# Retro Encabulation

> Demystifying technology, compliance, and autonomic AI cybersecurity through authoritative glossaries, technical presentations, and open-source security operations research.

## Overview
Retro Encabulation (retroencabulation.com) is curated by **John Van Lowe** (aka "JVL"), Implementation Engineer at DeepTempo and Community Lead for the open-source VigilSOC project. The project takes its name from the legendary engineering parody that originated in 1944 and was famously revived by voice actor Mike Kraft in Rockwell Automation's *Retro Encabulator* video and SANS Institute's 2023 *ICS HyperEncabulator*. 

While the original encabulator used deadpan technobabble, **retroencabulation.com** does the reverse: taking the dense, acronym-heavy jargon of cybersecurity, compliance regulations, and AI security operations, and laying it out plainly with authoritative citations.

## Curated Entity Profile: John Van Lowe
- **Current Positions**: Implementation Engineer at [DeepTempo](https://deeptempo.ai) • Community Lead for [VigilSOC](https://vigilsoc.org)
- **Background**: Multi-decade career across mission-critical, zero-fault environments:
  - **NASA Johnson Space Center (JSC MCC)**: Total operational awareness and telemetry monitoring.
  - **USAF**: F-16 flightline readiness and avionics.
  - **Micron Technology**: Cleanroom semiconductor fabrication precision.
  - **Data Center Infrastructure**: Scaled environments from hosting virtualization to 15MW mission-critical facilities.
- **LinkedIn**: [https://linkedin.com/in/johnvl](https://linkedin.com/in/johnvl)
- **GitHub**: [https://github.com/johnvanlowe/](https://github.com/johnvanlowe/)
- **Email**: [jvl@retroencabulation.com](mailto:jvl@retroencabulation.com)

## Core Technical Research & Concepts

### 1. DeepTempo LogLM
An encoder-only neural foundation model trained directly on raw Netflow and syslog telemetry data. LogLM produces behavioral vector embeddings to detect novel, zero-day threat sequences without relying on fragile static signatures.

### 2. VigilSOC (Open Source Autonomous SOC)
An Apache 2.0 open-source framework (hosted at `github.com/Vigil-SOC/vigil`) designed to operationalize LogLM and multi-source community detection rules (Sigma, Splunk SPL, Elastic EQL, Microsoft KQL):
- **13+ Specialized Agents**: Dedicated agents for ingest, triage, correlation, forensic analysis, and containment.
- **30+ MCP Connectors**: Model Context Protocol integrations connecting agents to firewalls, EDRs, cloud APIs, and identity providers.
- **Event-Driven DAGs**: Replaces fragile prompt bloat with dynamic Python selection functions and circuit-breaker pivoting.

### 3. The Autonomic SOC & White Team Shift
- **Stage 1 (v0.1 - v0.3 / HITL)**: Human-In-The-Loop. Analysts approve individual agent actions.
- **Stage 2 (v0.4 - v0.6 / HOTL)**: Human-On-The-Loop. Swarms automate triage and cross-telemetry enrichment while human operators supervise.
- **Stage 3 (v1.0+ / Autonomic SOC)**: Autonomous machine-speed remediation within strict confidence bounds, mathematical guardrails, and closed-loop feedback.
- **The White Team Paradigm**: In multi-agent autonomous defense (Blue hunt swarms vs. Red adversarial swarms), human security professionals transition to the White Team—focusing on safety boundaries, ethical governance, and operational deconfliction.

### 4. AI Security & Governance Frameworks
Authoritative comparison of primary standards:
1. **ISO/IEC 42001 (AIMS)**: Management system requirements for AI governance.
2. **NIST AI RMF 1.0**: Risk framework structured around Govern, Map, Measure, and Manage.
3. **OWASP Top 10 for LLMs / MCP**: Critical application vulnerability taxonomies.
4. **EU AI Act**: Tiered legal risk classifications and compliance obligations.
5. **MITRE ATLAS™**: Adversarial threat landscape tactics and techniques for AI.
6. **CSA STAR for AI**: Cloud AI security assurance and trust registry.

