrics

The metrics that measure a vulnerability-management program, MTTR, SLA compliance, critical-vulnerability backlog, scan coverage, that give leaders a credible view of program health.

VM Reporting to Leadership

Communicating vulnerability-management posture and progress to leadership clearly and credibly, what's at risk, what's improving, what investments help, that turns VM data into decision support.

VM Runtime Protection

Protecting cloud VMs at runtime, monitoring process behavior, file changes, network connections, often via EDR or specialized cloud-workload agents, complementing configuration and image controls.

VM Security in Cloud

Securing cloud VMs from a cloud-engineering perspective, image, IAM, network, encryption, hardening, that an engineer implements as part of cloud infrastructure work.

VM-specific Cloud Telemetry

Telemetry distinct to cloud VMs, metadata-service access, control-plane API calls, instance-level network logs, that goes beyond on-prem endpoint data and is essential for cloud workload detection.

VPC Assessment

A structured assessment of a VPC (or set of VPCs) for security, posture, routing, segmentation, exposure, and connectivity, used to find misconfigurations and risky design choices.

VPC Design

Designing a VPC (or set of VPCs) for security and operations, subnet layout, routing, gateways, segmentation, the engineering decisions that shape what's possible to enforce later.

VPC Flow Log Analysis

Analyzing VPC flow logs (per-flow records of who talked to whom, when, and how much) to investigate cloud incidents, detect anomalies, and verify connectivity, a key cloud IR data source.

VPN Limitations

Limitations of traditional VPNs that drive zero-trust adoption, perimeter trust on connect, lateral movement once inside, weak device posture, that ZTA replaces with continuous, per-request verification.

Valid Accounts

An ATT&CK technique: attackers using legitimate, working credentials (stolen, leaked, or default) for access, evasion, and persistence. Often the leading initial-access vector in modern breaches.

Validating Webhooks

Verifying that webhook requests come from the expected sender, via signed payloads, HMAC verification, or source-IP checks, since webhook endpoints are publicly reachable and trivially spoofable otherwise.

Vanity Metrics

SOC metrics that look impressive but don't actually drive better outcomes, alerts per day, total signatures deployed, that distract from metrics that matter and can mislead leadership.

Vendor Due Diligence

The structured assessment of a vendor's security and risk posture before engaging or renewing, security questionnaires, SOC 2 review, evidence checks, that grounds the relationship in informed risk acceptance.

Vendor Intelligence

Intelligence specifically about an organization's vendors, their incidents, vulnerabilities, threats targeting them, that informs ongoing third-party risk and supply-chain decisions.

Vendor Landscape

The current map of cloud-workload-protection vendors, their categories, strengths, and overlap, that informs tooling decisions in a fast-evolving market.

Vendor Questionnaires

Structured questionnaires sent to vendors to gather information about their security and risk posture, the most common instrument of TPRM due diligence and a foundational risk-management practice.

Vendor Risk Management

The governance discipline that manages risk arising from third-party vendor relationships, related to TPRM but emphasizing the program and governance lens over operational lifecycle.

Vendor Tiering

Categorizing vendors by criticality and risk so due diligence depth, contractual requirements, and monitoring scale with actual exposure, a foundational TPRM practice.

Vertical Privilege Escalation

Privilege escalation that gains higher-level access than the user has, from regular user to admin, in contrast to horizontal escalation that accesses another peer's account.

Virtual Machine Security

From a cloud-foundations lens, securing cloud VMs end to end, image, configuration, identity, runtime, the workload-layer counterpart to broader cloud security.

Visibility Gap Operationalization

Turning identified visibility gaps into actionable work, telemetry projects, detection coverage, hunt plans, so gaps don't just get logged but get closed.

Visual Analysis

Using visualizations, graphs, heatmaps, timelines, scatterplots, to spot patterns in telemetry that are invisible in tables, a productive hunting technique against rich data.

Vulnerability

A vulnerability is a weakness that could be exploited to harm a system, application, account, or process.

Vulnerability Alerts

Alerts about newly disclosed vulnerabilities relevant to the organization, that analysts triage to assess exposure and decide whether immediate response is needed.

Vulnerability Management

The discipline of identifying, prioritizing, remediating, and verifying vulnerabilities across an organization's systems on an ongoing basis. A defining defensive program alongside detection and IR.