Security glossary
These are 40 terms that show up in proposals and meetings all the time and still trip people up when they have to explain them. We wrote them the way you'd explain them to a colleague at the next desk. Where a standard or an agency has published a definition, we followed it.
Quick index
Acronyms and names
Other terms
Attacks and threats
The words you run into first when reading incident reports and threat reports.
Ransomware
Malware that encrypts files and demands payment to unlock them. Many groups also steal the data before encrypting it and threaten to publish it if you don't pay. In that case, having backups doesn't end the extortion. In real incidents, encryption is the last step. Before that, the attackers go looking for backup servers and domain admin accounts.
Why ransomware groups go after backup servers firstSupply Chain Attack
Instead of breaking into the target directly, the attacker first compromises software or a vendor the target trusts. Pushing a malicious build to an update server, slipping malicious code into npm or PyPI packages, and coming in through a maintenance vendor's account all fall under this. Because a legitimate program arrives through a legitimate channel, signature checks and reputation-based blocking often miss it.
Supply chain attacks that come in through MCP serversSpear Phishing
Phishing aimed at a chosen person or department, as opposed to mass phishing sent to anyone. The document title and sender are tailored to the recipient's job, business partners or interests, so it's hard to be suspicious. ATT&CK splits it into Spearphishing Attachment (T1566.001), Spearphishing Link (T1566.002) and Spearphishing via Service, such as messaging apps (T1566.003).
Related service: Security training and phishing drillsZero-day
A vulnerability exploited while the vendor either doesn't know about it or hasn't shipped a patch. With no patch available, your options are to turn off the vulnerable feature, reduce exposure, or catch the behavior that follows exploitation. Keep in mind that even after a patch ships, the risk is effectively the same until you apply it.
Lateral Movement
The stage where the attacker moves from the first PC or server they landed on to other systems inside the network. They use the same tools admins use every day, such as Remote Desktop, SMB admin shares, WinRM and PsExec, so it's hard to tell apart from normal administration. You need context: who connected, from which PC, to a server they don't normally touch.
See the ATT&CK coverage mapPrivilege Escalation
How an attacker who got in with normal user rights gains administrator, SYSTEM or root privileges. Common paths are unpatched kernel vulnerabilities, misconfigured service permissions, UAC bypass, and stealing another admin's credentials. If every PC uses the same local admin password, one compromised machine opens up the rest.
TTP (Tactics, Techniques, and Procedures)
A shorthand for what the attacker is after (tactics), the method they use (techniques), and exactly how they carry it out (procedures). Attackers change IPs and hashes quickly, but the way they work changes slowly, so detection rules meant to last are built around TTPs. MITRE ATT&CK is the best-known knowledge base that catalogs them.
TTPs of threat groups targeting KoreaIoC (Indicator of Compromise)
A specific value you can use as a sign that a compromise happened: a malicious file hash, a C2 server IP or domain, a particular registry key. They're handy because you can search for them right away, but they don't stay useful for long. David Bianco's Pyramid of Pain shows the difference well: hashes are easy for an attacker to change, TTPs are hard.
Related service: Threat intelligenceDetection and operations
The product names here sound alike, which makes this the most confusing group when you're comparing quotes.
SOC (Security Operations Center)
The team, and the way it operates, that watches security alerts, makes the call, and directs the response. Some companies run it in house and some hand it to an outside monitoring provider. Running 24/7 takes enough people for shifts, so a common split is to cover business hours internally and outsource nights and weekends.
Related service: AI security monitoring and MDRSIEM (Security Information and Event Management)
A system that collects logs from firewalls, servers, EDR, cloud and other sources in one place, lets you search them, and raises alerts through correlation rules. Running it is harder than buying it. Cost grows with log volume, and if nobody keeps tuning the rules, the alerts just pile up.
