Security words, in plain English.

2FA bypassGetting past a second sign-in step by exploiting how it is built or enforced.

ABACPermissions decided by attributes like department, location or data label, not just role. Abandoned packageA dependency no longer maintained, so new flaws in it will not get fixed. Access controlThe rules deciding which person can see or do which thing in your app. Access control listA list on a resource naming who may read, write or change it. Access reviewA regular check that each person still needs the access they hold. Access tokenA short-lived token that lets a client call an API on a user's behalf. Account enumerationLearning which emails have accounts because your app answers differently. Account lockoutBlocking an account after repeated failed sign-ins, and the denial it can cause. Account sharingOne paid account used by many people, and how a business detects and limits it. Account takeoverAn attacker ends up signed in as one of your real users. Adaptive authenticationAsking for more proof when a sign-in looks unusual. Admin panel exposureA management page left reachable by the public or by ordinary accounts. Admission controllerA cluster gate that can reject workloads breaking your security rules. Advanced persistent threatA skilled attacker who stays hidden in a network for a long time. AES-GCMA widely used encryption mode that also detects tampering with the data. Affiliate fraudFaking sales or clicks to earn commission you did not earn. AI data leakageA model or its logs exposing private data that went into prompts or training. Alert fatigueTeams ignoring warnings because too many of them turn out to be noise. AllowlistA list of what you permit, with everything else refused by default. APIThe part of your application other software talks to, not a person. API abuseUsing an API as designed but at a scale or in a way that harms you. API authenticationHow an API decides which caller is making a request before it does anything. API gatewayA front door that routes API traffic and applies shared checks like auth and limits. API inventoryA maintained list of every API you expose, who owns it and what it returns. API keyA secret string that identifies the app calling your API, and is easily leaked. API key rotationIssuing new API keys on a schedule and retiring the old ones. API penetration testingA pentest aimed at your API's endpoints, auth, data access and business rules. API rate limitingCapping how many calls a client can make so abuse and cost stay bounded. API schema validationRejecting requests that do not match the format the API says it accepts. API versioningRunning old and new API versions together, and the security gaps the old ones keep. App reverse engineeringTaking a mobile app apart to read its code, keys and hidden endpoints. Application securityKeeping the software you build and run from being abused. Argon2A modern password hashing function that is slow and memory-hungry on purpose. Asset inventoryA current list of the systems, apps and data you are responsible for. Attack pathA chain of small steps that together take an attacker to something valuable. Attack surfaceEverything about your application an outsider can touch. Attestation letterA short signed statement that a test was done, for customers or auditors. Audit logA record of who did what and when, kept so you can answer later. Authenticated scanA scan that signs in first so it can see behind the login. Authenticated testingTesting the parts of an application that only signed-in accounts can reach. AuthenticationProving you are who you say you are. It answers one question only. AuthorizationDeciding what a proven user is then allowed to do. Automated penetration testingSoftware that finds and proves vulnerabilities on its own, repeatably and on a schedule.

Backup integrityKnowing your backups are complete, untouched and actually restorable. Base imageThe starting image your container builds on, and the old packages it can bring. Bastion hostA single hardened server that is the only way in for administrators. bcryptA deliberately slow password hashing function with a built-in salt. Bearer tokenA token that works for whoever holds it, with no further proof of identity. BFLAAn API lets an ordinary account call functions meant only for admins. BIMIA standard that shows your logo beside authenticated email in some inboxes. Black-box testingTesting an app from outside, with no access to the source code. Blind SQL injectionInjection where no data comes back, so answers are read from timing or behaviour. BOLAAn API returns a record just because you asked for it by number. Bot trafficAutomated visitors that scrape, stuff credentials or buy stock before real customers. Branch protectionRepository rules that stop unreviewed code reaching the main branch. Breach and attack simulationSoftware that repeatedly plays known attacker steps to test your defences. Breach notificationTelling regulators and affected people about a data breach within a set time. Breached password checkRefusing passwords that already appear in public leaks. Break-glass accountA powerful emergency account, locked away and loudly monitored when used. Broken access controlAn application failing to enforce its own rules about who may do what. Broken authenticationFlaws in sign-in or token handling that let someone pose as another account. Broken function-level authorisationCalling an API function your account was never meant to use. Broken object property level authorisationSeeing or changing single fields of a record that you should not. Browser fingerprintingIdentifying a visitor from the many small details their browser reveals. Brute forceTrying passwords or codes over and over until one of them works. Bug bountyPaying outside researchers for vulnerabilities they report responsibly. Build pipeline compromiseAn attacker altering your build system so every release carries their code. Build provenanceA signed record of where, when and how a piece of software was built. Business continuityKeeping critical services running, or restoring them fast, through a disruption. Business email compromiseFraud using a hacked or faked work email to redirect payments or data. Business impactWhat a flaw would cost in money, customers, uptime or trust if used. Business logic flawNothing is technically broken, but your own rules turn against you.

