The SOC Analyst
Glossary

MDR vs MSSP is the choice between a service that actively detects and responds to threats for you and one that monitors your security tools and forwards validated alerts for your team to act on.

MDR is an outsourced service where a provider delivers continuous detection and active response, while a SOC is the in-house team and function that owns monitoring, detection, and response across the organization.

Mean time to repair (MTTR) is the average time it takes to restore a system to working order after a failure or security incident, calculated by dividing total repair time by the number of incidents.

Microservices architecture is a way of building an application as a collection of small, independent, loosely coupled services that each own one piece of business capability and communicate with the others over lightweight network protocols.

Microservices security is the practice of protecting an application built as many small, independent, loosely coupled services that communicate over the network, covering the APIs, the service-to-service trust, the traffic on the wire, the containers, and the pipeline that ships them.

MITRE ATLAS is a public, ATT&CK-style knowledge base of the tactics, techniques, and real-world case studies that adversaries use against AI and machine-learning systems.

MITRE ATT&CK is a free, public knowledge base of adversary tactics and techniques based on real-world observations, used by defenders to map detections, hunt threats, and describe attacker behavior in a shared language.

Mobile application security testing is the practice of evaluating an iOS or Android application's security across its full attack surface (the compiled app, the data it stores on the device, the traffic to its backend, and the platform it runs on) to find mobile-specific flaws before and after release.

Mobile malware is malicious software designed to target mobile devices, primarily smartphones and tablets, to steal data, commit fraud, spy on the user, or take control of the device.

Mobile threat defense (MTD) is security software that detects, analyzes, and responds to threats targeting mobile devices in real time, covering the device, network, application, and phishing layers that device-management tools do not inspect.

The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in November 2024, that defines a uniform way for AI applications to connect to external tools and data sources.

A Managed Service Provider (MSP) operates and maintains IT infrastructure to keep it running, while a Managed Security Service Provider (MSSP) defends that infrastructure by detecting and responding to threats from a 24/7 SOC.

Multi-cloud is the use of two or more public cloud providers (such as AWS, Microsoft Azure, and Google Cloud) at the same time to run applications and store data.

Multi-cloud management is the practice of running, governing, and accounting for workloads that span two or more public cloud providers from a single operational layer, covering provisioning, policy, spend, and telemetry.

Multi-cloud security is the practice of protecting data, applications, and infrastructure spread across two or more public cloud providers at once, imposing consistent identity, configuration, and monitoring controls over environments that each define security differently.

Multi-cloud vulnerability management is the continuous practice of finding, ranking, and fixing security weaknesses consistently across every cloud provider you run (AWS, Azure, Google Cloud), instead of treating each console as its own island.

Multi-factor authentication is an access control method that requires two or more authentication factors, each from a different category (something you know, have, or are), before granting access.

Network access control is the set of policies and technology that authenticates devices and users at the point of connection, then decides which network segment they may reach.

Network detection and response (NDR) is a category of security tooling that uses the network as its sensor: ingesting traffic, modeling normal communication, detecting malicious or anomalous activity, and supporting investigation and response.

Network security is the set of controls, policies, and monitoring that protect the confidentiality, integrity, and availability of data as it moves across a network and the systems connected to it.

Network segmentation is the practice of dividing a computer network into smaller, isolated subnetworks and controlling the traffic allowed between them.

Network traffic analysis (NTA) is the practice of capturing and examining the traffic moving across a network (the packets, flows, and sessions) to detect threats, investigate incidents, and understand what is actually happening on the network.

Next-generation antivirus (NGAV) is a prevention control that uses machine learning, behavioral analysis, and exploit mitigation to block malware at the moment of execution, including threats that have no known signature.

The NIST Cybersecurity Framework (CSF) is a voluntary, free set of NIST guidelines that organizes cybersecurity risk management into six functions (Govern, Identify, Protect, Detect, Respond, Recover) and helps an organization assess, prioritize, and communicate its security posture.

NTLM and Kerberos are the two authentication protocols Windows uses to verify identities on a network. Kerberos is the modern default, built on time-limited tickets issued by the domain controller, while NTLM is a legacy challenge-response protocol that Microsoft has deprecated because it enables pass-the-hash and relay attacks.