## Key Presentations & Decks
- [Stanford Applied Cyber Session (Sep 2026)](https://retroencabulation.com/stanford/): *Vigil Security Operations Center — Moving from Agentic to Autonomous SOC in Machine-Speed Cyber Defense*. Includes full slide deck, speaker notes, and glossary.
- [VigilSOC is Turning Purple (Jul 2026)](https://retroencabulation.com/ACA-Boston-Vigil-Turning-Purple.pdf): Boston AI Cyber Alliance presentation on closed-loop purple team automation.
- [AI Workflows in the SOC (Jul 2026)](https://retroencabulation.com/AI-Workflows-in-the-SOC.pdf): AustinJS presentation on building agentic security pipelines.
- [The Agentic Battlefield: Red vs Blue Agents (Jun 2026)](https://retroencabulation.com/AgentBattles-RedvsBlue.html): ACM / IEEE Community Showcase slide deck.
- [Open Source AI Security Agents (Jun 2026)](https://retroencabulation.com/ai-cyber-alliance.html): San Francisco AI Cyber Alliance session.
- [Don't Be That DEV! Infosec Edition (May 2026)](https://retroencabulation.com/dev-infosec.html): Austin JavaScript security presentation.
- [OWASP Top 10 MCP & MSSS (Apr 2026)](https://retroencabulation.com/owasp-mcp.html): AIMUG presentation on Model Context Protocol security.
- [Snow Shoe Hunting with GoLang (Feb 2026)](https://retroencabulation.com/golang-snowshoe.html): ATX GoLang meetup talk on network telemetry inspection.

## Glossary & Definitions Directory
The full searchable glossary of 111+ compliance standards and technical acronyms (including 2FA, ACL, AES, AI, API, APT, BCP, CI/CD, CIS, CMMC, CVE, DLP, EDR, FedRAMP, GDPR, HIPAA, IAM, ISO 27001, MITRE ATT&CK, NIST, OWASP, PCI-DSS, RPO, RTO, SIEM, SOAR, SOC 2, XDR, and Zero Trust) is hosted at:
- [https://retroencabulation.com/](https://retroencabulation.com/)
- Comprehensive markdown dump: [https://retroencabulation.com/llms-full.txt](https://retroencabulation.com/llms-full.txt)


---

# Complete Glossary of Cybersecurity, Compliance, and AI Terminology

### 2FA — Two-Factor Authentication.
- **Category**: Technical
- **Definition**: An authentication method that requires two distinct factors (typically something you know plus something you have) before granting access.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/two_factor_authentication)

### 5G — 5th Generation Mobile Network Security.
- **Category**: Technical
- **Definition**: The global wireless telecommunications standard enabling high-speed, low-latency connectivity for mobile devices, industrial IoT, and critical infrastructure backhaul with dedicated security slicing primitives.
- **Primary Source**: [3GPP 5G Security Specification →](https://www.3gpp.org/technologies/5g-system-overview)

### ACL — Access Control List.
- **Category**: Technical
- **Definition**: A list of permissions attached to a resource that specifies which users or systems are granted access and what operations they may perform.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/access_control_list)

### AES — Advanced Encryption Standard.
- **Category**: Technical
- **Definition**: A symmetric block cipher standardized by NIST and used worldwide to protect sensitive data at rest and in transit.
- **Primary Source**: [NIST FIPS 197 → → →](https://csrc.nist.gov/pubs/fips/197/final)

### AI — Artificial Intelligence.
- **Category**: Technical
- **Definition**: The field of computer science focused on building systems that perform tasks normally requiring human intelligence, such as reasoning, perception, and language understanding.
- **Primary Source**: [NIST AI → → →](https://www.nist.gov/artificial-intelligence)

### AIMS — Artificial Intelligence Management System (ISO/IEC 42001).
- **Category**: Compliance
- **Definition**: A certifiable international standard specifying requirements for establishing, implementing, maintaining, and continually improving an AI Management System in organizations.
- **Primary Source**: [ISO/IEC 42001 Standard → →](https://www.iso.org/standard/81230.html)