CanonicalisationReducing input to one standard form before checking it, so tricks cannot slip by. Card testingUsing your checkout to check which stolen card numbers still work. CASBA control point between your staff and the cloud apps they use. CERT-In directionsIndian rules requiring certain incidents to be reported within six hours. Certificate expiryA TLS certificate running out, which breaks trust and often the whole site. Certificate pinningAn app accepting only one expected certificate, so a fake one is refused. Chain of custodyA record of who handled evidence, so it can be trusted later. Chained vulnerabilitiesSeveral smaller flaws combined to produce a much bigger impact than any alone. Chaos engineeringBreaking parts of a live system on purpose to learn how it fails. Chargeback fraudDisputing a genuine purchase with the card issuer to get money back and keep the goods. Choosing a pentest providerWhat to ask, check and compare before hiring a firm to test your software. CI/CDThe pipeline that builds, tests and ships code on every merge. Cipher suiteThe set of algorithms two sides agree to use when they set up a secure connection. CIS ControlsA prioritised list of safeguards that stop the most common cyber attacks. CISA KEV catalogueA government list of vulnerabilities known to be exploited in real attacks. ClickjackingTricking someone into clicking your button while it is hidden from them. Closed-loop retestRe-running the exact exploit after a fix, so the finding closes only on proof. Cloud credentials leakCloud access keys exposed in code, images or logs and then used by others. Cloud key managementUsing the provider's managed service to create, store and rotate encryption keys. Cloud loggingSwitching on and keeping the provider's activity logs so you can answer what happened. Cloud misconfigurationA cloud setting left unsafe, such as open storage or an overly broad permission. Cloud penetration testingTesting cloud accounts and services for weaknesses, within the provider's rules. Cloud privilege escalationUsing a small cloud permission to gain a much larger one inside the same account. Cloud workload protectionSecurity tools that watch servers, containers and functions running in the cloud. Cluster hardeningTightening a Kubernetes setup against published good-practice benchmarks. Code ownersPeople named as required reviewers for sensitive parts of a codebase. Code signingSigning software so users and systems can check who released it and that it is intact. Command injectionInput that ends up run as an operating system command on your server. Compensating controlA different safeguard used to cover a gap you cannot close directly. Compliance reportA report shaped to show an auditor that a required test or control was done. Concurrent sessionsOne account signed in on several devices at once, and how many you allow. Confused deputyA trusted service tricked into using its own power for someone who lacks it. Container escapeBreaking out of a container to reach the machine that hosts it. Container image scanningChecking a built image for known-vulnerable packages before it ships. Container registryThe store that holds your images, which needs its own access control. ContainmentLimiting an incident's spread first, before the clean-up starts. Content Security PolicyA header telling the browser which scripts a page may load. Content sniffingA browser guessing a file's real type, which can turn an upload into a script. Content-type validationChecking what a request or upload really is, not just what it says it is. Continuous penetration testingTesting that runs again whenever your application changes, not once a year. Cookie prefixA name prefix such as __Host- that makes browsers enforce stricter cookie rules. Cookie scopeThe domain and path settings that decide which sites and pages receive a cookie. Cookie tossingA sibling subdomain planting cookies that your main site then trusts. CORSThe browser rule for which sites may read responses from your API. CORS misconfigurationA CORS setup that lets sites you never meant to trust read your API responses. Coupon abuseUsing a discount code more times, or in more ways, than you intended. CPEA standard name for a product and version, used to match software to CVEs. CrawlingFollowing links and forms automatically to map out what an app exposes. Credential recoveryThe ways a locked-out user gets back in, which are often the weakest door. Credential stuffingTrying passwords leaked elsewhere, because people reuse them. CRLF injectionUsing carriage return and line feed characters to split a response or a log line. Cross-account accessOne signed-in account reaching another account's data or functions. Cross-Origin-Embedder-PolicyA header requiring embedded resources to opt in before your page will load them. Cross-Origin-Opener-PolicyA header that isolates your page from windows opened by other sites. Cross-site leaksSmall side effects, like timing or errors, that let another site infer private data. CSP nonceA one-time value that marks which inline scripts a content security policy allows. CSP report-only modeTrying a content security policy by logging breaches without blocking anything. CSPMTools that keep checking your cloud settings against security good practice. CSPRNGA random number generator safe to use for secrets, tokens and keys. CSRFAn attacker's page makes a logged-in user's browser act on your site. CSRF tokenA secret value in each form that proves the request came from your own page. CSV injectionSpreadsheet formulas hidden in exported data that run when someone opens the file. CVEA public reference number for one known flaw in one piece of software. CVSSA scoring system that turns a vulnerability into a number out of ten. CVSS 4.0The newest CVSS version, adding clearer threat and supplemental metrics. CVSS environmental scoreA CVSS score adjusted for how the flaw affects your own setup. CVSS vectorThe short string that records each factor behind a CVSS score. CWEA catalogue of vulnerability types, rather than individual bugs. CWE mappingTagging each finding with the weakness type that describes it. CWE Top 25A yearly list of the most dangerous software weakness types. Cyber EssentialsA UK scheme certifying that an organisation has basic cyber protections in place. Cyber insuranceCover for costs after a cyber incident, usually conditional on controls being in place. CycloneDXA standard format for writing an SBOM so tools can exchange it.