Related engine: Threat CorrelatorSOAR (Security Orchestration, Automation and Response)
A tool that turns the repetitive work people do on each alert into automated playbooks. When someone reports a phishing email, for example, it checks URL reputation, finds everyone else who received the same message, and deletes it from all mailboxes, in that order. If a playbook drifts out of step with the real environment, automation can make an incident worse, so high-impact actions get an approval step.
EDR (Endpoint Detection and Response)
An agent installed on PCs and servers that records activity such as process execution, file changes and network connections, and detects or blocks suspicious behavior. Antivirus asks "is this a known malicious file?" EDR asks "is what this process is doing right now unusual?" During an investigation, the process tree EDR recorded is usually the first thing people pull up.
Related engine: Behavioral AnalyzerXDR (Extended Detection and Response)
A product category that pulls in data from email, network, cloud and identity systems on top of endpoints, and ties it together into a single incident. Every vendor defines it a little differently. When you compare quotes, ask which data sources come in out of the box and whether it accepts logs from other vendors' products.
Related engine: Threat CorrelatorMDR (Managed Detection and Response)
A service where outside specialists run the detection tools, analyze alerts and handle the initial response. It overlaps a lot with traditional managed monitoring. The usual difference is whether the provider stops at forwarding the alert or goes on to isolate hosts and lock accounts. Put the scope of their response authority in writing before you sign.
Related service: AI security monitoring and MDRUEBA (User and Entity Behavior Analytics)
An analysis method that sets a baseline for how users, servers and accounts normally behave and looks for activity that departs from it. Think of a finance account that only ever logs in during the morning suddenly connecting to a dev server at 3 a.m., or one person downloading more than ten times their usual number of files. The baseline takes a few weeks to build, and alerts go up whenever work patterns shift, such as during a reorganization or at fiscal close.
Related engine: Behavioral AnalyzerSandbox
An isolated virtual environment where a suspicious file is actually opened so you can watch what it does. A common setup runs email attachments there before they reach the user. Attackers know this, so their malware may do nothing when it detects a virtual environment, or wait several minutes before running.
False Positive
An alert that flags normal activity as an attack. Each one looks minor, but as they pile up analysts start skimming past alerts, and real attacks get buried in the noise. Turning rules off to cut false positives raises false negatives, so you have to tune the two together.
How Genox measures false positives and false negativesFalse Negative
A real attack that went by undetected. The trouble is that you don't know what you missed, so it often comes to light later through an incident investigation or an outside notification. That's why you need validation that actually runs real attack techniques.
Related service: Proactive security validationThreat Hunting
Digging through logs yourself, starting from the assumption that an attacker may already be inside, instead of waiting for an alert. You form a hypothesis such as "has this technique used by a recently disclosed group ever run in our environment?" and check it against EDR and SIEM data. Patterns you find while hunting should be turned into detection rules, so nobody has to find them by hand next time.
Related service: Threat intelligenceValidation and red teaming
Ways to check whether your defenses actually stop an attack.
The names sound similar, but each one tells you something different.
Red Team
A team or exercise that behaves like a real attacker to see whether it can reach a set objective, for example access to the customer database or control of the payment system. The output is a timeline of the path to the objective and of when the defenders noticed along the way. Usually only a few people on the defending side know about it in advance.
Related service: Proactive security validation, red team and blue teamBlue Team
The defending side: SOC analysts, incident responders, and the engineers who write detection rules. In a red team exercise, the blue team is often judged less on whether it blocked the attack and more on how quickly it noticed and worked out the scope.
Related service: Proactive security validation, red team and blue teamPurple Team
The red team and blue team working side by side. The red team runs a technique, the blue team checks the logs and alerts right away, and if nothing fired, they fix the rule on the spot and run it again. It has less tension than a covert red team exercise, and it closes detection gaps much faster.
See the ATT&CK coverage mapPenetration Testing
Testing a defined set of systems or services from an attacker's point of view to find vulnerabilities that can be exploited. It's often done before a web service launches or while preparing for a certification audit, and the results come back as a list of vulnerabilities with reproduction steps and remediation advice. Because the scope is fixed, whether your detection and response actually work has to be checked separately.