### AML — Adversarial Machine Learning.
- **Category**: Technical
- **Definition**: The study of attacks against ML systems (such as evasion, poisoning, and model extraction) and the defenses that make models robust to them.
- **Primary Source**: [NIST AI 100-2 → → →](https://csrc.nist.gov/pubs/ai/100/2/e2025/final)

### API — Application Programming Interface.
- **Category**: Technical
- **Definition**: A defined contract that lets software components communicate, and a major attack surface that OWASP tracks with a dedicated Top 10.
- **Primary Source**: [OWASP API Security → → →](https://owasp.org/API-Security/editions/2023/en/0x00-header/)

### APT — Advanced Persistent Threat.
- **Category**: Technical
- **Definition**: A sophisticated, well-resourced adversary (often nation-state backed) that gains and maintains long-term, stealthy access to a target network.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/advanced_persistent_threat)

### ASM — Attack Surface Management.
- **Category**: Technical
- **Definition**: The continuous discovery, inventory, and monitoring of an organization's externally reachable assets to reduce exposure.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/attack_surface)

### AST — Abstract Syntax Tree.
- **Category**: Technical
- **Definition**: A tree representation of the abstract syntactic structure of source code used by compilers, static code analysis engines (SAST), and AI review pipelines to verify types, variable bindings, and function signatures without executing untrusted code.
- **Primary Source**: [ACM Digital Library → →](https://dl.acm.org/doi/10.1145/359576.359579)

### ATLAS™ — Adversarial Threat Landscape for Artificial-Intelligence Systems (MITRE).
- **Category**: Technical
- **Definition**: A globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world attacks against artificial intelligence and machine learning systems.
- **Primary Source**: [MITRE ATLAS™ Matrix → →](https://atlas.mitre.org)

### ATT&CK — MITRE ATT&CK.
- **Category**: Technical
- **Definition**: A globally accessible, curated knowledge base of adversary tactics and techniques observed in real-world attacks, used to map detections and assess coverage.
- **Primary Source**: [ATT&CK Framework → → →](https://attack.mitre.org/)

### BCP — Business Continuity Plan.
- **Category**: Compliance
- **Definition**: Documented procedures that guide an organization in continuing critical operations during and after a disruption.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/business_continuity_plan)

### BYOD — Bring Your Own Device.
- **Category**: Technical
- **Definition**: A policy allowing employees to use personal devices for work, introducing management and data-protection challenges.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/bring_your_own_device)

### C2 — Command and Control.
- **Category**: Technical
- **Definition**: The infrastructure and channels attackers use to remotely direct compromised systems, exfiltrate data, and deliver further payloads.
- **Primary Source**: [MITRE ATT&CK → → →](https://attack.mitre.org/tactics/TA0011/)

### CASB — Cloud Access Security Broker.
- **Category**: Technical
- **Definition**: A policy enforcement point placed between users and cloud services to provide visibility, compliance, and threat protection.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/cloud_access_security_broker)

### CCPA — California Consumer Privacy Act.
- **Category**: Compliance
- **Definition**: A state statute that gives California residents rights over the personal information businesses collect about them, including the right to know, delete, and opt out of the sale of their data.
- **Primary Source**: [CA Attorney General → → →](https://oag.ca.gov/privacy/ccpa)

### CI/CD — Continuous Integration / Continuous Delivery.
- **Category**: Technical
- **Definition**: A set of practices that automate building, testing, and deploying software, enabling frequent and reliable releases.
- **Primary Source**: [OWASP CI/CD Risks → → →](https://owasp.org/www-project-top-10-ci-cd-security-risks/)

### CIA — Confidentiality, Integrity, and Availability.
- **Category**: Technical
- **Definition**: The three core security objectives (the "CIA triad") used to frame how information must be protected.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/confidentiality)

### CISA — Cybersecurity and Infrastructure Security Agency.
- **Category**: Compliance
- **Definition**: The US federal agency responsible for strengthening cybersecurity and infrastructure protection, publishing widely-used advisories and the Known Exploited Vulnerabilities (KEV) catalog.
- **Primary Source**: [CISA.gov → → →](https://www.cisa.gov/)