Dangling DNSA DNS record pointing at something you no longer own or run. Dangling markupInjected HTML that never closes, swallowing the page after it and sending it out. DASTTools that attack a running application from the outside. Data breachInformation you hold ends up somewhere it should not be. Data classificationLabelling data by how sensitive it is so each kind gets the right protection. Data exfiltrationQuietly copying data out of your systems to somewhere the attacker controls. Data loss preventionTools and rules that stop sensitive data leaving where it should stay. Data maskingHiding part of a value, such as card digits, so most people only see a safe version. Data minimisationCollecting and keeping only the personal data you actually need. Data residencyWhere in the world your customers' data is physically stored. Debug mode in productionLeaving developer switches on in a live app, which leaks internals. Deep link hijackingAnother app catching a link meant for yours and reading what it carries. Defence in depthAssume any one control will fail, and have something else behind it. Delegated accessLetting one person or app act for another within limits they set. Denial of serviceMaking an application unavailable by overwhelming or exhausting it. Deny by defaultRefusing every request unless a rule explicitly allows it. Dependency confusionTricking a build into fetching a public package that shares a private package's name. Dependency update botA tool that opens pull requests when your libraries have newer or safer versions. Dependency vulnerabilityA known flaw in a library your application ships. Developer security trainingTeaching engineers the flaws they are most likely to introduce, and how to avoid them. Device bindingTying a session or token to one device so a copy elsewhere is refused. DevSecOpsMaking security a shared, automated part of development and operations. Digital forensicsCollecting and studying evidence from systems to learn what happened. Digital signatureA value that proves who produced data and that it has not changed since. Disaster recoveryThe plan and tools for restoring systems and data after a major failure. Distroless imageA minimal container image with no shell or package manager for an attacker to use. DKIMA signature on outgoing email that proves it came from your domain and is unaltered. DMARCA DNS policy telling receivers what to do with email that fails SPF and DKIM. DNS securityProtecting the lookup system that turns your domain name into a server address. DockerA tool for packaging an app and its dependencies into a portable container. DOM-based XSSScript injection that happens in the browser's own code, not in the server's response. Domain hijackingSomeone taking control of your domain name, and so your site and email. DORAAn EU regulation on digital operational resilience for financial firms. Double spendUsing the same balance, credit or voucher twice by acting faster than your checks. DPDP Act 2023India's law on how organisations may collect, use and protect personal data. Drive-by downloadSoftware installed just by visiting a page, without any click or consent. Dynamic analysisStudying software while it runs, rather than reading its code.

Edge securityProtections placed at the network edge, such as CDN rules and bot filtering. EDRSoftware on laptops and servers that records activity and spots attacks. Egress filteringLimiting what your servers may connect out to, which blunts data theft. Email header injectionInput that adds extra recipients or headers to an email your app sends. Email spoofingSending email that appears to come from your domain when it does not. Encryption at restStored data scrambled so a stolen disk is useless without the key. Encryption in transitProtecting data while it travels between a browser and your servers. End-of-life softwareSoftware its maker no longer supports, so new flaws stay unfixed. EntropyHow unpredictable a value is, which decides how hard it is to guess. EnumerationWorking out what exists by asking repeatedly and watching the answers. Envelope encryptionEncrypting data with a data key, then encrypting that key with a master key. EPSSA score estimating how likely a vulnerability is to be exploited in the next thirty days. etcd exposureAn open Kubernetes data store, which holds the cluster's secrets and state. Evidence of exploitationThe request, response and screenshot showing a flaw was truly used. Excessive agencyGiving an AI agent more tools and permissions than its task needs. Excessive data exposureAn API sends whole records and trusts the page to show only the safe fields. Executive summaryThe one-page version of a security report written for non-technical decision makers. ExploitThe specific sequence that turns a suspected weakness into a real one. Exploit maturityHow developed and available attack code is for a given flaw. ExploitabilityHow easily and reliably a flaw can be used in practice. Exploited findingA finding confirmed by actually using it, not one that only looks likely. Exploratory security testingUnscripted testing where the tester follows hunches about how the app breaks. Exposed Kubernetes dashboardA cluster admin screen reachable without proper sign-in. Exposure managementTracking what an attacker could actually reach across all your assets. Expression language injectionInput evaluated as an expression by a framework, which can run code.

Fake account creationMass sign-ups by bots to abuse offers, spam users or farm rewards. False negativeA real vulnerability that a test failed to find. False positiveA reported issue that turns out not to be real. False positive rateHow often a tool reports issues that turn out not to be real. Feature flag securityMaking sure switches that turn features on or off cannot be flipped by outsiders. Federated identityLetting one organisation's sign-in be trusted by another's applications. File upload vulnerabilityAn upload feature that accepts files it should refuse, such as scripts. Finding deduplicationMerging reports of the same flaw so a team sees it once. Finding triageSorting new findings into fix now, fix later, duplicate or not real. Findings exportSending findings into your ticketing or tracking tools so fixes get owned. FirewallA control deciding which traffic is allowed to reach a system. Fix verificationProving a fix works by repeating the original exploit against the new code. Forced browsingTyping the address of a page you were never linked to and finding it opens. Fourth-party riskThe risk that comes from your suppliers' own suppliers. Fraud detectionSpotting abuse of your business by patterns in behaviour, devices and payments. FuzzingThrowing malformed input at an application to see what falls over.

Gating a buildStopping a release automatically when a security check fails. GDPRThe EU law governing personal data, with strict duties and large fines. Gift card fraudDraining or guessing gift card balances before the real owner uses them. GraphQLOne API endpoint where the client asks for exactly the fields it wants. GraphQL batching abusePacking many operations into one request to dodge rate limits. GraphQL introspectionA feature that lets anyone ask a GraphQL API to describe its whole schema. Grey-box testingTesting an app with some inside knowledge, such as accounts and docs, but not the code. gRPCA fast API style between services that sends compact binary messages over HTTP/2.

