Glossary

Identity Provider

A service that authenticates users and shares identity information with applications.

Identity Provisioning

Creating and granting access to identities, setting up accounts and assigning the right entitlements when someone joins or needs new access, ideally automated so access is timely, accurate, and based on role.

Identity Risk Scoring

Assigning each identity a risk score based on factors like its access, behavior, anomalies, and policy conflicts, so governance and detection can prioritize the riskiest identities for review, monitoring, or remediation.

Identity Source of Truth

The authoritative system that holds the definitive record of identities, often an HR system for people, from which other systems derive accounts and access, so identity data stays consistent and lifecycle changes propagate reliably.

Identity Telemetry

The activity data generated by identity systems, sign-ins, authentication results, privilege changes, access grants, and federation events, that feeds detection, hunting, and investigation of identity-based threats.

Identity-Centric ZTA

A zero-trust architecture that treats identity as the primary control point, making strong authentication and continuous, context-aware authorization of identities the foundation of access decisions rather than network location.

Image Hardening

Configuring a VM or container image to a secure, minimal state, removing unnecessary packages and services, applying secure settings, and patching, so every workload launched from it starts hardened rather than from an insecure default.

Image Pipeline

The automated process that builds, hardens, scans, and publishes VM or container images, so images are produced consistently and securely from source to a trusted registry rather than assembled ad hoc.

Image Scanning

Examining VM or container images for vulnerabilities, misconfigurations, secrets, and malware before deployment, so insecure images are caught early, a foundational cloud security practice.

Image Security

From the cloud engineer's view, the overall practice of keeping container and VM images secure across their lifecycle, building from trusted sources, hardening, scanning, signing, and controlling registries, so workloads start from trustworthy images.

Image Security Pipeline

A build-and-delivery pipeline with security stages woven in, building, hardening, scanning, signing, and gating images, so security is enforced automatically as images move from source to deployment.

Image Signing

Cryptographically signing container or VM images so their integrity and origin can be verified before deployment, ensuring an image has not been tampered with and came from a trusted source.

Impact

The harm that could happen if a threat successfully exploits a weakness.

Impact Estimation

Judging how much harm a risk would cause if it materialized, financial loss, operational disruption, reputational or legal damage, so risks can be prioritized by consequence alongside their likelihood.

Implementation Groups

The tiered sets within the CIS Controls (IG1, IG2, IG3) that group safeguards by an organization's size, resources, and risk, so smaller or less-resourced organizations can adopt a sensible subset first and scale up.

Impossible Travel

An identity anomaly where one account signs in from two locations too far apart to travel between in the elapsed time, strongly suggesting the credentials are being used by more than one party, often an attacker.

Impossible Travel Hunting

A threat-hunting technique that searches authentication data for impossible-travel patterns across accounts, proactively finding credential compromise that automated alerts may have missed or that spans accounts.

Imposter Syndrome

The persistent feeling of self-doubt and not being competent enough despite real ability, common among security analysts given the field's breadth, that affects confidence and wellbeing if left unaddressed.

Inbox Rules

Automated email-handling rules in a mailbox that attackers abuse after compromising an account, creating rules to hide, forward, or delete messages, concealing their activity and enabling fraud like business email compromise.

Incident

A confirmed or suspected event that harms or threatens security.

Incident Commander

The person coordinating decisions, communication, and priorities during an incident.

Incident Commander Role

The person who leads and coordinates the response to a major incident, owning decisions, orchestrating teams and external parties, and managing communication, so the response is directed and coherent rather than chaotic.

Incident Communication Plan

The part of a business continuity plan that defines how the organization communicates during a disruption, who notifies whom, through which channels, and with what messages, so coordination holds even when normal systems are down.

Incident Confirmation

The step in incident response of verifying that a suspected event is a genuine security incident before mobilizing the full response, distinguishing real incidents from false alarms so effort is not wasted or misdirected.

Incident Intelligence

Using and producing intelligence around an incident, applying threat intelligence to understand the adversary and extracting intelligence from the incident itself, so response is informed and the organization learns from what happened.

Incident Lifecycle

The end-to-end stages of handling a security incident, preparation, detection and analysis, containment, eradication, recovery, and post-incident learning, that structure incident response from readiness through to lessons learned.

Incident Responder

A professional who handles security incidents hands-on, investigating, containing, eradicating, and recovering from intrusions, within incident response operations. The role demands technical depth, composure, and structured judgment under pressure.

Incident Responders

The incident-response function within a blue team, the people who handle incidents, positioned alongside SOC analysts, detection engineers, forensic analysts, and threat hunters in the broader defensive organization.

Incident Response

The organized process of preparing for, detecting, containing, eradicating, and recovering from security incidents, with the goal of limiting damage, restoring operations, and learning to prevent recurrence.

Incident Severity

A rating of how serious an incident is, based on its impact and scope, that drives prioritization, escalation, resource allocation, and communication, so response effort matches the incident's actual significance.

Indexes

Data structures in logging and SIEM platforms that organize stored events so they can be searched quickly. Indexing makes telemetry usable for detection and investigation but adds storage and cost, shaping what is kept hot.