### CISO — Chief Information Security Officer.
- **Category**: Compliance
- **Definition**: The senior executive accountable for an organization's information and cybersecurity strategy, risk, and governance.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/chief_information_security_officer)

### CMMC — Cybersecurity Maturity Model Certification.
- **Category**: Compliance
- **Definition**: A U.S. Department of Defense program, built on NIST SP 800-171, that verifies contractors protect controlled unclassified information.
- **Primary Source**: [NIST SP 800-171 → → →](https://csrc.nist.gov/pubs/sp/800/171/r3/final)

### CodeQL — Code Query Language.
- **Category**: Technical
- **Definition**: An open-source semantic code analysis engine developed by GitHub that treats source code as data, enabling security researchers to query Abstract Syntax Trees for vulnerabilities across pull request streams.
- **Primary Source**: [GitHub CodeQL Documentation → →](https://codeql.github.com)

### CSA — Cloud Security Alliance.
- **Category**: Technical
- **Definition**: A global organization dedicated to defining standards, certifications, and best practices to ensure secure cloud computing environments and trustworthy AI deployments.
- **Primary Source**: [Cloud Security Alliance →](https://cloudsecurityalliance.org)

### CSF — Cybersecurity Framework.
- **Category**: Compliance
- **Definition**: NIST's voluntary framework of functions (Govern, Identify, Protect, Detect, Respond, Recover) for managing cybersecurity risk.
- **Primary Source**: [NIST CSF → → →](https://www.nist.gov/cyberframework)

### CSRF — Cross-Site Request Forgery.
- **Category**: Technical
- **Definition**: An attack that tricks an authenticated user's browser into submitting unwanted requests to a web application, performing actions without the user's consent.
- **Primary Source**: [OWASP on CSRF → → →](https://owasp.org/www-community/attacks/csrf)

### CTI — Cyber Threat Intelligence.
- **Category**: Technical
- **Definition**: Evidence-based knowledge about adversaries and their tactics, used to inform detection and defensive decisions.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/cyber_threat_intelligence)

### CVD — Coordinated Vulnerability Disclosure (RFC 9116).
- **Category**: Compliance
- **Definition**: A structured vulnerability management process where security researchers privately report discovered security flaws to maintainers before public disclosure, often orchestrated via standardized security.txt endpoints.
- **Primary Source**: [NIST CVD Glossary → →](https://csrc.nist.gov/glossary/term/coordinated_vulnerability_disclosure)

### CVE — Common Vulnerabilities and Exposures.
- **Category**: Technical
- **Definition**: A standardized dictionary of publicly disclosed cybersecurity vulnerabilities, each assigned a unique identifier (e.g., CVE-2021-44228) for tracking and reference.
- **Primary Source**: [CVE Program → → →](https://www.cve.org/)

### CVSS — Common Vulnerability Scoring System.
- **Category**: Technical
- **Definition**: An open framework for communicating the characteristics and severity of software vulnerabilities, producing a numerical score from 0 to 10.
- **Primary Source**: [FIRST CVSS → → →](https://www.first.org/cvss/)

### CWE — Common Weakness Enumeration.
- **Category**: Technical
- **Definition**: A community-developed catalog of software and hardware weakness types, used to describe the root causes behind vulnerabilities (e.g., CWE-79 for XSS).
- **Primary Source**: [MITRE CWE → → →](https://cwe.mitre.org/)

### CycloneDX — CycloneDX Software Bill of Materials Specification.
- **Category**: Technical
- **Definition**: A full-stack Software Bill of Materials (SBOM) and Bill of Vulnerabilities specification created by OWASP designed for application security contexts and software supply chain risk management.
- **Primary Source**: [OWASP CycloneDX Project → →](https://cyclonedx.org)

### DAG — Directed Acyclic Graph.
- **Category**: Technical
- **Definition**: A finite directed graph with no directed cycles used by modern autonomous security platforms (such as VigilSOC) to orchestrate event-driven threat hunting steps, tool execution, and circuit-breaker pivoting.
- **Primary Source**: [NIST CSRC Glossary →](https://csrc.nist.gov/glossary/term/directed_acyclic_graph)