Hardcoded secretA password, API key or token written straight into source code. Hardware security module (HSM)A tamper-resistant device that holds keys and does cryptography inside it. Hash collisionTwo different inputs that produce the same hash, which breaks trust in it. HashingA one-way transformation, so a password can be checked but never read back. Helm chart securityReviewing the packaged Kubernetes templates you install, and what they switch on. HIPAAThe US law protecting the privacy and security of health information. HMACA hash mixed with a secret key, proving a message is unchanged and from the key holder. Homomorphic encryptionEncryption that lets you compute on data without ever decrypting it. Horizontal privilege escalationReaching another user's data at your own level, not a higher one. HSTSA header telling browsers to use HTTPS only for your site, every time. HTML injectionGetting your page to render markup an outsider supplied, even without running scripts. HTTP header injectionSlipping line breaks into input so an attacker adds headers to your response. HTTP parameter pollutionSending the same parameter twice so different layers read different values. HTTP request smugglingSending requests that front and back servers read differently to slip one past checks. HTTP verb tamperingSwitching a request's method to reach a path that only checks other methods. HttpOnly cookieA cookie that page scripts cannot read, so XSS cannot simply steal it. HTTPSThe encrypted web protocol, and the minimum for anything with a login.

IAM roleA set of cloud permissions that a person or service can temporarily assume. IASTAn agent inside a running app that watches where input travels. Identity and access management (IAM)The tools and rules that manage who your people and services are and what they reach. Identity provider (IdP)The service that signs people in and tells your app who they are. IDORChanging an id in a request and getting back someone else's record. IDOR testingSwapping record ids between two accounts to see whether the app notices. Iframe sandboxAn attribute that strips embedded content of most of its powers. Image signingSigning container images so a cluster only runs ones your pipeline produced. Impersonation featureA support tool that acts as a customer, and the controls it needs around it. Impossible travelTwo sign-ins from places too far apart for one person to have reached. Incident communicationsWho says what, to whom and when, during and after an incident. Incident playbookA step-by-step guide for handling one type of incident the same way each time. Incident responseThe agreed plan for the hours after something has gone wrong. Incident response planA written plan for who does what in the first hours after a security incident. Incident severity levelsAgreed tiers that decide how fast and how widely an incident is escalated. Incident war roomA single place and channel where responders coordinate during a live incident. Indicators of compromiseTraces, such as addresses or file hashes, that suggest a system has been breached. Indirect prompt injectionInstructions hidden in a web page or file that an AI assistant then obeys. Informational findingAn observation that is not a vulnerability but is worth knowing about. Infrastructure as codeDescribing servers and networks in files so they can be reviewed and repeated. Infrastructure driftLive systems slowly differing from what your code says they should be. Initialisation vector (IV)A starting value that makes the same data encrypt differently each time. InjectionInput that ends up running as a command instead of being read as text. Input sanitisationCleaning or stripping risky characters from input, which is weaker than encoding. Input validationChecking that what arrives is the shape and range you expected. Insecure data storage on mobileA phone app saving tokens or personal data where other apps or people can read it. Insecure deserialisationTurning data from outside back into live objects without checking it. Insecure output handlingTrusting what a model writes and passing it on to code or a browser unchecked. Insider threatHarm from someone with legitimate access, through malice or by mistake. Install script riskCode a package runs automatically the moment you install it. Instance metadata serviceA cloud server's local service that hands out its own credentials to whoever asks. Intrusion detectionWatching network or host activity for signs that someone is breaking in. Inventory hoardingHolding stock in carts or bookings so real buyers cannot get it. ISO 27001The international standard for running an information security management system. ISO 27001 Annex AThe list of security controls an ISO 27001 certified organisation chooses from.

JailbreakA prompt crafted to push an AI model past its safety rules. Just-in-time accessGranting elevated access only when needed, and removing it soon after. JWTA signed token a client carries to prove who is signed in. JWT algorithm confusionTricking a server into verifying a token with the wrong signing method. JWT expiryThe time claim that stops a signed token from being accepted forever. JWT none algorithmA token that claims to need no signature, accepted by a careless library. JWT signature verificationChecking a token's signature properly before trusting anything inside it.

Key derivation function (KDF)A function that turns a password or secret into a strong, fixed-size key. Key escrowKeeping a copy of an encryption key with a trusted party so data can be recovered. Key rotationReplacing a credential on a schedule so a leaked one has a short life. Known-vulnerable componentA library or runtime with a published flaw that you are still shipping. Kubelet API exposureAn open node-level Kubernetes API that can run commands in pods. KubernetesA system that runs and manages containers across many machines. Kubernetes network policyRules that say which pods may talk to which other pods. Kubernetes RBACRules for which accounts and services may do what inside a Kubernetes cluster. Kubernetes secretsKubernetes objects for passwords and keys, stored encoded but not encrypted by default.