Related service: Penetration testing and vulnerability assessmentBAS (Breach and Attack Simulation)
A tool that runs known attack techniques automatically and often, to check whether your security controls block or detect them. A human red team might run once or twice a year, while BAS can run every week, which makes it a good fit for regression checks after you change a control's policy. It won't find attack paths that aren't in its scenarios.
Compare validation methodsMITRE ATT&CK
A public knowledge base of attacker tactics and techniques that MITRE, a US nonprofit, builds from real-world attacks. Each tactic, from Initial Access (TA0001) to Impact (TA0040), has techniques under it with IDs such as T1566, and it also records which techniques each attack group has used. Teams use it as a common language when describing detection coverage or planning red team scenarios.
Threat groups targeting Korea, mapped to ATT&CKVulnerability management
The IDs and scores you look at together when setting patch priorities.
Each one answers a different question, so relying on just one leads to bad calls.
CVE (Common Vulnerabilities and Exposures)
A unique ID assigned to each publicly disclosed vulnerability. It's made of a year and a sequence number, as in CVE-2021-44228, and is assigned by a CVE Numbering Authority (CNA) authorized by the CVE Program. The ID is only a name that points to the vulnerability. Severity is rated separately.
Related engine: Vulnerability ScannerCVSS (Common Vulnerability Scoring System)
A system maintained by FIRST that expresses a vulnerability's severity as a score from 0.0 to 10.0. A score of 9.0 or higher is Critical, and 7.0 to 8.9 is High. The base score only reflects the properties of the vulnerability itself, so whether it's exposed to the internet in your environment, or being exploited in the wild, has to be weighed separately. Version 4.0 was released in November 2023.
Related engine: Vulnerability ScannerEPSS (Exploit Prediction Scoring System)
A model that estimates the probability, as a value between 0 and 1, that a given CVE will be exploited in the wild in the next 30 days. Like CVSS, it's run by FIRST, and scores are updated daily. Putting severity (CVSS) next to likelihood of exploitation (EPSS) makes it much easier to decide what to patch first.
KEV (Known Exploited Vulnerabilities)
A catalog published by the US Cybersecurity and Infrastructure Security Agency (CISA) that lists only vulnerabilities confirmed to have been exploited. Under Binding Operational Directive 22-01 (BOD 22-01), US federal civilian agencies must remediate listed vulnerabilities by set deadlines. Companies in Korea have no such obligation, but it works well as the first filter for patch priority.
SBOM (Software Bill of Materials)
A list of the open-source components and libraries in a piece of software, with their versions. You build one so that when a new vulnerability drops, you can answer "which of our products include this library?" right away. SPDX and CycloneDX are the common formats, and an SBOM is only really useful if it's generated automatically on every build.
Two cases where a single npm install compromised a developer's PCAI security
Terms that came along once companies started wiring LLMs and AI agents into their work.
Prompt Injection
An attack that sneaks instructions into the input an LLM reads so it behaves differently than intended. Sometimes the user types them in directly. The harder case is indirect injection, hidden inside a web page, email or document that the AI is summarizing. It's listed first, as LLM01, in the OWASP Top 10 for LLM Applications 2025.
How Korean-language prompt injection slips past filtersJailbreak
A technique for getting around a model's safety policy to get answers it should refuse. Common approaches are role-play, splitting the question into small pieces, or asking again in another language or encoding. It overlaps a lot with prompt injection. A handy way to separate them: a jailbreak targets the model's safety policy, while injection targets the instructions the application gave the model.
Related service: AI/LLM red team assessmentRAG (Retrieval-Augmented Generation)
An architecture where, when a question comes in, relevant content is first retrieved from internal documents or databases and passed to the LLM along with the question. It's popular because the model can use current internal knowledge without retraining. On the security side, the usual checks are documents the user isn't authorized to see showing up in answers, and injections hidden in retrieved documents.
