Glossary

Technical Intelligence

Intelligence focused on technical indicators and details, hashes, IPs, vulnerabilities, exploit code, that defenders use directly in tools and rules. Closely related to tactical intelligence.

Technical Skills

The technical capabilities a SOC analyst builds, networking, OS, scripting, SIEM querying, EDR, that enable effective investigation and detection work. Distinct from but complementary to soft skills.

Technique

In ATT&CK terms, the how of an adversary action, the specific method used to achieve a tactic, like Phishing for Initial Access or Process Injection for Defense Evasion.

Telemetry

The data systems generate about their behavior, logs, metrics, traces, events, that defenders collect, store, and analyze to detect threats, investigate incidents, and run security operations.

Telemetry Gaps

Areas where the data needed to detect or investigate isn't being collected, blind spots that limit what detections can see no matter how clever the rules are.

Telemetry Mapping

Mapping the telemetry available to the detections and investigations it supports, so coverage gaps and surplus collection are both visible, and decisions about telemetry investment are evidence-based.

Telemetry Volume

The amount of telemetry cloud-native workloads produce, which can grow far faster than traditional sources, forcing deliberate decisions about what to collect, store, and query.

Terraform Security

Securing Terraform-managed infrastructure: linting and scanning IaC, secret handling, state-file protection, module trust, and policy-as-code gates, so what Terraform deploys is safe by construction.

Test Coverage

How thoroughly the detection catalog has been tested against representative scenarios, so engineers know which detections are validated and which are unproven assumptions.

Testable Requirements

Policy requirements written so compliance can be measured objectively, with clear, observable, evidence-supported criteria, rather than vague aspirations that can't be evaluated.

The Shared Responsibility Model

The foundational cloud-security concept that security obligations split between cloud provider and customer along defined lines, and that customer responsibilities differ across IaaS, PaaS, and SaaS.

Third Party BC Assessment

Assessing third parties' business continuity and disaster recovery capabilities, so the organization understands what to expect when a critical vendor has an outage or disaster.

Third-Party Assessment

From an audit and assurance lens, assessing the controls and risks of third parties (vendors, partners, providers), often using SOC 2 reports, questionnaires, or independent audits.

Third-Party Risk

Risk introduced by vendors, suppliers, partners, or external services.

Threat

A threat is something that could cause harm to an asset, such as an attacker, mistake, outage, or unsafe condition.

Threat Actor

An entity, individual, group, or organization, that has the intent and capability to carry out an attack. Recognizing different actor types shapes how defenders prioritize and respond.

Threat Hunters

The people who conduct threat hunting, proactive analysts who form hypotheses and search telemetry for adversary activity that automated detections may have missed.

Threat Hunting

Proactively searching telemetry for adversary activity that automated detections have missed, by forming hypotheses, running iterative searches, and confirming or ruling out findings.

Threat Intelligence

Information about adversaries, their motivations, capabilities, and behaviors, that defenders consume to make better decisions about detection, response, and investment. Foundational to modern defense.

Threat Intelligence Feeds

Continuous data streams of threat indicators, IPs, domains, hashes, and signatures, that organizations subscribe to or share, feeding detection tools and enrichment workflows.

Threat Model

A structured description of who would attack a system, what they would target, and how, used to drive defensive design and prioritize controls before issues become incidents.

Threat Model Output Quality

How well a threat-modeling exercise's output supports decisions, specific, prioritized, actionable threats and mitigations, rather than a long, vague list that nothing changes from.

Threat Modeling

A structured way to identify what can go wrong and where defenses should focus.

Threat Modeling Effectiveness

Whether threat modeling actually changes defensive outcomes, controls implemented, designs adjusted, risks reduced, rather than just producing documents that sit on a shelf.

Threat Modeling Facilitation Challenges

The recurring challenges in facilitating threat-modeling sessions, engagement, scope, depth, getting the right participants, that make running productive sessions harder than the technique itself.

Threat Modeling Output

The artifacts a threat-modeling exercise produces, documented threats, mitigations, decisions, follow-ups, that downstream engineers and analysts actually consume and act on.

Threat Modeling Tools

Specific tools that support threat modeling, from diagramming tools like OWASP Threat Dragon and Microsoft Threat Modeling Tool to lightweight collaborative whiteboards, used to capture and share models.

Threat Modeling Value

The real benefits threat modeling delivers, earlier detection of design issues, more focused controls, better risk communication, that justify investing in the practice across the SDLC.

Threat Modeling Workshop Design

The deliberate design of threat-modeling workshops, scope, attendees, materials, timeboxing, that makes sessions productive rather than wandering or hollow.

Threat Modeling for Analysts

How security analysts use threat modeling in day-to-day work, scoping investigations, anticipating attacker behavior, communicating risk, not as a one-off design exercise but as ongoing thinking.

Threat Modeling in SDLC

Integrating threat modeling into software development lifecycle stages, design, before release, and on major change, so threats are addressed when they're cheapest to fix.