Lateral movementMoving from the first thing reached to the things worth taking. LDAP injectionInput that alters a directory lookup, such as a sign-in or user search. Least privilegeGiving every person and service the minimum access the job requires. Limit overrunExceeding a cap, such as one redemption per customer, with parallel requests. Local file inclusionMaking an app read and show a file from its own server that it should not. LockfileA file pinning exact dependency versions so builds are repeatable and checkable. Log injectionInput that forges or hides log entries by smuggling in new lines. Log retentionHow long you keep logs, which decides whether you can investigate old incidents. Logging and monitoringRecording what happens, and actually watching what gets recorded. Logout invalidationMaking sure signing out really kills the session on the server, not just in the browser. Loyalty points abuseEarning, moving or redeeming points in ways your programme was never meant to allow.

Magic linkA sign-in link sent by email that replaces the password for that visit. Malicious packageA published library built to steal data or run code on whoever installs it. MalwareSoftware built to damage systems, steal data or give an attacker control. Man-in-the-middle attackSomeone sitting between two parties, reading or changing what passes between them. Manual penetration testingTesting led by a person's judgement, not just by running an automated scanner. Mass assignmentWhen the fields in a request get written straight onto a record. MDRAn outside service that monitors your systems and responds to threats for you. Mean time to remediateThe average time from finding a vulnerability to fixing it. MFAA second proof beyond the password, usually a code or a hardware key. MFA fatigueSpamming approval prompts until a tired user taps accept. Missing function-level access controlA sensitive action that checks you are signed in but not whether you may use it. MitigationReducing what a vulnerability can do without actually fixing it. MITRE ATT&CKA public catalogue of the tactics and techniques real attackers use. Mixed contentAn HTTPS page loading some resources over plain HTTP, which can be tampered with. Mobile penetration testingTesting a mobile app and the services it talks to for security flaws. Model theftCopying a proprietary model by extracting its weights or imitating its answers. MSSPA provider that runs security services, such as monitoring or testing, for other businesses. mTLSA connection where both client and server prove who they are with certificates. Multi-cloud securityKeeping controls consistent when you run across more than one cloud provider. Multi-tenancyOne running application serving many customers whose data must stay apart. Mutation testingDeliberately changing code to check whether your tests notice the change.

NCA ECCSaudi Arabia's Essential Cybersecurity Controls for national organisations. Need to knowLimiting information to the people whose work actually requires it. Negative quantityA numeric field accepting values below zero so balances move the wrong way. Network penetration testingTesting the servers, services and network paths around your applications. NIS2An EU directive setting security and reporting duties for many essential businesses. NIST Cybersecurity FrameworkA voluntary framework that organises security work into six core functions. NonceA value issued for a single use, so it cannot be replayed later. Nonce reuseUsing a single-use value twice, which can break the encryption or the check built on it. NoSQL injectionInput that changes the meaning of a query to a non-SQL database. NVDThe US government database that adds scores and details to published CVEs.

OAuthThe standard behind every sign in with and connect your account button. OAuth redirect URIThe address a sign-in provider sends the user back to, which must be matched exactly. Object injectionSupplying crafted serialised data so your app builds objects the attacker designed. Object storage securityLocking down buckets and blobs: access rules, encryption, versioning and logging. Object-level authorisationChecking access to each individual record, not only to the type of record. On-premisesSoftware running on hardware you own or control, not a vendor's. Opaque tokenA token with no readable content, looked up on the server to find who it is for. Open redirectA page that forwards visitors to any address handed to it in the URL. Open source licence complianceMeeting the legal terms attached to the open-source code you use. OpenAPI specificationA file that describes an API's endpoints so tools and people can read it. OpenID ConnectA sign-in layer on top of OAuth that tells your app who the user is. OSSTMMA methodology for measuring operational security through repeatable tests. Output encodingEscaping data for its destination so it is shown as text, not run as code. Overly permissive IAMCloud permissions broader than a job needs, so one leak reaches far. OWASP API Security Top 10The OWASP list of the most serious risks specific to APIs. OWASP ASVSA detailed checklist of security requirements for web applications. OWASP LLM Top 10The OWASP list of the main security risks in applications built on language models. OWASP mappingTagging each finding with the OWASP risk category it falls under. OWASP MASVSA standard listing what a secure mobile app should do. OWASP SAMMA model for measuring and improving how well an organisation builds secure software. OWASP Top 10A widely used list of the ten most critical web application risks. Ownership checkConfirming that the record being requested belongs to the account asking for it.