### DAST — Dynamic Application Security Testing.
- **Category**: Technical
- **Definition**: A black-box testing method that probes a running application from the outside to find vulnerabilities an attacker could exploit at runtime.
- **Primary Source**: [OWASP DAST Tools → → →](https://owasp.org/www-community/Vulnerability_Scanning_Tools)

### DDoS — Distributed Denial-of-Service.
- **Category**: Technical
- **Definition**: An attack that overwhelms a target with traffic from many compromised sources, rendering a service unavailable to legitimate users.
- **Primary Source**: [CISA on DDoS → → →](https://www.cisa.gov/news-events/news/understanding-denial-service-attacks)

### DEF CON — DEF CON Hacking Conference.
- **Category**: Technical
- **Definition**: One of the world's largest and most notable annual cybersecurity and hacker conventions held in Las Vegas, featuring competitive CTF events and vulnerability research disclosures.
- **Primary Source**: [DEF CON Official →](https://defcon.org)

### DKIM — DomainKeys Identified Mail.
- **Category**: Technical
- **Definition**: An email authentication method that attaches a cryptographic signature so receivers can verify a message was not altered in transit.
- **Primary Source**: [IETF RFC 6376 → → →](https://datatracker.ietf.org/doc/html/rfc6376)

### DLP — Data Loss Prevention.
- **Category**: Technical
- **Definition**: Technologies and policies that detect and block the unauthorized transmission or exfiltration of sensitive data.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/data_loss_prevention)

### DMARC — Domain-based Message Authentication, Reporting, and Conformance.
- **Category**: Technical
- **Definition**: An email policy layer over SPF and DKIM that tells receivers how to handle messages that fail authentication.
- **Primary Source**: [IETF RFC 7489 → → →](https://datatracker.ietf.org/doc/html/rfc7489)

### DNS — Domain Name System.
- **Category**: Technical
- **Definition**: The internet's directory service that translates human-readable domain names into the IP addresses machines use to locate each other.
- **Primary Source**: [What is DNS? → → →](https://www.cloudflare.com/learning/dns/what-is-dns/)

### DORA — Digital Operational Resilience Act.
- **Category**: Compliance
- **Definition**: An EU regulation that sets uniform requirements for the security and operational resilience of ICT systems supporting financial entities.
- **Primary Source**: [About DORA → → →](https://www.digital-operational-resilience-act.com/)

### DPO — Data Protection Officer.
- **Category**: Compliance
- **Definition**: An independent role required under the GDPR for certain organizations to oversee data protection strategy and compliance.
- **Primary Source**: [GDPR Art. 37 → → →](https://gdpr-info.eu/art-37-gdpr/)

### DRP — Disaster Recovery Plan.
- **Category**: Compliance
- **Definition**: A documented set of procedures to recover IT systems and data following a disruptive event.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/disaster_recovery_plan)

### EDR — Endpoint Detection and Response.
- **Category**: Technical
- **Definition**: Security tooling that continuously monitors endpoints (laptops, servers) to detect, investigate, and respond to threats at the host level.
- **Primary Source**: [What is EDR? → → →](https://www.crowdstrike.com/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/)

### FedRAMP — Federal Risk and Authorization Management Program.
- **Category**: Compliance
- **Definition**: A US government-wide program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.
- **Primary Source**: [FedRAMP.gov → → →](https://www.fedramp.gov/)

### FERPA — Family Educational Rights and Privacy Act.
- **Category**: Compliance
- **Definition**: A US federal law that protects the privacy of student education records and gives parents and eligible students rights over those records.
- **Primary Source**: [US Dept. of Education → → →](https://studentprivacy.ed.gov/)

### FISMA — Federal Information Security Modernization Act.
- **Category**: Compliance
- **Definition**: U.S. legislation requiring federal agencies to implement and document information security programs.
- **Primary Source**: [NIST on FISMA → → →](https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma)

