Glossary

Exclusion

A deliberately defined condition under which a detection will not fire, used to suppress known-benign activity that would otherwise be a false positive, narrowing a detection without weakening its ability to catch real threats.

Executable Path

The full filesystem location a program runs from, which is valuable security context: legitimate software usually runs from expected directories, so a process running from an unusual path is a strong signal of suspicious activity.

Execution

The attacker tactic of running malicious code on a target system, the step where a payload, script, or command actually runs, turning access into action. It is a pivotal stage that detections heavily target.

Executive Crisis Communication

How incident leadership communicates with and on behalf of executives during a major incident, coordinating leadership messaging, decisions, and external statements at the highest level, often with legal and board involvement.

Executive Risk Communication

Conveying risk to executives in a way they can act on, framing it in business and financial terms, focusing on decisions and trends rather than technical detail, so leaders can govern risk and set direction.

Exfiltration

Unauthorized movement of data out of an environment.

Exposed Databases

A cloud misconfiguration where a database is reachable from the public internet or lacks proper access controls, exposing potentially sensitive data. It is a frequent and high-impact cause of cloud data breaches.

Exposure

A condition where a system, service, data, or weakness can be reached or affected.

External Audit Cycles

The recurring schedule and phases of external audits, planning, fieldwork, testing, reporting, and follow-up, that organizations and audit firms move through, often annually, to provide independent assurance over controls.

External Audit Firm Career

A career path working as an auditor within an external audit or accounting firm, progressing from staff auditor through senior, manager, and partner, building assurance skills across many client engagements.

External Communication

Communicating with parties outside the organization during an incident, customers, partners, regulators, and the public, in a coordinated, accurate way that meets obligations and protects trust while avoiding premature or damaging statements.

External IR Coordination

Coordinating with outside parties during a major incident from a leadership standpoint, external responders, forensics firms, law enforcement, regulators, and partners, so their involvement is managed coherently rather than ad hoc.

External IR Support

Outside help brought in during an incident, such as incident-response retainers, forensics specialists, or threat-intelligence providers, when an incident exceeds the internal team's capacity, expertise, or capacity for objectivity.

External Risk Sources

Risks that originate outside the organization, such as threat-actor activity, regulatory change, supply-chain and vendor risk, economic shifts, and geopolitical events, that risk identification must look beyond internal assets to capture.

External Secrets

A pattern for managing secrets in cloud-native systems where applications fetch credentials from an external secrets manager at runtime, rather than storing them in the cluster, keeping sensitive values out of manifests and source control.

FAIR Factors in Depth

A detailed look at the factors in the FAIR model that combine to produce risk, breaking loss event frequency and loss magnitude into their contributing sub-factors so each can be estimated and analyzed precisely.

FAIR Methodology

FAIR (Factor Analysis of Information Risk) is a quantitative method for analyzing risk in financial terms, decomposing it into loss event frequency and loss magnitude and using calibrated estimates to produce a measured range of probable loss.

FAIR Ontology

The structured taxonomy at the heart of FAIR that defines each risk factor and how they relate, loss event frequency and loss magnitude and their sub-factors, giving a precise, shared vocabulary for decomposing and analyzing risk.

FAIR Practice Development

Building the capability to do FAIR analysis well over time, developing analysts' calibration and modeling skills, refining processes, and maturing how an organization performs quantitative risk analysis.

FAIR Program Integration

Embedding FAIR quantitative analysis into the organization's broader risk-management program, so quantified results feed risk registers, prioritization, reporting, and decisions rather than living as standalone analyses.

FAIR Program Metrics

The measures used to track the value and maturity of a FAIR quantitative-risk program, such as how many decisions it informed, the consistency and accuracy of estimates, and the program's coverage and efficiency.

FAIR Scenario Definition

Precisely framing the risk scenario to be analyzed in FAIR, specifying the asset at risk, the threat, and the type of loss event, so the analysis measures a well-bounded, meaningful risk rather than something vague.

FAIR Sensitivity Analysis

Examining which input factors most affect a FAIR analysis's result, so analysts know where estimate uncertainty matters most and where to focus effort to refine the model or reduce risk.

FAIR in Context

Understanding where the FAIR quantitative risk model fits among other risk approaches and when to use it, recognizing its strengths for financial risk analysis and its place alongside qualitative methods and broader risk frameworks.

FIDO2

An open authentication standard that enables strong, phishing-resistant, passwordless login using public-key cryptography and hardware or platform authenticators, such as security keys or device biometrics, instead of passwords.

FTP

File Transfer Protocol: an old protocol for transferring files between systems that sends data and credentials in plaintext, making it insecure and a notable risk when found, since traffic can be intercepted.

False Positive

An alert that appears suspicious but is not actually harmful.

False Positive Analysis

Investigating why a detection fired on benign activity, in detection engineering, so the rule can be tuned to reduce noise without losing its ability to catch real threats. It turns false positives into targeted improvements.

False Positive Management

In vulnerability management, the process of identifying scanner findings that are not actually exploitable or present, validating them, and suppressing them, so remediation effort focuses on real vulnerabilities rather than scanner noise.

False Positives

Alerts that flag benign activity as malicious, a detection firing when nothing bad actually happened. High false-positive rates waste analyst time, cause alert fatigue, and erode trust in detections, so reducing them is a constant goal.

FedRAMP

The US government program that standardizes security assessment and authorization for cloud services used by federal agencies, so a cloud provider authorized once can be trusted across government under a common baseline.