Package pinningFixing a dependency to one exact version rather than accepting any newer release. Padding oracleAn error message that lets an attacker decrypt data one piece at a time. Pagination abuseAsking for huge pages or walking every page to pull data out in bulk. Parameter tamperingChanging values in a request, such as a price or an id, to alter what happens. Parameterised queriesSending the query and the data separately so input can never become code. PasskeysPhishing-resistant sign-in using a key on your device instead of a password. Password policyThe rules on length, reuse and checking that decide which passwords you accept. Password reset flawA weak reset link or code that lets someone else take over the account. Password sprayingTrying a few common passwords across many accounts to stay under lockout limits. Patch managementThe routine of tracking, testing and rolling out updates across your systems. PatchingApplying the fixes that vendors and maintainers publish. Path traversalUsing a crafted file name to reach files outside the intended folder. Payment fraudUsing stolen or fake payment details to buy from your business. PBKDF2An older password hashing method that repeats a hash many thousands of times. PCI DSSThe security standard for any business that handles payment card data. PCI DSS 11.4The card standard requirement to run internal and external penetration tests. Penetration testA time-boxed engagement where skilled people attack your systems by hand. Penetration test costWhat drives the price of a pentest: scope, depth, time and who does the work. Penetration test reportThe document that lists what was found, how, how bad it is and how to fix it. Penetration test scopeThe written list of what a pentest may and may not touch. Pentest as a servicePenetration testing bought as an ongoing subscription rather than a one-off project. PepperA secret added to every password hash and kept outside the database. Perfect forward secrecySession keys that are discarded, so old traffic stays safe if a key leaks later. Permissions-PolicyA header that turns off browser features like camera or location for your pages. PhishingPersuading someone to hand over credentials by posing as a trusted sender. PIIAny data that points at a specific human being. PKCEAn extra check that stops a stolen OAuth code from being swapped for a token. Pod security standardsBuilt-in Kubernetes levels that restrict risky settings in pods. Policy as codeWriting access rules as versioned, testable code instead of settings clicked by hand. Port scanningChecking which network doors on a server are open and listening. Post-incident reviewA blameless look back at an incident to improve the plan and the system. postMessage securityChecking who sent a message between windows before you act on its contents. Pre-commit hookA small check that runs on a developer's machine before code is committed. Predictable randomnessTokens or codes made from a generator an attacker can work out or guess. Price manipulationChanging a price, quantity or discount in a request so you pay less than you should. Private registryAn internal package store that keeps your private code off public indexes. Privilege creepPeople collecting more access over time than their current job needs. Privilege escalationGaining rights you were never given, sideways or upwards. Privileged access managementTight control and recording of accounts that hold powerful admin rights. Privileged containerA container given near-host powers, so a flaw inside it is a flaw in the host. Prompt injectionText that tricks an AI model into ignoring its instructions and doing something else. Proof of conceptThe smallest demonstration that a vulnerability is genuinely real. Proof of exploitEvidence that a flaw can be used to cause real impact, not just that it exists. Prototype pollutionChanging the base object every JavaScript object inherits from, through user input. PTESA standard outline of the phases of a penetration test. Public cloudComputing rented from a provider that shares its hardware across many customers. Public key cryptographyEncryption with a pair of keys: one shared openly, one kept private. Pull request security checkAutomatic security testing that runs on a code change before it is merged. Purple teamAttackers and defenders working together so each test improves detection.

Quantum-safe cryptographyEncryption designed to stay secure against future quantum computers.

Race conditionTwo near-simultaneous actions producing a result neither should allow. RAG securityControlling what a retrieval-based AI assistant can fetch and show to each person. Rainbow tableA precomputed list of hashes used to reverse unsalted passwords quickly. RansomwareMalware that locks your data and demands payment to unlock it. Rate limitingCapping how often something can be attempted, per user or per address. RBACPermissions attach to roles, and people are given roles. RBI cyber security frameworkReserve Bank of India rules for cyber resilience at banks and payment firms. Recovery point objectiveThe most data, measured in time, you can afford to lose. Recovery time objectiveThe longest outage you can accept before a system must be back. Red teamA simulated adversary given a goal and left to reach it however they can. Redirect chainingUsing a harmless redirect to make a phishing or token-theft link look trusted. ReDoSA pattern match that takes enormous time on crafted input and freezes the app. Referral fraudGaming a refer-a-friend reward with fake or self-made accounts. Referrer-PolicyA header controlling how much of your page address is sent to other sites. Reflected XSSA script in a link that your page echoes straight back into the response. Refresh tokenA long-lived token used to get new short-lived access tokens without signing in again. Refund abuseClaiming refunds or credits more often, or for more, than your policy permits. RegressionA bug that was fixed and has come back, usually undone by a later change. RemediationThe actual work of fixing a finding: the change, the review, the release. Remediation guidanceThe advice in a report on how to fix a finding, ideally down to the code. Remediation SLAThe agreed time within which a finding of each severity must be fixed. Remember meA long-lived login option, and the extra risk it carries if its token is stolen. Remote code executionGetting a server to run commands of an attacker's choosing. Remote file inclusionMaking an app load and run code from an address the attacker controls. Replay attackCapturing a valid request and sending it again to get the same result twice. Reproducible buildsBuilds that produce identical output every time, so tampering shows up. Reproduction stepsThe exact steps another person can follow to see a vulnerability for themselves. REST APIA common web API style where URLs name things and HTTP verbs act on them. RetestRunning the test again to confirm that a reported flaw has really been fixed. Retest reportA short report confirming which earlier findings are now closed and which remain. Risk acceptanceDeciding, on the record, to live with a known issue rather than fix it. Risk ratingA combined view of how likely a flaw is to be used and how much harm it would do. Risk registerA running list of risks, their owners, ratings and chosen responses. Risk-based prioritisationOrdering fixes by real-world risk, not just by the raw severity score. Role escalationChanging your own role, or another's, through a flaw in how roles are assigned. Root and jailbreak detectionAn app checking whether the phone has been unlocked in ways that weaken security. Root causeThe underlying mistake behind a flaw, which fixing prevents a whole class from returning. Root cause analysisWorking out why an incident happened, so the real cause is fixed. Rootless containerA container run as an ordinary user, limiting damage if it is broken into. Rounding abuseExploiting how amounts are rounded to gain tiny sums repeated many times. Row-level securityDatabase rules that limit which rows each account can read or change. Rules of engagementThe agreed limits, times and contacts that govern how a security test is run. Runtime securityWatching containers while they run for behaviour that should never happen.