Related page: AI securityMCP (Model Context Protocol)
An open protocol, released by Anthropic in November 2024, that standardizes how AI applications connect to external tools and data. Add one MCP server and the AI can call the file system, Git repositories or internal APIs directly. That convenience cuts both ways: a vulnerability in the server code or an instruction hidden in a tool description can turn straight into AI behavior, so review servers before you install them.
Remediation guidance for a Git MCP server vulnerabilityAI Agent
A system where an LLM takes a goal, breaks it into steps on its own, calls tools, and decides the next action based on the results. A chatbot hands back text. An agent takes real actions, such as sending email, opening tickets or locking accounts. So the first job when adopting one is deciding which actions it may take on its own and which need human approval.
Which calls to keep in human hands when bringing AI agents into the SOCGuardrail
A catch-all term for controls that inspect an LLM's input and output and filter out requests or answers that break policy. Examples include blocking answers that contain personal information, refusing prohibited topics, and validating parameters before a tool call. Guardrails built with English in mind can be weak against Korean-language workarounds, so test them in the language your service actually uses.
Related page: AI securityRegulation and frameworks
Terms that come up in every Korean public sector and financial sector project and in certification audits. If you're a foreign company operating in Korea, expect to see them in RFPs and audit checklists. Detailed requirements are revised often, so check the official notices and guides as well.
Zero Trust
A security principle that says being on the internal network is no reason to be trusted. Every access request is checked against the user, the device and the context, and only what's needed is allowed. NIST SP 800-207 is the best-known defining document, and in Korea the Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) have published guidelines. Switching all at once is hard, so organizations usually move in stages, starting with identity and access control.
Related service: Zero trust securityNetwork Separation (망분리)
Splitting the internal business network from the internet network, either physically or logically through means such as virtualization, so outside attacks can't reach internal business systems. It has long been a baseline requirement in Korean regulations for public institutions and the financial sector. The catch is that it makes external services like cloud and generative AI hard to use, so the public sector is moving toward approaches like N2SF that vary controls by data classification.
Related service: Security consulting and complianceISMS-P (Personal Information & Information Security Management System, 정보보호 및 개인정보보호 관리체계 인증)
A Korean certification run by KISA that adds requirements for each stage of personal information processing on top of the Information Security Management System (ISMS) certification. Under the Act on Promotion of Information and Communications Network Utilization and Information Protection (the Network Act), businesses above a certain size must hold ISMS certification. ISMS-P is the option when you also want personal information covered. Auditors focus on evidence of actual operation more than on documents, so a policy that exists on paper with no records behind it gets written up as a finding.
Related service: Security consulting and complianceN2SF (National Network Security Framework, 국가망 보안체계)
A public sector security framework set up by Korea's National Intelligence Service (NIS). It classifies work information and systems as Classified (C), Sensitive (S) or Open (O) and applies security controls that match each level. The idea is to replace blanket network separation and open a path for using cloud services and generative AI for Open-level work. Guideline 1.0 was published in September 2025, and how each agency applies it is decided together with the NIS security review.
Related service: Security consulting and complianceCan't find the term you need?
Send us a note and we'll add it in the next update. We can also help you figure out which validation or monitoring approach fits your environment.
References
Definitions and figures follow the sources below.
Checked on 2026-11-07.
- MITRE ATT&CK, MITRE
- CVE Program, CVE.org
- Common Vulnerability Scoring System v4.0, FIRST
- Exploit Prediction Scoring System (EPSS), FIRST
- Known Exploited Vulnerabilities Catalog, CISA
- BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, CISA
- The Minimum Elements For a Software Bill of Materials (SBOM), NTIA, 2021
- NIST SP 800-207 Zero Trust Architecture, NIST, 2020
- OWASP Top 10 for LLM Applications, OWASP
- Model Context Protocol, official documentation
- ISMS-P certification, Korea Internet & Security Agency (KISA), in Korean