Glossary

AD Attack Surfaces

The parts of an Active Directory environment that an attacker can target or abuse, including privileged accounts, service accounts and their tickets, group memberships, domain controllers, trusts, and misconfigured permissions.

AD Compromise Response

The specialized response to an incident where an attacker has gained control of Active Directory itself, which often means assuming every credential and trust is suspect and may require rebuilding or restoring the directory from a clean state.

AD Privileged Account Hardening

Securing the high-power accounts in Active Directory, such as Domain Admins and service accounts, by limiting their number and rights, restricting where they can log in, enforcing strong authentication, and monitoring their use closely.

AI and Compliance

The compliance questions raised when organizations use AI services in the cloud, including how training data is handled, where it is processed, whether use meets emerging AI regulations, and how to demonstrate accountability for automated decisions.

API Gateway Security

Securing the API gateway, the entry point that sits in front of backend services and APIs, by enforcing authentication, authorization, rate limiting, and input checks centrally so individual services do not each have to.

API Server Security

Protecting the Kubernetes API server, the central control plane component that every cluster action passes through. Because it governs the whole cluster, hardening its authentication, authorization, and exposure is critical.

ATT&CK Coverage Mapping

Charting an organization's detections against the MITRE ATT&CK matrix to see which adversary techniques are covered, which are weakly covered, and which are blind spots, so detection effort can be focused.

ATT&CK Navigator

A free tool for working with the MITRE ATT&CK matrix visually, letting defenders annotate, color, and layer techniques to track detection coverage, map threat-actor behavior, or plan detection work.

Access Certification

Access certification is a formal review where managers, system owners, or data owners confirm whether users should keep specific access.

Access Review Implementation

Access review implementation is the practical work of running access reviews, collecting decisions, applying removals, and keeping evidence.

Account Compromise Response

The set of actions a team takes once it confirms an attacker controls a legitimate user or service account, including locking the account, revoking sessions, resetting credentials, and tracing what the attacker did while logged in.

Account/Subscription Strategy

An account and subscription strategy defines how cloud accounts or subscriptions are separated, governed, and assigned so ownership, billing, and security boundaries stay clear.

Action Item Tracking

The practice of recording the follow-up tasks identified in a post-incident review and tracking each one to completion with an owner and due date, so lessons from an incident actually turn into fixes.

Action Items

The concrete follow-up tasks that come out of a post-incident review, each describing a specific improvement, such as a configuration change, new detection, or process update, meant to reduce the chance or impact of a future incident.

Action-Oriented Reporting

A style of risk reporting that frames findings around the decisions and actions the audience can take, rather than just listing data. It tells leaders what changed, why it matters, and what to do next.

Activation Decisions

The judgment calls about whether and when to formally declare an incident and stand up the response process, including who has authority to activate and what thresholds trigger it.

Active Directory Security

The practice of protecting Microsoft Active Directory, the on-premises identity service that authenticates users and controls access across most enterprise networks. Because nearly everything trusts it, compromising AD often means compromising the whole environment.

Active Directory Security Architecture

The structural design choices that make Active Directory defensible, such as administrative tiering, forest and domain trust boundaries, privileged access workstations, and the placement of controls that limit how far an attacker can move after a foothold.

Actor Profiling Use

Applying knowledge of a specific threat actor, such as their goals, typical tools, and behaviors, to make SOC work sharper, like prioritizing the detections and hunts most relevant to adversaries that actually target your organization.

Actor-Based Hunting

A threat-hunting approach that builds hypotheses around a specific adversary, searching for the tools, techniques, and behaviors that group is known to use, rather than hunting for generic anomalies.

Ad-Hoc Requirements

One-off intelligence questions that arise outside the standing set of priority requirements, such as an urgent request to learn more about a threat actor newly seen in your environment. They need a fast, focused answer rather than ongoing collection.

Admission Control

A gatekeeping step that checks whether a workload, image, or change is allowed to run before it is admitted into an environment, blocking anything that fails policy such as an unsigned container image or one with critical vulnerabilities.

Admission Controllers

Kubernetes components that intercept requests to the cluster's API server and can validate or modify them before objects are created, letting security teams enforce policy such as blocking privileged pods or requiring trusted images.

Adversary Emulation

Safely reproducing the specific techniques a real threat actor uses to test whether your defenses detect and stop them. Unlike a broad penetration test, it follows a known adversary's playbook to validate detection coverage.

Agent vs Agentless

Two ways to gather security data from cloud workloads. Agent-based methods install software on each workload for deep, real-time visibility, while agentless methods scan workloads from outside (for example via snapshots or APIs) for broad, low-friction coverage.

Alert Design

Deciding how a detection turns into an actionable alert: what conditions trigger it, what context it carries, how severe it is, and how it routes to analysts, so that the alert is meaningful and not lost in noise.

Alert Triage

The first analytical step after an alert fires: quickly assessing what it is, whether it is a real threat or a false positive, and how urgent it is, so the right ones move into deeper investigation.

Alert Triage Methodology

A repeatable, structured way to triage alerts, defining the questions to ask, the context to gather, and the criteria for deciding an alert's disposition, so triage stays consistent across analysts and shifts.

Allowlist Management

The disciplined practice of maintaining the exceptions that tell a detection to ignore specific known-benign activity, so that tuning down noise does not silently create blind spots attackers can hide in.

Analysis Documentation

Recording how a risk analysis was performed, including the assumptions, data sources, methods, and reasoning behind each estimate, so the conclusions can be understood, defended, and revisited later.

Analyst Development

The growth of a security analyst's skills over time, from following playbooks toward independent investigation, hunting, and mentoring, built through hands-on incident experience and reflection.