Observability is the ability to understand a system's internal state from its external outputs (its metrics, logs, and traces), well enough to answer questions you did not anticipate when you built it.

Open-source intelligence (OSINT) is the practice of gathering information from publicly available sources and analyzing it to produce something useful, relying only on data obtained legally from places open to the public.

Open source software security is the practice of identifying, assessing, and managing the risk introduced by open source components in an application and its build pipeline, from inventory to patching.

OT security is the protection of the systems that monitor and control physical processes (controllers, sensors, and actuators behind factories, grids, water, and pipelines), prioritizing safety and availability over confidentiality.

In-house cybersecurity is run by your own employees for full control and business context, while outsourced cybersecurity (MSSP or MDR) contracts a provider for 24/7 coverage and instant expertise on a predictable subscription.

Patch management is the process of identifying, acquiring, testing, and deploying software and firmware updates across an environment, then verifying they installed, to close known vulnerabilities before attackers exploit them.

Penetration testing is an authorized simulated cyberattack run by a security professional to find and exploit weaknesses, proving which are exploitable before a real attacker does.

Persistence is how an attacker maintains a foothold in a system or network so that their access survives interruptions such as a reboot, a logged-off session, a password reset, or even the removal of their original malware.

Phishing is a form of social engineering in which an attacker sends a fraudulent message designed to trick a person into revealing sensitive information, handing over credentials, running malware, or transferring money.

Platform as a Service (PaaS) is a cloud computing model in which a third-party provider delivers a complete, managed application platform on demand over the internet, billed by consumption.

Privileged access management (PAM) is the set of cybersecurity strategies and technologies for controlling, monitoring, securing, and auditing privileged identities and their access across an environment.

Privileged account management is the practice of identifying, securing, and governing the accounts in an environment that hold elevated permissions (administrator, root, and service accounts) across their full lifecycle.

A privileged threat scan (PTS) is a proactive assessment that inventories every privileged account and credential, then grades each by how exposed it is to abuse.

Privilege escalation is the act of exploiting a flaw, misconfiguration, or stolen credential to obtain permissions beyond what an account is supposed to have.

Public cloud security is the set of controls, policies, and practices that protect data, applications, and workloads running on shared, multi-tenant infrastructure owned and operated by a third-party provider such as AWS, Microsoft Azure, or Google Cloud.

The quantum computing threat is the risk that a sufficiently powerful quantum computer breaks the public-key cryptography (RSA, Diffie-Hellman, elliptic-curve) that secures internet traffic, stored secrets, and digital signatures.

Ransomware is a type of malware that encrypts files or locks systems on a victim's device, making data inaccessible until the attacker receives a ransom payment, typically in cryptocurrency. It is one of the most damaging and widespread cyber threats facing organizations today, targeting businesses, government agencies, healthcare institutions, and critical infrastructure alike.

Ransomware as a service (RaaS) is a business model in which a core group develops ransomware and rents it to affiliates, who carry out the attacks and share the proceeds with the developers.

Ransomware detection is the set of techniques that identify ransomware activity before encryption, and ransomware response is the coordinated process of containing the attack, removing the threat, and restoring operations.

Ransomware prevention is layered control placed where attackers operate: closing entry vectors, containing spread with segmentation and least privilege, and removing attacker leverage with offline immutable backups.

A red team is a group of security professionals who emulate a real-world adversary to test how well an organization's people, processes, and technology detect and respond to an attack.

A reverse shell is a command session in which the victim machine connects back out to the attacker, giving the attacker interactive command execution while slipping past inbound firewall rules.

Risk-based authentication assigns a risk score to each login attempt from contextual signals (device, location, behavior, time, threat intelligence), then applies a policy that allows, steps up, or denies access based on the score.

Cybersecurity risk management is the continuous cycle of identifying, assessing, treating, and monitoring the risks to an organization's systems and data.

Runtime Application Self-Protection (RASP) is a security technology built into an application or its runtime that detects and blocks attacks in real time using the application's own execution context.