Glossary

Homemade Cryptography

Inventing your own cryptographic algorithm or protocol instead of using established, vetted ones, a serious anti-pattern, since custom crypto almost always contains subtle, exploitable flaws that peer-reviewed standards have eliminated.

Horizontal Privilege Escalation

A web access-control attack where a user accesses another user's data or actions at the same privilege level, such as viewing someone else's account, by exploiting missing checks that they are the rightful owner.

Host

In a URL, the part identifying the server to connect to, typically a domain name or IP address. It tells the browser where to send the request and is key context when judging whether a request goes where expected.

Host Firewall

A firewall running on an individual device or server.

Hot Leads

Promising investigative leads that strongly suggest malicious activity and warrant immediate follow-up, as opposed to cold leads, used by analysts to prioritize where to dig during triage and investigation.

Hot Standby

A disaster-recovery setup where a fully running duplicate system stands ready to take over almost instantly if the primary fails, giving very fast recovery at higher cost than colder standby options.

Hot vs Cold Storage

The tradeoff in log and data storage between hot storage, fast and immediately searchable but costly, and cold storage, cheap for long retention but slow to access, used to balance cost against analysis needs.

HttpOnly Flag

A cookie attribute that prevents JavaScript from reading the cookie, so that even if a site has a cross-site scripting flaw, an attacker's script cannot steal the protected cookie, such as a session token.

Hub-and-Spoke

A cloud network topology where a central hub network connects to multiple isolated spoke networks, centralizing shared services like connectivity, inspection, and egress while keeping workloads segmented in their own spokes.

Hunt After Eradication

Proactively hunting through the environment after eradicating a threat to confirm the attacker is truly gone and has left no overlooked foothold, rather than assuming eradication was complete.

Hunt Conclusion

The closing stage of a threat hunt, where findings are assessed against the hypothesis, a verdict is reached (threat found or not), and outcomes, new detections, leads, or assurance, are determined and recorded.

Hunt Documentation

Recording a threat hunt, its hypothesis, data examined, methods, findings, and outcome, so the work is repeatable, its value is captured, and lessons (including new detections) carry forward.

Hunt Execution

The active phase of a threat hunt, where the hunter queries data, applies analysis techniques, and follows leads to test the hypothesis, turning the hunt plan into hands-on investigation of the environment.

Hunt Finding Lifecycle

The path a threat-hunt finding follows after discovery, from validation and triage through escalation, operationalization into a detection, or recording as assurance, so what a hunt uncovers turns into lasting value.

Hunt Hypothesis

A specific, testable statement of what malicious activity might be present and how it would show up in data, that drives a threat hunt, giving it a clear question to investigate rather than aimless searching.

Hunt Hypothesis Library

A curated, reusable collection of hunt hypotheses an advanced hunting program maintains, so proven and candidate hunt ideas are organized, prioritized, and repeatable rather than reinvented each time.

Hunt Outcomes

The range of results a threat hunt can produce, finding an active threat, generating new detections, surfacing visibility gaps, or providing assurance that nothing was found, all of which are legitimate, valuable results.

Hunt Plan

The structured plan for a threat hunt that specifies the hypothesis, the data sources and techniques to use, the scope, and the success criteria, so the hunt is organized and repeatable rather than ad hoc.

Hunt Program Operations

The ongoing management of a threat-hunting program, planning and prioritizing hunts, allocating resources, tracking coverage and outcomes, and reporting value, so hunting runs as a sustained capability rather than occasional effort.

Hunt Report Structure

The standard format for documenting and communicating a threat hunt, covering the hypothesis, scope, data and methods, findings, and recommendations, so results are clear, comparable, and actionable to different audiences.

Hunt-Driven Improvement

Using what threat hunts reveal, new detections, closed visibility gaps, refined processes, to systematically strengthen the organization's defenses over time, making hunting an engine of continuous improvement.

Hunter Community

The professional community of threat hunters who share hypotheses, techniques, tooling, and intelligence, helping practitioners learn, stay current on adversary behavior, and raise the collective standard of hunting.

Hunter Skills

The competencies a threat hunter needs, deep knowledge of attacker behavior, data analysis and query fluency, hypothesis-driven thinking, tool proficiency, and the curiosity to chase anomalies, that enable effective proactive hunting.

Hunter Specialization

The focused areas a threat hunter can develop expertise in, such as cloud, identity, endpoint, or network hunting, or particular adversary types, allowing deeper mastery beyond generalist hunting.

Hunter to Adjacent Roles

The career moves available from threat hunting into related roles, such as detection engineering, incident response, threat intelligence, or red teaming, leveraging hunting's deep adversary knowledge and analytical skills.

Hunting Mindset

The proactive, skeptical, curiosity-driven attitude a threat hunter brings, assuming a breach may already exist and actively seeking it, rather than waiting for alerts. It is the mental posture that makes hunting work.

Hunting Practice

The hands-on, ongoing activity of conducting threat hunts and building hunting skill through repetition, applying techniques against real or lab data so the craft develops through doing, not just theory.

Hybrid Cloud

A computing model that combines private infrastructure (on-premises or private cloud) with public cloud, connected so workloads and data can move or integrate between them, balancing control with the scalability of public cloud.

Hybrid Identity

An identity setup that links on-premises directories with cloud identity services, so users have a single identity spanning both, commonly by synchronizing or federating an on-prem directory with a cloud directory.

Hybrid SOC

A security operations model that combines in-house staff with outsourced services (such as an MSSP or MDR provider), splitting monitoring and response duties to balance control, cost, coverage, and specialized expertise.

Hypothesis Formation

The analyst skill of forming a testable explanation for what an alert or anomaly might mean, then investigating to confirm or rule it out, bringing structure and direction to triage and investigation.