Tech Glossary — Page 3

Routing traffic through two VPN servers for an extra layer of encryption.

VMware's bare-metal hypervisor, installed directly on server hardware to run virtual machines. Each ESXi host is administered through vCenter, and its management interface controls the host's accounts, storage, and the workloads it runs, which makes that interface high-value attack surface.

A network appliance that sits on the boundary between the internet and an internal network, such as a VPN gateway, firewall, or secure-access appliance. Edge devices are internet-facing, hold credentials, and broker connections inward, which makes them high-value and frequently repeated targets for zero-day exploitation.

Serverless code, such as a Cloudflare Worker, that runs on a CDN's edge network in front of the origin server and can inspect or rewrite requests and responses in flight. Because the origin is never modified, a malicious edge worker is invisible to origin-side integrity checks.

Restricting the outbound connections a system may make to an explicit list of required destinations, enforced at the network layer or through an egress proxy. It breaks payload downloads, mining-pool connections and callback channels, and turns an attacker's success signal into a detection event.

The process of converting data into a coded format that can only be read with the correct decryption key.

Software that its vendor no longer supports with security updates. Vulnerabilities discovered after the end-of-life date are never patched, so running EOL software is a permanent and growing exposure.

Encryption where only the sender and recipient can read the message—not even the service provider.

A Microsoft synchronization protocol that enables mobile devices to access email, calendar, contacts, and tasks from an Exchange server over HTTPS.

Microsoft's cloud-based email and calendaring service, part of Microsoft 365, that hosts mailboxes in Microsoft's data centers.

A PowerShell security feature that determines the conditions under which PowerShell loads configuration files and runs scripts, ranging from Restricted (no scripts) to Bypass (no restrictions).

Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access.

Two or more vulnerabilities used in sequence so that each one supplies the access the next one requires, for example an unauthenticated SSRF that reaches a command injection which alone would need administrator credentials. Chains let attackers turn moderate individual flaws into unauthenticated remote code execution.

A Windows security feature that binds an authentication token to the TLS channel it was issued on, so a token replayed on a different channel is rejected. It is the primary defense against NTLM relay.

A design flaw in which a control that cannot complete its check grants access instead of denying it. In authentication, a missing key or failed lookup that results in access being allowed turns a security check into a rubber stamp.

Security system that monitors and controls network traffic based on predetermined rules.

Permanent software programmed into a device's hardware that controls its basic functions.

A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs.

Fortinet's cloud-based management and services platform that provides centralized management, logging, reporting, and single sign-on capabilities for Fortinet security products.

Restricting access to content based on the user's geographic location.

A script that Git executes automatically when a repository event occurs, such as a push, commit, or index write. Hooks are plain executable files in the repository's hooks directory and run with the privileges of the user running Git, which makes them a code-execution primitive on hosting servers.

An attack in which an adversary who has obtained the signing key or credentials of an identity provider forges valid SAML authentication tokens for any user, including administrators. Because the tokens are correctly signed, downstream services trust them without a further password check.

A high-performance runtime that can execute JavaScript, Python and other languages inside a Java process through a polyglot context. That context can grant guest scripts access to host Java classes, so its security depends entirely on how strictly host access is configured.

A construction that combines a secret key with a message and a hash function to produce a code that verifies both the integrity and authenticity of the message. It underpins signed URLs, API request signing, and session token validation.

A memory-corruption bug where a program writes more data into a heap allocation than it was sized to hold, spilling into adjacent memory. When the overwritten neighbor is the allocator's own bookkeeping, an attacker can steer it toward code execution.

A decoy system deployed to be attacked so defenders can observe exploitation attempts safely. Honeypot networks give early warning that a vulnerability has moved from theoretical to actively exploited, often before official catalogs like CISA KEV confirm it.

A web application such as cPanel & WHM, Plesk, or DirectAdmin that manages a hosting server's accounts, websites, mail, and databases. It runs with root privileges and loads third-party plugins, so a flaw in the panel or a plugin can expose every customer on the server.

An out-of-cycle software update that addresses a specific urgent defect, usually a security flaw, on an existing release line without waiting for the next scheduled version. Hotfixes are typically numbered and cumulative on that line, but each covers only the issues named in its notes, so a later one may be required.

Software that creates and manages virtual machines by allocating physical hardware resources among multiple guest operating systems. VMware ESXi is a Type 1 (bare-metal) hypervisor.

The protocol IPsec uses to negotiate cryptographic parameters, exchange keys, and authenticate peers before a tunnel is established. It listens on UDP/500, and on UDP/4500 when NAT traversal is used, which makes it internet-facing on most VPN gateways.

A unique numerical identifier assigned to every device connected to the internet.

A network access control that permits connections to a service only from an explicit list of approved source addresses or subnets, denying everything else. Applied at the edge, on the host, or both.

A security system that monitors network traffic for malicious activity and can automatically block or prevent detected threats in real-time.

A suite of protocols that authenticates and encrypts IP traffic at the network layer, used for site-to-site tunnels between gateways and for many remote-access VPNs. IKE handles the negotiation; ESP carries the protected packets.

Services that continuously watch for signs that your personal information is being misused, including monitoring credit reports, dark web activity, and public records.

A Microsoft Entra ID Premium feature that uses machine learning to detect risky sign-ins and user behaviors, automatically enforcing remediation like MFA challenges or password resets.

A system that creates, maintains, and manages identity information for users while providing authentication services to relying party applications through protocols like SAML or OAuth.

An attack technique where adversaries register malicious OAuth applications that request excessive permissions, then trick users into authorizing them.

A backup written so that it cannot be modified or deleted for a defined retention period, even by an administrator. Immutability protects recovery data from ransomware and from insiders who hold privileged credentials, since the copy survives even if the live environment is fully compromised.

A security fix that blocks the reported exploit path without correcting the underlying weakness, leaving an alternative route to the same bug. The follow-up is often assigned its own CVE; N-central's CVE-2026-18577 was formally described as the result of an incomplete patch for CVE-2026-18556.