Glossary

Hunter Community

The professional community of threat hunters who share hypotheses, techniques, tooling, and intelligence, helping practitioners learn, stay current on adversary behavior, and raise the collective standard of hunting.

Hunter Skills

The competencies a threat hunter needs, deep knowledge of attacker behavior, data analysis and query fluency, hypothesis-driven thinking, tool proficiency, and the curiosity to chase anomalies, that enable effective proactive hunting.

Hunter Specialization

The focused areas a threat hunter can develop expertise in, such as cloud, identity, endpoint, or network hunting, or particular adversary types, allowing deeper mastery beyond generalist hunting.

Hunter to Adjacent Roles

The career moves available from threat hunting into related roles, such as detection engineering, incident response, threat intelligence, or red teaming, leveraging hunting's deep adversary knowledge and analytical skills.

Hunting Maturity

How developed an organization's threat-hunting capability is, from ad-hoc, occasional hunts to a structured, data-rich, continuously improving program, used to assess where hunting stands and how to advance it.

Hunting Mindset

The proactive, skeptical, curiosity-driven attitude a threat hunter brings, assuming a breach may already exist and actively seeking it, rather than waiting for alerts. It is the mental posture that makes hunting work.

Hunting Practice

The hands-on, ongoing activity of conducting threat hunts and building hunting skill through repetition, applying techniques against real or lab data so the craft develops through doing, not just theory.

Hybrid Cloud

A computing model that combines private infrastructure (on-premises or private cloud) with public cloud, connected so workloads and data can move or integrate between them, balancing control with the scalability of public cloud.

Hybrid Identity

An identity setup that links on-premises directories with cloud identity services, so users have a single identity spanning both, commonly by synchronizing or federating an on-prem directory with a cloud directory.

Hybrid SOC

A security operations model that combines in-house staff with outsourced services (such as an MSSP or MDR provider), splitting monitoring and response duties to balance control, cost, coverage, and specialized expertise.

Hypothesis Formation

The analyst skill of forming a testable explanation for what an alert or anomaly might mean, then investigating to confirm or rule it out, bringing structure and direction to triage and investigation.

Hypothesis Refinement

Adjusting a hunt hypothesis as evidence accumulates, narrowing, broadening, or pivoting it based on what the data shows, so the hunt stays productive rather than rigidly pursuing an initial guess.

Hypothesis Sources

The inputs that generate hunt hypotheses, threat intelligence, knowledge of attacker techniques (like MITRE ATT&CK), past incidents, anomalies in data, and environmental knowledge, that give hunters credible ideas worth investigating.

Hypothesis-Driven Hunting

A hunting approach that starts from a specific, testable hypothesis about attacker activity and then queries telemetry to confirm or refute it, contrasted with purely data-driven hunting that lets anomalies surface from the data.

IA Independence

The principle that an internal audit function must be organizationally independent and objective, reporting in a way that keeps it free from management influence, so its assessments of controls and risk are credible and unbiased.

IA Maturity

How developed an internal audit function is, from a basic, compliance-focused activity to a strategic, risk-based, value-adding function, used to assess where internal audit stands and how to advance its capability.

IA Methodology

The structured approach an internal audit function follows to plan and perform audits, risk-based planning, fieldwork and testing, evidence gathering, and reporting, so audits are consistent, rigorous, and aligned to risk.

IA Reporting

How an internal audit function communicates results, audit reports with findings, risk ratings, and recommendations to management, and summary reporting to the board or audit committee, so assurance leads to action and oversight.

IAM Architecture

The overall design of an organization's identity and access management, how identities, authentication, authorization, directories, and access controls fit together across systems, so access is secure, consistent, and manageable at scale.

IAM Architecture Patterns

Reusable, proven design approaches for structuring identity and access management, such as hub-and-spoke identity, centralized versus federated models, or standard provisioning and SSO designs, that engineers adapt rather than designing from scratch.

IAM Career Path

The progression of roles in identity and access management, from analyst or administrator through IAM engineer to architect and program leadership, with specializations like cloud IAM, IGA, or privileged access.

IAM Career Reflection

A capstone reflection on the identity-and-access-management career journey, consolidating what an IAM practitioner has learned and how the pieces, technical, program, and governance, fit into a coherent professional path.

IAM Continuous Improvement

IAM continuous improvement repeatedly inventories identity state, measures control outcomes, investigates failures and bypasses, updates ownership and design, and retests prevention, detection, response, and recovery.

IAM Design Principles

The guiding principles for sound identity and access management design, such as least privilege, single identity, separation of duties, defense in depth, and automation, that shape secure, maintainable IAM architectures.

IAM Detection for Meridian

A capstone exercise applying identity threat detection to a fictional organization (Meridian), designing detections for identity-based attacks as part of building that organization's identity program end to end.

IAM Exception Governance

IAM exception governance records and controls a temporary departure from an identity requirement with a named risk owner, compensating controls, evidence, approval, expiry, and exit plan.

IAM Gap Analysis

Assessing an organization's current identity and access management against a desired target state to identify gaps, weaknesses, missing capabilities, and risks, that the identity program needs to close.

IAM Metric Design

IAM metric design connects identity control activity to verified security and service outcomes while reporting failures, exceptions, latency, coverage, and evidence quality.

IAM Policies

In the cloud, the documents that define what actions an identity may perform on which resources, the rules attached to users, roles, or resources that grant or deny specific permissions. They are how cloud access control is expressed.

IAM Privilege Escalation

Abusing cloud IAM misconfigurations to gain more permissions than originally granted, for example using a permission to modify policies or assume a more powerful role, a major focus of cloud security assessment.

IAM Privilege Escalation Path

An IAM privilege escalation path is a chain of permissions and trust relationships that lets a principal obtain or exercise authority beyond its intended role.