Glossary

Post-Incident Review

A structured review of what happened, what worked, and what should improve after an incident.

Posture Remediation

Fixing the misconfigurations and policy violations that posture-management tools surface, closing exposures the CSPM identified across the cloud estate, so cloud security posture actually improves.

Posture Reporting

Communicating the state of cloud security posture to stakeholders, findings, trends, remediation pace, coverage, so leadership and teams can see where the cloud stands and steer improvement.

Posture Standards

The defined baseline a cloud environment is measured against, often drawn from frameworks like CIS Benchmarks, that posture management uses to identify deviations and drive remediation.

PowerShell Detection

Detecting malicious PowerShell use through behavioral signals like encoded commands, suspicious script content, unusual parent processes, and known abuse patterns, often mapped to ATT&CK to catch a heavily abused execution technique.

Pre-Audit Activities

The work done before a cloud-compliance audit, gap closure, evidence gathering, stakeholder readiness, and dry runs, so the audit goes smoothly and findings reflect real, sustained compliance rather than scrambled preparation.

Preflight Request

A CORS mechanism where the browser sends an OPTIONS request before certain cross-origin requests, asking the server which origins, methods, and headers are allowed, used to safely permit some cross-origin web behavior.

Preparation

The first phase of the incident response lifecycle, building the readiness (plans, tools, training, contacts) needed before incidents happen, so when an incident occurs, the team can respond effectively rather than improvise.

Prescriptive vs Outcome-Based

The distinction between frameworks that prescribe specific controls and those that require outcomes (leaving implementation up to the organization), shaping how flexibly the framework can be applied across different environments.

Pretexting

A social-engineering technique where an attacker invents a credible scenario or impersonation to get the target to share information or take an action, exploiting trust and helpfulness rather than technology.

Preventive Controls

Controls that aim to stop incidents before they happen, locks, firewalls, access controls, training, one of the core control categories alongside detective and corrective controls.

Principle of Least Functionality

A hardening principle that systems should run only the services, features, and software they actually need, since every unneeded component is added attack surface that could be exploited.

Principle of Least Privilege

A foundational security principle: every user, process, and system should have only the minimum permissions needed to do its job, so the damage from any compromise is bounded.

Priority Intelligence Requirements

The top intelligence questions a leader or organization needs answered to make decisions, used to focus a threat-intelligence program on what matters most rather than collecting everything indiscriminately.

Privacy

The expectation and right of individuals over how their personal data is collected, used, and shared. Privacy is distinct from security, though they overlap, and is governed by laws like GDPR and program-level practice.

Privacy Breach Assessment

Assessing a confirmed privacy incident to determine its scope, severity, and regulatory implications, what personal data is affected, how many people, what harms, and what notifications are required.

Privacy Breach Identification

Recognizing that an event qualifies as a privacy breach under applicable law, distinct from a generic security incident, since not every security event is a notifiable privacy breach and vice versa.

Privacy Impact Assessment

A structured evaluation of how a new system, service, or activity will affect personal data and privacy, identifying risks and required safeguards before it goes live. A core privacy-by-design and governance practice.

Privacy vs Security Law

The distinction between privacy law (governing how personal data is handled) and security law (governing how systems and data must be protected). They overlap but differ in focus, obligations, and enforcement.

Private Address Space

Reserved IP address ranges (like 10.0.0.0/8, 192.168.0.0/16) used inside organizations' networks, not routable on the public internet. Understanding them is foundational to interpreting internal versus external traffic.

Private Cloud

Cloud infrastructure dedicated to a single organization, run on-premises or by a provider for that customer only. It offers more control and isolation than public cloud at the cost of less scalability and shared efficiency.

Private Key

The secret half of an asymmetric key pair, kept strictly confidential by its owner, used to decrypt or sign. Its secrecy is the foundation of identity and trust in public-key cryptography.

PrivateLink

A cloud service that connects customer networks to provider services or to other customers' services through private endpoints, avoiding public-internet exposure of those connections and reducing attack surface.

Privilege Creep

The gradual accumulation of unneeded permissions as people change roles, get temporary access that never gets revoked, or accept new responsibilities, eroding least privilege over time.

Privilege Escalation

Gaining more access than originally allowed.

Privilege Escalation Hunts

Threat hunts targeting privilege escalation activity, searching for evidence of attackers gaining higher access through token abuse, exploits, or misuse of legitimate elevation paths.

Privileged Access

Access that grants elevated rights, such as administrative or root permissions, over systems, identities, or data. Because it can do significant harm if abused, privileged access is the focus of specialized controls (PAM).

Privileged Access Management

Processes and tools for controlling and monitoring powerful accounts.

Privileged Access Threat Landscape

The set of attacks specifically targeting privileged access, credential theft, hash and ticket reuse, escalation, abuse of standing admin rights, that drive why privileged-access management is essential.

Privileged Access Workstation

A hardened, dedicated workstation used exclusively for privileged administrative tasks, isolated from email, browsing, and general use, so administrative credentials are entered only on a known-clean device.

Privileged Account Types

The categories of privileged accounts in an environment, domain admins, local admins, service accounts, cloud admins, application admins, that PAM must inventory and govern with controls suited to each type.

Privileged Accounts

Accounts that hold elevated permissions over systems, directories, or data, the targets PAM programs focus on, since their compromise can lead to widespread, severe harm in an environment.