S3 bucket exposureA cloud storage bucket left open so anyone on the internet can read its files. SaltRandom data added to each password before hashing so identical passwords differ. SAMA cyber security frameworkSaudi central bank rules for cyber security at financial institutions. Same-origin policyThe browser rule that stops one site's scripts reading another site's data. SameSite cookieA cookie setting that limits when a browser sends it on requests from other sites. SAMLAn older XML standard for single sign-on between a company and its apps. SAML signature wrappingMoving a signed SAML assertion so the app reads attacker-chosen content instead. SASTTools that read your source code without ever running it. SBOMA list of every component your application includes, with versions. SBOM requirementA customer or regulator asking you to supply an SBOM with your software. SCAChecking your libraries against databases of published vulnerabilities. SCIMA standard for creating and removing user accounts across systems automatically. ScrapingAutomatically copying large amounts of data from your site or API. scryptA password hashing function that needs a lot of memory, which slows cracking hardware. seccompA Linux feature that limits which system calls a container may make. Second-order injectionMalicious input stored safely at first, then run later when another part reads it. Secret scanningSearching code and history for keys, passwords and tokens that should not be there. Secrets managementKeeping keys, passwords and tokens out of code and in a vault. Secure by designChoosing safe defaults and structures from the start, not bolting protection on later. Secure code reviewReading code specifically to spot security flaws before they ship. Secure cookie flagA setting that makes the browser send a cookie only over HTTPS. Secure defaultsSettings that are safe out of the box, so no one has to remember to turn them on. Secure error handlingFailing safely and showing users nothing that helps an attacker. Secure SDLCBuilding security checks into every stage of how software is planned, built and shipped. Security championA developer in a team who takes on security questions and spreads good habits. Security debtThe pile of known weaknesses a team has put off fixing. Security findingOne confirmed weakness in a report, with the evidence to show it is real. Security gateA pipeline check that must pass before a build is allowed to move on. Security groupCloud firewall rules that decide which traffic may reach a server. Security headersResponse headers that switch on browser protections against common web attacks. Security incidentAn event that actually harms, or threatens to harm, your data or systems. Security operations centreA team and room that watch for and respond to threats around the clock. Security questionnaireThe list of questions a buyer's security team sends before they sign. Security regression testAn automated test that fails if a fixed vulnerability ever returns. Security requirementsWritten statements of what the software must do or prevent to be secure. Security test coverageHow much of your application a security test actually reached. Security ticketA tracked work item for fixing one finding, with owner, severity and deadline. Security vendor assessmentChecking a supplier's security before you trust them with your data. Self-XSSTricking a person into pasting attacker code into their own browser console. Separation of dutiesSplitting a sensitive task so no single person can complete it alone. Server-side authorisationEnforcing permissions on the server, because hiding a button in the page protects nothing. Server-side includes injectionInput that gets processed as a server-side include directive. Server-side template injectionUser input evaluated by your template engine, often leading to code execution. Serverless securitySecuring functions that run on demand, where you manage code but not servers. Service accountA non-human identity that software uses to sign in and call other systems. Service meshA layer that handles encryption and identity between services in a cluster. Session fixationAn attacker sets your session id before login, then waits for it to work. Session hijackingStealing the token that tells your application a browser is logged in. Session managementHow your app creates, tracks, renews and ends a signed-in visit. Session regenerationIssuing a new session id at sign-in so an old one cannot be reused. Session timeoutThe point at which an idle or old session stops working and sign-in is required again. Session tokenA random value the browser sends to show it belongs to a signed-in visit. SeverityHow bad a finding is, from critical down to informational. Severity vs confidenceHow bad a finding is, kept apart from how sure the tester is that it is real. Shadow APIAn API running in production that nobody has documented, tracked or secured. Shared responsibility modelThe split between what your cloud provider secures and what you must secure yourself. Shift leftDoing security work while code is written, not as a check at the end. SIEMA system that gathers logs from everywhere and raises alerts on suspicious patterns. SIM swapTaking over a phone number so text-message codes reach the attacker instead. Single sign-onOne company identity for many applications, granted and removed in one place. Sliding sessionA session whose expiry is pushed back each time the user is active. SLSAA framework of levels for how trustworthy a software build and its output are. SMS pumpingTriggering paid text messages in bulk so you pay while the attacker is paid. Snapshot exposureDisk or database backups shared or left public by mistake. SOAPAn older XML-based API standard still found in banking and enterprise systems. SOC 2An audit report on how well a service provider protects customer data. SOC 2 Type IIA SOC 2 report showing controls worked over a period, not on one day. Social engineeringManipulating people, not software, into giving up access or information. Social engineering testChecking whether people can be talked into handing over access or information. Software composition analysisInventorying your open-source parts and flagging the ones with known flaws. Software supply chain securityProtecting the code, tools and people that go into building your software. SPDXA standard format for listing software components and their licences. SPFA DNS record listing which servers may send email for your domain. SQL injectionInput a database ends up running as part of a query. SSO misconfigurationA single sign-on setup that trusts the wrong issuer or accepts the wrong audience. SSRFMaking your server fetch a URL of the attacker's choosing. SSRF in APIsAPI features that fetch a caller-supplied address, such as import by URL or webhooks. SSVCA decision tree that tells you whether to act on a vulnerability now or later. Staging environment exposureTest systems left open to the internet, often with real data and weak controls. State machine abuseMoving an order or account into a state the normal flow would never reach. Stateless sessionA session kept entirely in a signed token, with nothing stored on the server. Static analysis rulesThe patterns a code scanner uses to decide what counts as a flaw. Stored XSSMalicious script saved by your app and then served to other people who view it. STRIDEA checklist of six threat types used to find what could go wrong in a design. Subdomain takeoverClaiming an abandoned cloud resource that one of your DNS names still points to. Subresource integrityA hash check that stops a tampered third-party script or stylesheet from loading. Supply chain attackReaching you through a library, a build tool or a vendor you trust. Symmetric encryptionEncryption where the same secret key locks and unlocks the data. Synthetic identity fraudAccounts built from a mix of real and invented details to pass checks.

