Glossary

Exercise Evaluation

Exercise evaluation compares observable participant actions and outputs with objectives defined before a drill or tabletop begins.

Exercise Objective

An exercise objective defines the capability and decision being tested, participants, expected evidence, success criteria, limitations, and required outputs.

Exercise Safety Boundary

An exercise safety boundary defines authorization, systems, identities, data, techniques, time, stop conditions, emergency contacts, evidence handling, production protections, approvals, and cleanup.

Exfiltration

Unauthorized movement of data out of an environment.

Expected Annual Loss

Expected Annual Loss is the arithmetic mean of a modeled distribution of total loss over a one-year period.

Explainable Governance Decisions

Explainable governance decisions show what access and subject were evaluated, which policy and evidence applied, who was accountable, what uncertainty remained, and how an error can be corrected.

Exposed Databases

A cloud misconfiguration where a database is reachable from the public internet or lacks proper access controls, exposing potentially sensitive data. It is a frequent and high-impact cause of cloud data breaches.

Exposure

A condition where a system, service, data, or weakness can be reached or affected.

External Audit Cycles

The recurring schedule and phases of external audits, planning, fieldwork, testing, reporting, and follow-up, that organizations and audit firms move through, often annually, to provide independent assurance over controls.

External Audit Firm Career

A career path working as an auditor within an external audit or accounting firm, progressing from staff auditor through senior, manager, and partner, building assurance skills across many client engagements.

External Communication

Communicating with parties outside the organization during an incident, customers, partners, regulators, and the public, in a coordinated, accurate way that meets obligations and protects trust while avoiding premature or damaging statements.

External IR Coordination

Coordinating with outside parties during a major incident from a leadership standpoint, external responders, forensics firms, law enforcement, regulators, and partners, so their involvement is managed coherently rather than ad hoc.

External IR Support

Outside help brought in during an incident, such as incident-response retainers, forensics specialists, or threat-intelligence providers, when an incident exceeds the internal team's capacity, expertise, or capacity for objectivity.

External Identity Data Governance

External identity data governance controls claims, tokens, profiles, contacts, organization data, and events received from social, enterprise, government, or verification providers.

External Risk Sources

Risks that originate outside the organization, such as threat-actor activity, regulatory change, supply-chain and vendor risk, economic shifts, and geopolitical events, that risk identification must look beyond internal assets to capture.

External Secrets

A pattern for managing secrets in cloud-native systems where applications fetch credentials from an external secrets manager at runtime, rather than storing them in the cluster, keeping sensitive values out of manifests and source control.

FAIR (Factor Analysis of Information Risk)

FAIR is a risk taxonomy and analysis method that estimates information risk through loss-event frequency and probable loss magnitude.

FAIR Factors in Depth

A detailed look at the factors in the FAIR model that combine to produce risk, breaking loss event frequency and loss magnitude into their contributing sub-factors so each can be estimated and analyzed precisely.

FAIR Methodology

FAIR (Factor Analysis of Information Risk) is a quantitative method for analyzing risk in financial terms, decomposing it into loss event frequency and loss magnitude and using calibrated estimates to produce a measured range of probable loss.

FAIR Ontology

The structured taxonomy at the heart of FAIR that defines each risk factor and how they relate, loss event frequency and loss magnitude and their sub-factors, giving a precise, shared vocabulary for decomposing and analyzing risk.

FAIR Practice Development

Building the capability to do FAIR analysis well over time, developing analysts' calibration and modeling skills, refining processes, and maturing how an organization performs quantitative risk analysis.

FAIR Program Integration

Embedding FAIR quantitative analysis into the organization's broader risk-management program, so quantified results feed risk registers, prioritization, reporting, and decisions rather than living as standalone analyses.

FAIR Program Metrics

The measures used to track the value and maturity of a FAIR quantitative-risk program, such as how many decisions it informed, the consistency and accuracy of estimates, and the program's coverage and efficiency.

FAIR Scenario Definition

Precisely framing the risk scenario to be analyzed in FAIR, specifying the asset at risk, the threat, and the type of loss event, so the analysis measures a well-bounded, meaningful risk rather than something vague.

FAIR Sensitivity Analysis

Examining which input factors most affect a FAIR analysis's result, so analysts know where estimate uncertainty matters most and where to focus effort to refine the model or reduce risk.

FAIR in Context

Understanding where the FAIR quantitative risk model fits among other risk approaches and when to use it, recognizing its strengths for financial risk analysis and its place alongside qualitative methods and broader risk frameworks.

FIDO2

An open authentication standard that enables strong, phishing-resistant, passwordless login using public-key cryptography and hardware or platform authenticators, such as security keys or device biometrics, instead of passwords.

FIDO2/WebAuthn

FIDO2 and WebAuthn provide public-key authentication whose credential is bound to a relying party, making properly configured sign-in resistant to phishing and replay.

FTP

File Transfer Protocol: an old protocol for transferring files between systems that sends data and credentials in plaintext, making it insecure and a notable risk when found, since traffic can be intercepted.

Falco Runtime Rules

Falco runtime rules match supported system-event data to behaviors that may require investigation, such as unexpected process execution or sensitive file access.

False Positive

An alert that appears suspicious but is not actually harmful.