Glossary

Virtual Machine Security

From a cloud-foundations lens, securing cloud VMs end to end, image, configuration, identity, runtime, the workload-layer counterpart to broader cloud security.

Virtual SOC (VSOC)

A virtual SOC is a distributed security-operations team that works through shared processes and technology rather than one physical operations room.

Visibility Gap Operationalization

Turning identified visibility gaps into actionable work, telemetry projects, detection coverage, hunt plans, so gaps don't just get logged but get closed.

Visual Analysis

Using visualizations, graphs, heatmaps, timelines, scatterplots, to spot patterns in telemetry that are invisible in tables, a productive hunting technique against rich data.

Vulnerability

A vulnerability is a weakness that could be exploited to harm a system, application, account, or process.

Vulnerability Alert

A notification that a potentially affected asset, component, configuration, or exposure requires validation and risk-based remediation or exception handling.

Vulnerability Alerts

Alerts about newly disclosed vulnerabilities relevant to the organization, that analysts triage to assess exposure and decide whether immediate response is needed.

Vulnerability Data Sources

Vulnerability data sources are the authorized technical and advisory inputs used to identify potentially affected assets, components, configurations, and services.

Vulnerability Disclosure Intake

Vulnerability disclosure intake receives, protects, validates, routes, tracks, and coordinates reports from researchers, customers, vendors, employees, and partners.

Vulnerability Exception Governance

Vulnerability exception governance provides accountable, time-bounded approval when a remediation target cannot be met or an alternative treatment is accepted.

Vulnerability Finding Identity

Vulnerability finding identity binds an assertion to a specific asset or component, evidence source, observation time, product and version, location, configuration, and lifecycle state.

Vulnerability Management

The discipline of identifying, prioritizing, remediating, and verifying vulnerabilities across an organization's systems on an ongoing basis. A defining defensive program alongside detection and IR.

Vulnerability Management Lifecycle

The vulnerability management lifecycle connects discovery, assessment, validation, prioritization, treatment, verification, reporting, and improvement as continuing risk-reduction work.

Vulnerability Management Program

The structured program that runs vulnerability management, policy, scope, SLAs, tooling, ownership, that turns ad hoc scanning into a credible ongoing discipline with accountability.

Vulnerability Management SLAs

Service-level agreements specifying how quickly vulnerabilities must be remediated by severity, critical in days, high in weeks, that translate VM policy into concrete, measurable expectations.

Vulnerability Prioritization

Ranking vulnerabilities by actual risk, severity plus exposure plus exploitation context, so remediation effort goes where it reduces risk most, rather than treating CVSS scores as a queue.

Vulnerability Scanning

Automated checking of systems for known vulnerabilities, missing patches, weak configurations, exposed services, producing the raw findings VM programs consume.

Vulnerability Threat Intelligence

Vulnerability threat intelligence evaluates sourced information about exploit availability, campaigns, targeted technologies or sectors, prerequisites, adversary use, indicators, and vendor response.

Vulnerability Triage Process

A repeatable workflow that validates affected assets and versions, exposure, exploitation evidence, consequences, controls, ownership, priority, and next action.

Vulnerability-Based Identification

Identifying risks by starting from known vulnerabilities and weaknesses in the environment, then tracing what they could allow, a concrete risk-identification approach.

WMI Event Subscription

A Windows Management Instrumentation filter, consumer, and binding that runs an action when a defined event occurs and can be abused for fileless persistence.

WMI Event Subscriptions

A Windows persistence mechanism using WMI's event-subscription model to run code on specified triggers, popular with attackers because it's flexible, fileless, and easy to overlook.

WMI Subscription Hunting

WMI subscription hunting examines permanent event filters, consumers, bindings, creators, namespaces, queries, commands, and resulting execution for unauthorized persistence.

WSTG Test Coverage

WSTG test coverage maps applicable versioned OWASP Web Security Testing Guide scenarios to application assets, identities, methods, evidence, and completion states.

Walkthrough Review

A structured review in which plan owners and participants trace procedures, roles, assumptions, contacts, and dependencies without executing a full recovery.

War Room

A dedicated space (physical or virtual) where the incident response team coordinates during a major incident, with continuous presence, fast decisions, and tight communication.

Warm Standby

A disaster-recovery strategy where a backup environment is partially provisioned and kept ready, faster than rebuilding cold, cheaper than running hot, a middle DR posture.

Weak Algorithm

A cryptographic algorithm or parameter set that no longer provides the required security margin or is unsuitable for the intended construction and threat model.

Web App Incident Response

Incident response for web applications, identifying the attack vector (injection, broken auth, supply chain), scoping impact, containing without destroying evidence, with web-specific demands.

Web Application

A program delivered over HTTP/HTTPS that runs in browsers (client) and on servers, the dominant application form on the internet and the primary attack surface for defensive-web work.

Web Application Firewall

A control that inspects web traffic and can block common attack patterns.