Glossary

Program Reporting Integrity

Program reporting integrity distinguishes facts, estimates, forecasts, targets, risks, incidents, assurance results, limitations, thresholds, and requested decisions with traceable support.

Progressive Microsegmentation

Rolling out microsegmentation gradually in stages rather than all at once, starting with monitoring, then enforcing in narrow scopes and expanding, so the transition succeeds without breaking applications.

Progressive Policy Enforcement

Progressive policy enforcement moves from observation and simulation through bounded canary enforcement to wider release with explicit success, failure, rollback, monitoring, and exception criteria.

Protected Users Group

Protected Users is an AD DS security group that applies strict, nonconfigurable credential protections to supported user accounts.

Protected Users Security Group

Protected Users is an Active Directory group that applies credential protections to supported human user accounts, including restrictions on NTLM, weak Kerberos encryption, delegation, caching, and TGT renewal.

Protection Goal

A security outcome an asset or process requires, commonly confidentiality, integrity, availability, authenticity, accountability, privacy, safety, or resilience.

Provider Control Evidence

Provider control evidence is scoped documentation, contract, architecture, assurance, certification, status, or support information used to evaluate a provider-operated control.

Provisioning

Creating and granting accounts and access to identities, the joining-and-onboarding side of the identity lifecycle. Done well, provisioning is automated, timely, and grants only the access actually needed.

Provisioning Engine

A provisioning engine creates, updates, disables, and reconciles accounts and entitlements across connected systems from approved lifecycle events.

Provisioning Verification

Provisioning verification confirms that the correct target object reached the intended created, changed, disabled, or removed state after a governance action.

Proxy Frameworks

Frameworks an organization adopts as a proxy for, or wrapper over, a more specific set of obligations, allowing the organization to use one recognized framework to satisfy or signal multiple underlying requirements.

Proxy Logs

Logs from web proxies recording the URLs users and systems accessed, including method, response, and often categories, a rich source of telemetry for detecting C2, exfiltration, and policy violations.

Psychological Safety

The team-level condition where people feel safe to speak up, report mistakes, ask questions, or raise risks without fear of blame, foundational to security culture, learning, and effective blue-team operations.

Public Address Space

IP addresses that are routable on the public internet, assigned and managed globally. Recognizing the boundary between public and private addressing is foundational to understanding exposure and network traffic.

Public Cloud

Cloud infrastructure shared among many customers and offered as a service by a provider (such as AWS, Azure, or GCP). It delivers scale and economic efficiency through shared multi-tenant resources.

Public Key

The non-secret half of an asymmetric key pair, shared openly, used to encrypt to the holder of the matching private key or to verify signatures the private key produced.

Public Sandbox Disclosure Risk

Public sandbox disclosure risk is the possibility that submitting an artifact or hash reveals files, embedded data, internal indicators, campaign timing, customer information, or investigative interest to a provider or wider community.

Public Storage Buckets

A common cloud misconfiguration where object-storage buckets are set to public access, exposing data to the internet. A frequent, high-impact issue that posture management and assessment focus on.

Public-Facing Application

An application or service reachable by users or systems outside a trusted internal boundary, including internet-exposed APIs, portals, gateways, and management interfaces.

Public-Facing Applications

Applications reachable from the public internet, a primary attack surface in the threat landscape, since they are continuously probed and exploited by opportunistic and targeted attackers alike.

Purple Team Exercise

A purple team exercise pairs authorized adversary simulation with defensive observation to test and improve specific telemetry, analytics, investigation, and response outcomes.

Purple Team Exercises

Collaborative exercises where red-team attackers and blue-team defenders work together openly, attacking and defending in real time to validate detections, improve response, and transfer knowledge.

Push Notification Fatigue

Push notification fatigue is an attack that repeatedly triggers MFA approval prompts in the hope that a user accepts one through confusion or frustration.

Push Notification MFA

A possession-factor MFA method that sends an approval prompt to a registered device for the user to tap. Convenient and stronger than passwords alone, but vulnerable to MFA fatigue and relay attacks.

Pyramid of Pain

A model showing that some indicators (hashes, IPs) are cheap for attackers to change while behaviors and TTPs are painful, so detections built on the upper layers cause far more disruption to adversaries.

Qualitative Analysis Depth

The level of rigor and structure brought to qualitative risk analysis, from quick scoring to deep documented reasoning about scenarios, which determines how trustworthy and useful qualitative results are for decisions.

Qualitative Risk

Risk analysis expressed in non-numeric, descriptive terms such as high/medium/low or red/amber/green, common in GRC for its accessibility, often paired with structured criteria for consistency.

Qualitative Risk Limitations

The constraints of qualitative risk methods, subjective ratings, poor comparability across raters, inability to combine or compare in dollar terms, that motivate using quantitative methods like FAIR for certain decisions.

Quality Documentation

Accurate, timely, scoped, reproducible, audience-appropriate records that separate observation from inference and preserve decisions, evidence, actions, ownership, and limitations.

Quantitative Risk

Risk analysis expressed in numbers, frequencies, probability distributions, and dollar amounts, that enables comparison, aggregation, and clear financial reasoning. FAIR is the leading quantitative approach in cybersecurity.

Quantitative Risk Communication

Presenting quantitative risk results, ranges, distributions, and confidence, to decision-makers in ways they can act on, avoiding the false precision and impenetrability that quantitative analyses can otherwise convey.