Glossary

VM Reporting to Leadership

Communicating vulnerability-management posture and progress to leadership clearly and credibly, what's at risk, what's improving, what investments help, that turns VM data into decision support.

VM Runtime Protection

Protecting cloud VMs at runtime, monitoring process behavior, file changes, network connections, often via EDR or specialized cloud-workload agents, complementing configuration and image controls.

VM Security in Cloud

Securing cloud VMs from a cloud-engineering perspective, image, IAM, network, encryption, hardening, that an engineer implements as part of cloud infrastructure work.

VM-specific Cloud Telemetry

Telemetry distinct to cloud VMs, metadata-service access, control-plane API calls, instance-level network logs, that goes beyond on-prem endpoint data and is essential for cloud workload detection.

VPC Assessment

A structured assessment of a VPC (or set of VPCs) for security, posture, routing, segmentation, exposure, and connectivity, used to find misconfigurations and risky design choices.

VPC Design

Designing a VPC (or set of VPCs) for security and operations, subnet layout, routing, gateways, segmentation, the engineering decisions that shape what's possible to enforce later.

VPC Flow Log Analysis

Analyzing VPC flow logs (per-flow records of who talked to whom, when, and how much) to investigate cloud incidents, detect anomalies, and verify connectivity, a key cloud IR data source.

Valid Accounts

An ATT&CK technique: attackers using legitimate, working credentials (stolen, leaked, or default) for access, evasion, and persistence. Often the leading initial-access vector in modern breaches.

Validating Webhooks

Verifying that webhook requests come from the expected sender, via signed payloads, HMAC verification, or source-IP checks, since webhook endpoints are publicly reachable and trivially spoofable otherwise.

Vanity Metrics

SOC metrics that look impressive but don't actually drive better outcomes, alerts per day, total signatures deployed, that distract from metrics that matter and can mislead leadership.

Vendor Due Diligence

The structured assessment of a vendor's security and risk posture before engaging or renewing, security questionnaires, SOC 2 review, evidence checks, that grounds the relationship in informed risk acceptance.

Vendor Intelligence

Intelligence specifically about an organization's vendors, their incidents, vulnerabilities, threats targeting them, that informs ongoing third-party risk and supply-chain decisions.

Vendor Landscape

The current map of cloud-workload-protection vendors, their categories, strengths, and overlap, that informs tooling decisions in a fast-evolving market.

Vendor Questionnaires

Structured questionnaires sent to vendors to gather information about their security and risk posture, the most common instrument of TPRM due diligence and a foundational risk-management practice.

Vendor Risk Management

The governance discipline that manages risk arising from third-party vendor relationships, related to TPRM but emphasizing the program and governance lens over operational lifecycle.

Vendor Tiering

Categorizing vendors by criticality and risk so due diligence depth, contractual requirements, and monitoring scale with actual exposure, a foundational TPRM practice.

Vertical Privilege Escalation

Privilege escalation that gains higher-level access than the user has, from regular user to admin, in contrast to horizontal escalation that accesses another peer's account.

Virtual Machine Security

From a cloud-foundations lens, securing cloud VMs end to end, image, configuration, identity, runtime, the workload-layer counterpart to broader cloud security.

Visibility Gap Operationalization

Turning identified visibility gaps into actionable work, telemetry projects, detection coverage, hunt plans, so gaps don't just get logged but get closed.

Visual Analysis

Using visualizations, graphs, heatmaps, timelines, scatterplots, to spot patterns in telemetry that are invisible in tables, a productive hunting technique against rich data.

Vulnerability

A vulnerability is a weakness that could be exploited to harm a system, application, account, or process.

Vulnerability Alerts

Alerts about newly disclosed vulnerabilities relevant to the organization, that analysts triage to assess exposure and decide whether immediate response is needed.

Vulnerability Management

The discipline of identifying, prioritizing, remediating, and verifying vulnerabilities across an organization's systems on an ongoing basis. A defining defensive program alongside detection and IR.

Vulnerability Management Program

The structured program that runs vulnerability management, policy, scope, SLAs, tooling, ownership, that turns ad hoc scanning into a credible ongoing discipline with accountability.

Vulnerability Management SLAs

Service-level agreements specifying how quickly vulnerabilities must be remediated by severity, critical in days, high in weeks, that translate VM policy into concrete, measurable expectations.

Vulnerability Prioritization

Ranking vulnerabilities by actual risk, severity plus exposure plus exploitation context, so remediation effort goes where it reduces risk most, rather than treating CVSS scores as a queue.

Vulnerability Scanning

Automated checking of systems for known vulnerabilities, missing patches, weak configurations, exposed services, producing the raw findings VM programs consume.

Vulnerability-Based Identification

Identifying risks by starting from known vulnerabilities and weaknesses in the environment, then tracing what they could allow, a concrete risk-identification approach.

WMI Event Subscriptions

A Windows persistence mechanism using WMI's event-subscription model to run code on specified triggers, popular with attackers because it's flexible, fileless, and easy to overlook.

War Room

A dedicated space (physical or virtual) where the incident response team coordinates during a major incident, with continuous presence, fast decisions, and tight communication.

Warm Standby

A disaster-recovery strategy where a backup environment is partially provisioned and kept ready, faster than rebuilding cold, cheaper than running hot, a middle DR posture.