### FN — False Negative.
- **Category**: Technical
- **Definition**: A security detection failure where malicious activity, an unauthorized intrusion, or an adversarial payload bypasses defensive sensors without triggering an alert.
- **Primary Source**: [NIST Glossary →](https://csrc.nist.gov/glossary/term/false_negative)

### FP — False Positive.
- **Category**: Technical
- **Definition**: An alert triggered by a security sensor, SIEM, or machine learning model that incorrectly flags benign administrative activity or harmless network traffic as malicious.
- **Primary Source**: [NIST Glossary →](https://csrc.nist.gov/glossary/term/false_positive)

### GDPR — General Data Protection Regulation.
- **Category**: Compliance
- **Definition**: A regulation in EU law on data protection and privacy in the European Union and the European Economic Area. It also addresses the transfer of personal data outside the EU and EEA areas.
- **Primary Source**: [Official GDPR Source → → →](https://gdpr.eu/)

### GenAI — Generative AI.
- **Category**: Technical
- **Definition**: AI systems that create new content (text, images, audio, code) by learning the patterns and structure of their training data.
- **Primary Source**: [NIST AI → → →](https://www.nist.gov/artificial-intelligence)

### GLBA — Gramm-Leach-Bliley Act.
- **Category**: Compliance
- **Definition**: A US law requiring financial institutions to explain how they share and protect their customers' private information, including the Safeguards Rule and Privacy Rule.
- **Primary Source**: [FTC GLBA Guidance → → →](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act)

### GPAI — General-Purpose Artificial Intelligence (EU AI Act).
- **Category**: Compliance
- **Definition**: An AI model capable of performing a wide variety of distinct tasks across domains, classified under the European Union AI Act for systemic risk evaluation and red teaming obligations.
- **Primary Source**: [European Commission AI Act →](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)

### GRC — Governance, Risk, and Compliance.
- **Category**: Compliance
- **Definition**: The integrated discipline of aligning IT and security activities with business objectives, managing risk, and meeting regulations.
- **Primary Source**: [NIST CSF → → →](https://www.nist.gov/cyberframework)

### HIPAA — Health Insurance Portability and Accountability Act.
- **Category**: Compliance
- **Definition**: A US federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.
- **Primary Source**: [HHS HIPAA Source → → →](https://www.hhs.gov/hipaa/index.html)

### HITL — Human-In-The-Loop.
- **Category**: Technical
- **Definition**: An operational AI architecture where automated agents propose actions or triage telemetry, but require explicit human validation and intervention at every execution gate before changes are applied.
- **Primary Source**: [NIST AI Glossary → →](https://csrc.nist.gov/glossary/term/human_in_the_loop)

### HMI — Human-Machine Interface.
- **Category**: Technical
- **Definition**: The user interface or dashboard in an Industrial Control System (ICS/SCADA) connecting human operators to programmable logic controllers (PLCs) and physical plant telemetry.
- **Primary Source**: [NIST SP 800-82 →](https://csrc.nist.gov/glossary/term/human_machine_interface)

### HOTL — Human-On-The-Loop.
- **Category**: Technical
- **Definition**: A supervisory AI operational model where autonomous agent swarms execute detection, correlation, and mitigation pipelines at machine speed, while human analysts monitor telemetry and retain circuit-breaker override authority.
- **Primary Source**: [NIST AI RMF Terminology → →](https://csrc.nist.gov/glossary/term/human_on_the_loop)

### HSM — Hardware Security Module.
- **Category**: Technical
- **Definition**: A dedicated, tamper-resistant device that generates, stores, and manages cryptographic keys and performs secure crypto operations.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/hardware_security_module_hsm)

### IAM — Identity and Access Management.
- **Category**: Technical
- **Definition**: The framework of policies and technologies for ensuring that the right individuals and machines have the appropriate access to technology resources.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/identity_and_access_management)

### IDOR — Insecure Direct Object Reference.
- **Category**: Technical
- **Definition**: An access-control flaw where an application exposes a reference to an internal object (like a record ID) without verifying the user is authorized to access it.
- **Primary Source**: [OWASP Testing Guide → → →](https://owasp.org/www-project-web-security-testing-guide/)

