Glossary

Beacons

The periodic check-ins a compromised host makes to an attacker's command-and-control server to receive instructions. Their regular, often-disguised pattern is a key signal defenders hunt for to find hidden footholds.

Behavioral Anomaly Detection

In identity governance, detecting access behavior that deviates from a user's or peer group's norm, such as accessing systems they never use or acting outside their role, to surface risky or compromised identities.

Behavioral Detection

Detecting threats by what an entity does, its behavior and sequences of actions, rather than by matching known-bad signatures. It catches novel and fileless attacks that signature-based detection misses.

Behavioral Indicators

Observable signs in how people act that reveal the strength of a security culture, such as whether staff report suspicious emails, follow secure practices, or raise near-misses. They show culture in behavior, not just stated attitudes.

Behavioral Operationalization

Turning an abstract description of attacker behavior into something a threat hunter can actually search for, by defining the data sources, queries, and observable traces that the behavior would produce.

Behavioral Pivoting

During an investigation, expanding from one observed behavior to find related malicious activity, asking what else an attacker exhibiting this behavior would likely do, and searching for it. It widens an investigation beyond a single alert.

Behavioral Science

The study of why people act as they do, applied to security to design awareness and culture programs that actually change behavior rather than just delivering information. It explains why people click, comply, or take shortcuts.

Benign True Positive

An alert that correctly fired on the activity it was designed to detect, but where that activity turns out to be legitimate, such as an admin tool used by an authorized administrator. The detection worked; the behavior was simply expected.

Biometric Authentication

Authentication that uses a physical trait such as a fingerprint or face scan.

Blame Culture

An environment where mistakes lead to punishment and finger-pointing, which makes people hide errors and avoid reporting incidents. It is corrosive to security because it suppresses the very information defenders need.

Blameless Postmortem

A review after an incident that focuses on understanding what happened and why, in terms of systems and processes, rather than assigning fault to individuals. It produces honest analysis and concrete improvements.

Block Cipher Mode

The method that determines how a block cipher like AES is applied to data longer than a single block, such as CBC, CTR, or GCM. The mode chosen critically affects security, and a poor choice can break confidentiality even with a strong cipher.

Block Ciphers

Symmetric encryption algorithms that encrypt data in fixed-size blocks, such as AES with its 128-bit blocks. They are a fundamental building block of modern encryption when combined with a mode of operation.

Blue Team

The defenders in cybersecurity, the people and functions responsible for protecting systems, detecting attacks, and responding to incidents. It contrasts with the red team, which simulates attackers to test defenses.

Board Oversight

The board of directors' role in overseeing an organization's cybersecurity, setting risk appetite, holding leadership accountable, and ensuring security is governed as a business risk. It places ultimate accountability for cyber risk at the top.

Board Risk Reporting

Communicating the organization's key risks to the board of directors in a clear, decision-focused way, so the board can exercise oversight, set risk appetite, and hold leadership accountable without drowning in technical detail.

Boot Persistence

Attacker techniques that ensure malicious code runs automatically when a system starts up, surviving reboots. By hooking into boot or startup processes, an attacker keeps a foothold even after the machine restarts.

Bot Protection in CIAM

Defenses in customer identity systems against automated abuse such as credential stuffing, fake account creation, and scraping. Because CIAM faces the open internet, distinguishing real users from bots is a core security need.

Break Glass Account

An emergency account kept for rare situations when normal access methods are unavailable.

Broken Access Control

A web vulnerability where the application fails to properly enforce what an authenticated user is allowed to do, letting them reach data or functions that should be off-limits. It is one of the most common and impactful web weaknesses.

Browser Warnings

The security alerts a web browser shows when something is wrong with a site's connection or certificate, such as an invalid or expired certificate, or a downgrade from HTTPS. They are a frontline signal that a connection may be unsafe.

Building Framework Mapping

When building a compliance program, mapping the organization's controls to one or more frameworks (like SOC 2, ISO 27001, or NIST) so a single control can satisfy multiple requirements and gaps become visible.

Building GRC Capability

Developing the skills, processes, and maturity that let a person or organization perform governance, risk, and compliance work effectively, from foundational analyst abilities up to a functioning GRC program.

Burnout

The exhaustion, cynicism, and reduced effectiveness that affect security analysts after prolonged stress, high alert volume, and relentless pace. It is a serious operational risk because it degrades detection quality and drives staff turnover.

Business Continuity

Planning that helps critical operations continue during or after disruption.

Business Email Compromise

A fraud scheme where an attacker uses a compromised or spoofed business email account to trick someone into sending money or sensitive data, often by impersonating an executive or vendor. It relies on deception more than malware.

Business Impact Analysis

A structured process that identifies an organization's critical processes, what they depend on, and the consequences of disruption over time, producing the recovery priorities and objectives that drive continuity planning.

Business Logic Testing Methodology

A testing approach that targets flaws in an application's intended workflow and rules, rather than technical bugs, such as skipping a payment step, abusing discount logic, or bypassing an intended sequence. These flaws evade automated scanners.

Business Risk Integration

Connecting cybersecurity risk to the organization's broader enterprise and business risks so cyber is managed as one element of overall risk, not in a silo. It lets leaders weigh cyber risk alongside financial, operational, and strategic risks.

C2 Communication Detection

Detections that identify command-and-control traffic, the channel a compromised host uses to receive attacker instructions, by spotting patterns like regular beaconing, suspicious destinations, or anomalous protocols.

C2 Hunts

Threat hunts specifically aimed at finding command-and-control activity that detections missed, by searching telemetry for beaconing patterns, rare external connections, and other signs of an attacker's hidden communication channel.