Glossary

Tokenization

Replacing sensitive data with a substitute value that has limited meaning outside a controlled system.

Tone from the Top

The signal leaders send about how seriously they take security, by their actions, statements, and resource allocation, that shapes whether the rest of the organization treats it seriously.

Tool Exit Portability

Tool exit portability is the ability to retrieve usable compliance data, evidence, mappings, approvals, and audit history when a platform is replaced or a contract ends.

Tool Integration

Making cloud-workload-protection tools work together, sharing data, alerts, context, so the team gets unified visibility instead of fragmented dashboards across many separate consoles.

Tool Selection

Choosing cloud-workload-protection tools deliberately based on the workload mix, team capability, and program maturity, rather than buying based on hype or vendor pitches.

Tooling ROI Analysis

Tooling ROI analysis compares supported risk reduction and other benefits with the full lifecycle cost of a security technology and realistic alternatives.

Top-Down and Bottom-Up Role Analysis

Top-down and bottom-up role analysis combines required business work with patterns observed in current access data to design and validate candidate roles.

Training Delivery Cadence

The planned timing and frequency of learning activities, selected to support retention and behavior without assuming frequency alone proves effectiveness.

Transfer Impact Assessment

A required GDPR assessment of the risks involved in transferring personal data outside the EU, considering destination country laws and protections, after the Schrems II ruling.

Transfer Reassessment

Transfer reassessment re-evaluates a cross-border transfer when its data, importer, country, subprocessor, access, key management, law, mechanism, or evidence materially changes.

Transit Gateway/Hub

A cloud networking service that connects many VPCs and on-prem networks through a central hub, replacing complex mesh peering, and a key control point for inter-network security.

Transitive Dependency Risk

Transitive dependency risk comes from components introduced indirectly by a dependency selected by the application.

Treatment Combinations

Combining multiple treatment options for a single risk, mitigate-and-transfer, mitigate-and-accept-residual, that gets a better fit than any single treatment alone.

Treatment Effectiveness

How well a risk treatment actually reduces risk in practice, measured after implementation, so the program learns what works and adjusts when treatments underperform.

Treatment Implementation

Actually putting risk treatments in place, control deployment, contract changes, insurance arranged, that closes the loop from decision to operational reality.

Treatment Selection Logic

The reasoning that picks a specific treatment (or combination) for a risk, considering cost, effectiveness, appetite, feasibility, that distinguishes deliberate choice from default mitigation.

Treatment Strategy

The overall plan for how risks of various types will be treated, what defaults apply, when to escalate, how appetite shapes choices, that guides individual treatment decisions consistently.

Trend Analysis

Analyzing how risks, incidents, or controls evolve over time, looking for trajectories rather than snapshots, so the program sees direction of travel and acts before issues mature.

Triage

The first review of an alert or issue to decide priority and next action.

Triage Checklist

A concise, ordered set of evidence, safety, scope, severity, containment, documentation, and escalation checks used to make an initial incident decision consistently.

Triage Methodology

The disciplined approach an analyst uses to triage incoming alerts, gathering context, dispositioning, escalating, that turns alert volume into structured decisions rather than ad hoc reactions.

Triage Priority Decision

A triage priority decision sets response urgency from evidence confidence, active capability, asset and identity consequence, spread potential, and time sensitivity.

Triage Throughput

How many alerts a triage analyst processes per unit time, while maintaining quality, a key SOC operational metric that exposes capacity, methodology effectiveness, and queue health.

True Positive

From a logging/monitoring lens, the alerts that turned out to be real, that detection-engineering teams track to evaluate which rules are actually catching threats and refine accordingly.

True Positive (Outcome)

An alert that correctly represents the behavior or condition its logic was designed to identify, whether the underlying activity is malicious, authorized, or benign.

True Positive Rate

From a blue-team-operations lens, the proportion of real threats that the detection correctly fires on, a measure of detection sensitivity, also called recall.

Trust Boundary

A trust boundary is a point where data, identity, control, or responsibility crosses from one trust level to another.

Trust Boundary Analysis

Trust boundary analysis identifies where identity, privilege, tenant, network, device, administrative control, or organizational responsibility changes in a system flow.

Trust Chain

A chain of trust in cryptography: a certificate is trusted because it was signed by an issuer that is itself trusted, up to a root CA that is trusted by configuration. Foundational to PKI.

Trust Policy

In AWS IAM, the policy attached to a role that defines who can assume it, distinct from the permissions policy that defines what the role can do. Misconfigured trust policies are a major cloud security issue.

Tuning Anti-Patterns

Common bad habits in detection tuning, suppressing whole rules, broad exclusions, untracked changes, that reduce noise short-term but degrade detection coverage and program credibility over time.