The SOC Analyst
Glossary

User behavior analytics (UBA) is the practice of learning what normal activity looks like for each user in an environment, then flagging the activity that does not fit.

A Virtual Private Network (VPN) is a security technology that creates a secure, encrypted connection between a user’s device and a private network over the public internet. It ensures that data transmitted between endpoints remains confidential, protected from interception, and accessible only to authorized users.

Vishing, short for voice phishing, is a social engineering attack that uses phone calls or voice messages to trick a target into giving up credentials, money, or system access.

Vulnerability assessment is the systematic process of finding, classifying, and ranking known security weaknesses across an organization's systems, applications, and networks.

Vulnerability management is the continuous, organization-wide practice of discovering security weaknesses, assessing the risk each one carries, prioritizing them against finite resources, fixing or mitigating them, and verifying the fix held.

A vulnerability management platform (VMP) is the system of record that runs the vulnerability management lifecycle: it ingests findings from many scanners, correlates them against an asset inventory, prioritizes by real-world risk, routes remediation, and verifies closure.

Vulnerability scanning is the automated discovery of known weaknesses across your assets, scored and prioritized so a defender knows what to fix first.

A web application firewall (WAF) is a security control that inspects HTTP and HTTPS traffic at the application layer and blocks malicious web requests such as SQL injection and cross-site scripting before they reach the application.

A web shell is a malicious script uploaded to a web server that lets an attacker run commands on it remotely over HTTP, functioning as a persistent backdoor into the network.

Whaling is a highly targeted form of phishing in which an attacker impersonates or targets a senior executive to authorize a high-value action, usually a wire transfer, a sensitive data release, or a change to a payment account.

A white hat hacker is a security professional who attacks systems with the owner's permission to find weaknesses before a malicious attacker can exploit them.

Wireless security is the set of protocols, controls, and monitoring that protect a wireless network and the data traveling across it from unauthorized access, interception, and disruption.

XTAM (eXtended Threat and Asset Management) unifies continuous asset discovery with threat, exposure, and business context, so teams prioritize remediation by the real risk each asset carries.

A zero-day exploit is the code or technique an attacker uses to abuse a software flaw the vendor does not yet know about or has not yet patched.

Zero trust architecture is the way network components and services are structured to enforce a zero trust security model, defined by NIST SP 800-207.

Zero trust security is a model that removes implicit trust based on network location and verifies every access request against identity, device, and policy.