Glossary

AI and Compliance

The compliance questions raised when organizations use AI services in the cloud, including how training data is handled, where it is processed, whether use meets emerging AI regulations, and how to demonstrate accountability for automated decisions.

AI in Cloud Architecture

The design considerations for safely incorporating AI and machine-learning services into a cloud security architecture, covering where AI workloads sit in the network, how their data is protected, and how their access and logging fit existing controls.

API Gateway Security

Securing the API gateway, the entry point that sits in front of backend services and APIs, by enforcing authentication, authorization, rate limiting, and input checks centrally so individual services do not each have to.

API Server Security

Protecting the Kubernetes API server, the central control plane component that every cluster action passes through. Because it governs the whole cluster, hardening its authentication, authorization, and exposure is critical.

AWS CloudTrail Investigation

Using AWS CloudTrail logs, which record API calls and account activity, to investigate a cloud incident: who did what, from where, and when. It is the primary evidence source for AWS control-plane actions.

AWS GuardDuty

An AWS threat-detection service that analyzes account, network, and DNS activity to flag suspicious behavior, such as compromised credentials, cryptomining, or reconnaissance, without needing agents on workloads.

AWS Landing Zone Frameworks

Prescriptive blueprints, such as AWS Control Tower and the multi-account framework, for setting up a secure, scalable AWS foundation with baked-in account structure, guardrails, logging, and identity from the start.

AWS Network Architecture

The design of networking in AWS, VPCs, subnets, route tables, gateways, security groups, and connectivity, arranged to segment workloads, control traffic, and limit exposure as part of a secure cloud foundation.

Admission Control

A gatekeeping step that checks whether a workload, image, or change is allowed to run before it is admitted into an environment, blocking anything that fails policy such as an unsigned container image or one with critical vulnerabilities.

Admission Controllers

Kubernetes components that intercept requests to the cluster's API server and can validate or modify them before objects are created, letting security teams enforce policy such as blocking privileged pods or requiring trusted images.

Agent vs Agentless

Two ways to gather security data from cloud workloads. Agent-based methods install software on each workload for deep, real-time visibility, while agentless methods scan workloads from outside (for example via snapshots or APIs) for broad, low-friction coverage.

Architecture Decision Records

Short documents that capture a significant design decision, the options considered, the choice made, and the reasoning behind it. In cloud security architecture they preserve why controls were designed a certain way.

Audit Cycle

The end-to-end sequence of an audit: preparation, fieldwork or execution, findings, reporting, and follow-up. Understanding the cycle helps an organization know what each phase requires and prepare for it.

Audit Execution

The fieldwork phase of an audit, where the auditor tests controls, examines evidence, conducts interviews, and gathers the support for conclusions. It is where the audit's actual testing happens.

Audit Findings

The issues an audit identifies, such as a control that is missing, not operating, or operating ineffectively, each documented with evidence and usually a recommendation. Findings are the main output an organization must act on.

Audit Log Analysis

Examining cloud and system audit logs, the records of who did what and when, to detect suspicious activity, investigate incidents, and verify that controls are working. In cloud security it is a primary source of detection and forensic evidence.

Audit Preparation

The work an organization does before an audit begins: confirming scope, gathering and organizing evidence, briefing control owners, and resolving known gaps, so the audit runs efficiently and surfaces fewer surprises.

Audit Trail

A chronological record of actions and events in a system, showing who did what and when, that lets reviewers reconstruct activity. In cloud compliance, it is core evidence that controls operated as required.

Auditor Engagement

How an organization works with an external auditor across an audit, from initial engagement through fieldwork and findings. Productive engagement keeps the audit accurate, efficient, and free of surprises.

Auditor Selection

Auditor selection is the process of choosing a qualified and independent reviewer for a security, compliance, or assurance assessment.

Authorization Policies

In cloud-native environments, the rules that define which services, workloads, or users may access which resources, often expressed declaratively and enforced by a service mesh or admission controller. They implement least privilege between components.

Auto-Remediation

Automatically correcting an insecure cloud configuration as soon as it is detected, without waiting for a human, for example re-enabling logging or removing a public access setting that violates policy.

Automated Reporting

Generating compliance and security reports automatically from live data, such as control status, evidence, and posture, instead of compiling them by hand. It keeps reports current and frees teams from manual collection.

Azure Incident Investigation

Investigating a security incident in Microsoft Azure using its logs and signals, such as Entra ID sign-in logs, activity logs, and Microsoft Defender alerts, to determine what an attacker did and how far they reached.

Azure Landing Zone

Microsoft's prescriptive blueprint for a secure, scalable Azure foundation, defining management group hierarchy, subscriptions, policies, identity, networking, and logging so workloads land in a governed environment by default.

Azure Network Architecture

The design of networking in Azure, virtual networks, subnets, network security groups, peering, gateways, and firewalls, arranged to segment workloads, control traffic, and limit exposure within a secure cloud foundation.

Azure VM Forensics

Collecting and analyzing forensic evidence from an Azure virtual machine during an incident, such as disk snapshots and memory, in a way that preserves integrity so the VM's activity can be examined without altering evidence.

BYOK and HYOK

Two cloud encryption key models. Bring Your Own Key (BYOK) lets a customer supply keys that the cloud provider then manages, while Hold Your Own Key (HYOK) keeps keys entirely under the customer's control, never handing them to the provider.

CI/CD Security Integration

Building security checks directly into continuous integration and deployment pipelines, so issues like vulnerabilities, misconfigurations, and exposed secrets are caught automatically before code reaches production.

CIS Benchmarks Cloud

CIS configuration benchmarks tailored to cloud platforms like AWS, Azure, and GCP, specifying secure settings for cloud accounts and services. They give cloud teams a concrete, checkable baseline for hardening their environments.

CNAPP

A Cloud-Native Application Protection Platform: an integrated product that combines posture management, workload protection, identity analysis, and other cloud security functions into one platform for unified visibility and protection across the cloud lifecycle.