Glossary

Threat Modeling for Architecture

Threat modeling for architecture identifies credible actors, assets, entry points, abuse cases, trust boundaries, failure modes, and attack paths before selecting security controls.

Threat Modeling in SDLC

Integrating threat modeling into software development lifecycle stages, design, before release, and on major change, so threats are addressed when they're cheapest to fix.

Threat Prioritization

Threat prioritization orders analysis and response using consequence, affected population, preconditions, capability, path feasibility, controls, detectability, recovery, uncertainty, and organizational risk criteria.

Threat Scenario Development

Threat scenario development combines an actor or condition, preconditions, a path through the system, a failed control or assumption, and an adverse consequence into a testable concern.

Threat Statement Quality

Threat statement quality makes the actor or condition, preconditions, affected element, harmful action or failure, adverse consequence, objective, evidence, and uncertainty understandable and decision-ready.

Threat and Vulnerability Evidence

Threat and vulnerability evidence includes current, relevant information about actors, events, exposures, weaknesses, configurations, incidents, and dependencies used to evaluate a risk scenario.

Threat to Detection

The detection-engineering practice of translating identified threats into specific detections, mapping each threat through hypothesis, data needs, rule logic, to a working production detection.

Threat-Based Identification

Identifying risks by walking specific threats and asking what they could do, surfacing concrete risks tied to plausible adversary behavior rather than starting from generic categories.

Threat-Informed Coverage

Measuring and managing detection coverage by the threats and techniques most relevant to the organization, not by raw counts of rules. A defining detection-engineering practice.

Threat-Informed Hunting

Hunting driven by specific threat intelligence, recent campaigns, known TTPs, sector-targeted actors, so hunts pursue plausible threats rather than searching at random.

Threat-Mitigation Traceability

Threat-mitigation traceability links every threat to existing, planned, absent, rejected, or accepted controls and each control back to its threats, owner, implementation, validation, status, and residual concern.

Three Lines Model

The Three Lines Model explains how governing bodies, management, risk and compliance functions, and independent assurance contribute to governance and risk management.

Three Lines of Defense

A governance model assigning responsibilities across three layers, operating risk owners, oversight functions, and internal audit, so risk is managed with appropriate independence.

Three Pillars

A cloud-native security model with three pillars, identity, configuration, and runtime, that organizes the main protection layers and is widely used to structure cloud-native security thinking.

Three-Way Handshake

The TCP setup exchange (SYN, SYN-ACK, ACK) that establishes a connection between two endpoints. Foundational to understanding networking and to recognizing many TCP-based attack patterns.

Threshold Detection

Detection that fires when a metric crosses a defined threshold, login failures above a count, traffic above a baseline, useful for known patterns but limited where thresholds are hard to set.

Tier 1

The first analyst tier in a traditional SOC, handling initial triage of alerts, deciding what is benign, what needs more investigation, and what to escalate. The entry point for many SOC careers.

Tiered Admin

A privileged-access model that splits admin privileges into tiers (typically Tier 0/1/2), restricting which credentials and accounts can be used on which systems to limit lateral attack paths.

Time Bucketing

Time bucketing groups events into explicit intervals so counts, rates, and aggregates can be compared consistently.

Time Metric Boundary

A time metric boundary defines start and end events, clock source, pauses, exclusions, missing values, and case population for an operational duration measure.

Time Synchronization

Keeping system clocks synchronized via NTP or similar, so log timestamps align across systems. Foundational to investigation, correlation, and authentication protocols that depend on accurate time.

Time-Boxing

Limiting how long an analyst spends on a single task or investigation before deciding to escalate, move on, or change approach. A foundational analyst habit that prevents getting stuck.

Time-Series Analysis

Analyzing data over time, trends, seasonality, sudden changes, in hunting and investigation, to surface activity unlike historical patterns at a host, account, or service.

Time-Series Detection

Detection rules that reason about behavior over time, using moving averages, seasonality, and deviations, in SIEM query languages to catch threats invisible to single-point thresholds.

Timeline Analysis

Organizing events by time to understand how an incident or change unfolded.

Timeline Reconstruction

Reconstructing what happened during an incident in chronological order, attacker actions, system events, defender steps, that produces the canonical narrative used in IR work.

Timeliness

The currency of threat intelligence, fresh, current, recent enough to be acted on, that defines whether intelligence is still useful or already stale by the time it reaches its consumers.

Token

A piece of data that represents identity, authorization, or session state.

Token Signing

Application of a digital signature or keyed MAC to a token so recipients can validate integrity and issuer evidence, while still checking audience, time, purpose, and claims.

Token Theft Hunting

Token theft hunting searches for evidence that a bearer token, refresh token, session cookie, assertion, or derived session was used outside its legitimate context.

Token-Based Auth

Authentication that issues a token (often JWT) after initial verification, which the client presents on subsequent requests. The dominant model for cloud-native APIs and microservices.