Glossary

WMI Event Subscriptions

A Windows persistence mechanism using WMI's event-subscription model to run code on specified triggers, popular with attackers because it's flexible, fileless, and easy to overlook.

War Room

A dedicated space (physical or virtual) where the incident response team coordinates during a major incident, with continuous presence, fast decisions, and tight communication.

Warm Standby

A disaster-recovery strategy where a backup environment is partially provisioned and kept ready, faster than rebuilding cold, cheaper than running hot, a middle DR posture.

Web App Incident Response

Incident response for web applications, identifying the attack vector (injection, broken auth, supply chain), scoping impact, containing without destroying evidence, with web-specific demands.

Web Application

A program delivered over HTTP/HTTPS that runs in browsers (client) and on servers, the dominant application form on the internet and the primary attack surface for defensive-web work.

Web Application Assessment

A security assessment focused on a web application, covering its inputs, authentication, authorization, business logic, and dependencies, following an established methodology like OWASP WSTG.

Web Application Firewall

A control that inspects web traffic and can block common attack patterns.

Web Assessment Methodology

The structured methodology used in web-application security assessments, scoping, recon, mapping, testing categories in order, reporting, that produces repeatable, thorough coverage.

Web Authentication

How web applications authenticate users, password-based, OIDC/social, passkeys, with the session and token mechanisms that maintain login. A foundational defensive-web topic.

Web Client

The software that consumes a web service or page, typically a browser, but also mobile apps, scripts, or bots. Defenders treat all clients as untrusted because anything can speak HTTP.

Web Server

Software that receives HTTP requests and serves responses, Apache, Nginx, IIS, or an application framework. The server side of the trust boundary in web defense.

WebAuthn

Web Authentication, the W3C standard that enables phishing-resistant authentication in browsers using public-key cryptography and authenticators (hardware keys, platform biometrics). The basis for passkeys.

Well-Known Ports

Standardized TCP/UDP ports (0-1023) reserved for common services, like 22 for SSH, 80 for HTTP, 443 for HTTPS. Foundational networking knowledge defenders use constantly.

Windows Event Log

Windows' built-in event logging system, the primary source of security telemetry for Windows hosts, covering authentication, process creation, services, and many other event categories.

Windows Registry

Windows' hierarchical configuration database storing settings, software keys, autostarts, and more. A primary defender's data source and a major attacker target for persistence.

Windows SID

Security Identifier, the unique value Windows uses to identify a security principal (user, group, computer). Defenders read SIDs to identify subjects in audit logs and ACLs.

Workload Detection

Detecting threats inside cloud workloads, VMs, containers, serverless, by combining runtime telemetry with cloud-context signals, a defining cloud-workload-protection capability.

Workload IR

Incident response specifically for cloud workloads, VMs, containers, serverless, that uses cloud-context data alongside endpoint techniques to investigate and contain workload-level incidents.

Workload Identity

An identity assigned to software or infrastructure so it can access resources without static secrets.

Workload Identity Federation

Letting workloads (VMs, pods, functions) authenticate to cloud services using their own identity (not long-lived credentials), via trust between identity providers and cloud platforms.

Workload Onboarding

The process of bringing new cloud workloads under the protection program, agents installed, telemetry connected, posture checked, tagged for ownership, that ensures coverage scales with the estate.

Workload Protection

From a cloud-engineering perspective, protecting cloud workloads holistically, image, configuration, runtime, identity, the practical work of securing what actually runs.

Workload Security at Scale

Operating workload protection across many cloud workloads sustainably, automation, standardization, self-service, that distinguishes a working program from one that breaks under growth.

Writable Paths

Filesystem paths an account or process can write to, which on Windows and Linux can become privilege-escalation paths if the contents are later executed or read by something more privileged.