Tabletop exerciseA talk-through of an incident scenario to test the plan without touching systems. TabnabbingA link you opened silently changes the page that opened it, to a fake sign-in. Tenant data leakOne customer seeing records that belong to another customer of your service. Tenant isolationWhat keeps one customer's data unreachable from another's session. Terraform misconfigurationAn insecure setting written into infrastructure code and then deployed at scale. Test environmentA copy of your app used for security testing so production is not at risk. Testing in productionRunning security tests against the live app, with controls to avoid harm. Third-party script riskCode from outside vendors running on your pages with the same powers as yours. Threat actorWhoever might attack you, described by capability and motive. Threat huntingSearching your systems for attackers that alerts have not yet caught. Threat modelAsking what is worth taking, who wants it, and how they would try. Ticket scalpingBots buying scarce items or tickets in bulk to resell them. Time of check to time of useA gap between checking a condition and acting on it that an attacker can use. Timing attackLearning a secret by measuring how long your application takes to answer. TLSThe protocol that encrypts traffic between a browser and a server. TokenA string that stands in for an identity or a permission. Token replayReusing a stolen or captured token to be accepted as its rightful owner. Token revocationCancelling a token before it expires, for example after a password change. TokenisationReplacing sensitive data with a harmless stand-in kept apart from the real value. TOTPThe six-digit code from an authenticator app, changing every thirty seconds. Training data poisoningTainting the data a model learns from so it behaves wrongly later. Transitive dependencyA library pulled in by another library you chose, which you still ship. Trial abuseSigning up again and again to keep free access without ever paying. Trusted TypesA browser feature that blocks unsafe strings from being written into the page. TyposquattingPublishing a package with a near-identical name, hoping a developer installs it by mistake.

UAE IA standardThe UAE's information assurance standard for organisations in the country. Unauthenticated accessAnything your application answers without signing in at all. Unguessable idsUsing long random ids instead of counters, which hides records but does not protect them. Unicode normalisation attackCharacters that look different but compare equal after conversion, slipping past filters. Unrestricted resource consumptionAPI calls that can use unlimited CPU, memory, money or third-party credits. Unsafe consumption of APIsTrusting data from a partner's API without checking it like any other input. Untrusted inputAnything that arrived from outside your own code, and is therefore suspect.

Vendor risk managementJudging and monitoring the security of the suppliers your business relies on. Vertical privilege escalationClimbing to a higher level of access than your account was granted. VEXA statement that says whether a known flaw in a component can actually affect your product. Virtual patchingBlocking an exploit with a filter while the real fix is still being built. Virtual private cloudA private, isolated network space inside a public cloud account. VPNAn encrypted tunnel that links a device or office network to another network. VulnerabilityA weakness that somebody could use to cause harm. Vulnerability ageingHow long known findings have sat open, as a measure of fix speed. Vulnerability backlogThe growing list of known flaws a team has yet to fix. Vulnerability coordinationThe process of reporting a flaw to a vendor and agreeing when to publish. Vulnerability disclosureTelling an organisation about a flaw, and the policy that makes it safe. Vulnerability managementThe loop of finding, prioritising, fixing and checking the fix held. Vulnerability scanningAutomated checks that look for known weaknesses without proving they can be used.

WAFA filter in front of your application that blocks known bad requests. Web application penetration testingA pentest focused on a web app, its APIs and the logic behind them. Web storage securityThe risk of keeping tokens in localStorage, where any script on the page can read them. WebAuthnThe browser standard behind passkeys and hardware security keys. WebhookA URL you hand to another service so it can call you when something happens. Webhook signatureA check that an incoming webhook really came from the service it claims. WebSocket securityKeeping long-lived, two-way connections from becoming an unchecked back door. White-box testingTesting with access to the source code, not just the running application. White-label pentestingSecurity testing delivered to your clients under your own brand. Wildcard injectionFilenames with special characters that change what a command does to them. Workflow bypassSkipping a required step, such as payment or approval, by calling a later one directly.

X-Content-Type-OptionsA header that stops browsers guessing a file's type and running it as a script. X-Frame-OptionsA header that stops other sites from placing your page inside a frame. XPath injectionInput that changes an XPath query run against XML data. XSSAn attacker's script running in your pages, in your customers' sessions. XXEAn XML parser tricked into fetching files or internal addresses.

Zero dayA vulnerability exploited before any fix exists. Zero trustAssuming the network proves nothing, and checking every request. Zip slipAn archive entry with a crafted path that writes files outside the target folder. Zombie APIAn old API version that should be retired but still answers requests.