Glossary

TI Specializations

The areas TI analysts specialize in, threat-actor tracking, malware analysis, geopolitical/strategic, technical/tactical, that let the team cover the breadth of intelligence work in depth.

TI to Adjacent Roles

How threat-intelligence experience leads to adjacent careers, detection engineering, hunting, IR, security research, that use TI skills in different contexts.

TLD

Top-Level Domain, the rightmost component of a domain name like .com, .org, or country-code TLDs like .uk. Defenders track TLDs because some are heavily abused by attackers.

TLP (Traffic Light Protocol)

A simple labeling scheme for intelligence sharing, RED, AMBER, GREEN, CLEAR, that tells recipients who they may share information with, used widely across threat-intelligence communities.

TLS

TLS is a protocol that encrypts network communication and helps verify the identity of the service being contacted.

TLS Handshake

The TLS protocol exchange that negotiates parameters, authenticates peers as configured, establishes shared traffic keys, and binds the resulting protected session to the transcript.

TOTP (Time-based One-Time Password)

TOTP generates a short-lived numeric code from a shared secret and the current time, usually in fixed time steps.

TPRM Applied

Applying third-party risk management in practice end to end, vendor inventory, tiering, due diligence, contracts, monitoring, that builds a working TPRM function rather than a paper one.

TPRM Lifecycle

The end-to-end lifecycle of third-party risk management, identification, due diligence, contracting, monitoring, offboarding, that the GRC analyst manages through each stage.

TTP (Concept)

A tactic, technique, or procedure describing an adversary objective, method, or specific implementation, with the three levels kept distinct when mapping evidence.

TTP Mapping

Mapping observed activity (during a hunt or incident) to specific ATT&CK tactics, techniques, and procedures, so findings tie back to a shared framework for coverage, sharing, and analysis.

TTP-Based Hunting

Threat hunting organized around specific TTPs rather than indicators, looking for adversary behavior (credential dumping, lateral movement patterns) in telemetry to catch threats indicator-based detection misses.

TTPs

Tactics, Techniques, and Procedures: the patterned ways an adversary operates, more durable signals than indicators because attackers tend to keep their methods even when they rotate infrastructure.

TXT Record

A DNS record type that holds arbitrary text. Heavily used for security purposes: SPF, DKIM, DMARC, and domain-ownership verification all rely on TXT records.

Tabletop Exercise

A discussion-based exercise where teams walk through a hypothetical incident scenario, decisions, communications, actions, to test plans and build readiness without touching real systems.

Tabletop Exercise Design

Designing tabletop exercises deliberately, scenario, participants, injects, facilitation, learning objectives, so the exercise actually tests what matters and produces durable improvements.

Tabletop Facilitation

Tabletop facilitation guides a discussion-based exercise through objectives, rules, injects, simulated time, participant safety, and balanced discussion without dictating every answer.

Tactic

In MITRE ATT&CK terms, the why of an adversary action, the high-level objective like Initial Access, Persistence, or Exfiltration, under which specific techniques sit.

Tactical Intelligence

Intelligence about specific adversary techniques and immediate indicators, useful for hunters and detection engineers writing rules and looking for matches in current telemetry.

Tagging

Labeling alerts, tickets, or cases with structured tags for techniques, severity, source, status, that makes analyst data searchable, reportable, and useful for metrics over time.

Tagging and Categorization

Application of governed labels to cases, events, assets, or findings so reporting, routing, search, measurement, and knowledge reuse remain consistent.

Tail Risk (90th Percentile)

A 90th-percentile tail measure is the value at or below which ninety percent of modeled outcomes fall and above which ten percent fall.

Tamper Protection

Hardening that prevents users or malware from disabling or weakening security controls, like turning off antivirus, EDR, or logging. A core defense against well-known attacker tradecraft.

Targeted Attacker

An adversary who deliberately selects an organization, person, asset, or relationship and adapts collection or intrusion activity to that objective.

Team Capability

The team's collective skills, depth, and breadth to operate cloud workload protection effectively, recognized as a critical input alongside tools and process when designing a CWP program.

Technical Compliance Metrics

Compliance metrics derived from technical sources, configuration scans, vulnerability data, control telemetry, that make compliance measurable in real time rather than only via point-in-time audits.

Technical Control

A control implemented through hardware, software, configuration, protocol, or automated policy enforcement.

Technical Controls

Controls implemented through technology, firewalls, MFA, encryption, EDR, that automate enforcement of security requirements. One of three foundational control categories alongside administrative and physical.

Technical Debt

Accumulated shortcuts, deferred work, and aging components in technology, that create risk over time, security gaps, fragile dependencies, hard-to-fix exposures, that compound until addressed.

Technical Intelligence

Intelligence focused on technical indicators and details, hashes, IPs, vulnerabilities, exploit code, that defenders use directly in tools and rules. Closely related to tactical intelligence.

Technical Skills

The technical capabilities a SOC analyst builds, networking, OS, scripting, SIEM querying, EDR, that enable effective investigation and detection work. Distinct from but complementary to soft skills.