Glossary

Cybersecurity terms, in plain English

Allowlisting: Permitting only approved software to run; everything else is blocked by default.; Learn the topic See comparison
Application control: Policies that decide which programs, scripts, and libraries may execute.; Learn the topic See comparison
Audit mode: A setting where a security tool logs what it would block without actually blocking, used before enforcement.; Learn the topic
Default-deny: A policy where anything not explicitly allowed is refused.; Learn the topic
EDR: Endpoint Detection and Response: tools that record endpoint activity, detect threats, and support investigation and response.; Learn the topic See comparison
EPP: Endpoint Protection Platform: prevention-focused protection such as antivirus.; Learn the topic
Hash rule: An allowlisting rule that trusts one exact file, identified by its cryptographic hash.; Learn the topic
Lateral movement: An attacker moving from one compromised system to others within an environment.; Learn the topic
Least privilege: Giving users and systems only the access they need, nothing more.; Learn the topic See comparison
Living off the land: Attacks that abuse legitimate built-in tools (like PowerShell) instead of bringing new malware.; Learn the topic
MDR: Managed Detection and Response: a service where a provider monitors and responds to threats for you.; Learn the topic
MFA: Multi-factor authentication: proving identity with two or more factors, such as a password plus a security key.; Learn the topic
MSP: Managed Service Provider: an outside company that manages IT systems for a client.; Learn the topic
MSSP: Managed Security Service Provider: an outside company focused on security monitoring and management.; Learn the topic
Privilege elevation: Temporarily granting higher rights to run a specific approved task.; Learn the topic
Publisher rule: An allowlisting rule that trusts software signed by a specific vendor's code-signing certificate.; Learn the topic
Ransomware: Malware that encrypts or steals data and demands payment.; Learn the topic
Ringfencing: A vendor term (used by ThreatLocker and others) for restricting what an allowed application can access, such as files, the network, or other apps.; Learn the topic
SSO: Single sign-on: one login that grants access to many applications.; Learn the topic
XDR: Extended Detection and Response: correlates detections across endpoints and other sources like email and identity.; Learn the topic
Zero Trust: A model that verifies every access request explicitly rather than trusting network location.; Learn the topic See comparison
ZTNA: Zero Trust Network Access: grants users access to specific applications instead of a whole network.; Learn the topic See comparison