### IDS — Intrusion Detection System.
- **Category**: Technical
- **Definition**: A monitoring system that analyzes network or host activity and alerts on signs of malicious behavior or policy violations.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/intrusion_detection_system)

### InfoSec — Information Security.
- **Category**: Compliance
- **Definition**: The practice of protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction to ensure confidentiality, integrity, and availability (CIA triad).
- **Primary Source**: [NIST Glossary →](https://csrc.nist.gov/glossary/term/information_security)

### IOC — Indicator of Compromise.
- **Category**: Technical
- **Definition**: Forensic artifacts (such as malicious IPs, file hashes, or domains) that signal a system may have been breached.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/indicator_of_compromise)

### IPS — Intrusion Prevention System.
- **Category**: Technical
- **Definition**: A monitoring system that detects malicious activity and can actively block or drop it inline before it reaches its target.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/intrusion_prevention_system)

### IR — Incident Response.
- **Category**: Technical
- **Definition**: The organized process for preparing for, detecting, containing, eradicating, and recovering from security incidents.
- **Primary Source**: [NIST SP 800-61 → → →](https://csrc.nist.gov/pubs/sp/800/61/r2/final)

### ISO 27001 — ISO/IEC 27001.
- **Category**: Compliance
- **Definition**: The leading international standard for an Information Security Management System (ISMS), specifying requirements for establishing, implementing, maintaining, and continually improving information security.
- **Primary Source**: [ISO Standard → → →](https://www.iso.org/standard/27001)

### JWT — JSON Web Token.
- **Category**: Technical
- **Definition**: A compact, URL-safe, digitally signed token format used to securely transmit claims between parties, widely used for authentication and authorization.
- **Primary Source**: [JWT Introduction → → →](https://jwt.io/introduction)

### KEV — Known Exploited Vulnerabilities.
- **Category**: Technical
- **Definition**: CISA's authoritative catalog of vulnerabilities that have been actively exploited in the wild, used to prioritize remediation.
- **Primary Source**: [CISA KEV Catalog → → →](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

### LLM — Large Language Model.
- **Category**: Technical
- **Definition**: A type of artificial intelligence algorithm that uses deep learning techniques and massively large data sets to understand, summarize, generate and predict new content.
- **Primary Source**: [Learn about LLMs → → →](https://developers.google.com/machine-learning/resources/intro-llms)

### LogLM — Log Language Model (DeepTempo).
- **Category**: Technical
- **Definition**: An encoder-only neural foundation model trained directly on raw Netflow and syslog telemetry data to build deep behavioral vector embeddings that detect novel zero-day attack sequences without static signatures.
- **Primary Source**: [DeepTempo Foundation Models → →](https://deeptempo.ai)

### MCP — Model Context Protocol (Anthropic / Linux Foundation).
- **Category**: Technical
- **Definition**: An open standard that enables AI models and agentic workflows to securely connect to external tools, databases, APIs, and security telemetry harnesses through unified client-server primitives.
- **Primary Source**: [Model Context Protocol Specification → →](https://modelcontextprotocol.io)

### MFA — Multi-Factor Authentication.
- **Category**: Technical
- **Definition**: A security mechanism requiring two or more independent verification factors (something you know, have, or are) to gain access, dramatically reducing the risk of compromised credentials.
- **Primary Source**: [CISA on MFA → → →](https://www.cisa.gov/secure-our-world/turn-mfa)

### MITM — Man-in-the-Middle Attack.
- **Category**: Technical
- **Definition**: An attack where an adversary secretly relays or alters communication between two parties who believe they are talking directly.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/man_in_the_middle_attack)

### MITRE — MITRE Corporation.
- **Category**: Technical
- **Definition**: A non-profit organization operating federally funded research and development centers (FFRDCs) that maintains authoritative cybersecurity frameworks including ATT&CK, CAPEC, CWE, and ATLAS™.
- **Primary Source**: [MITRE Official →](https://www.mitre.org)

### ML — Machine Learning.
- **Category**: Technical
- **Definition**: A subset of AI in which systems learn patterns from data to make predictions or decisions without being explicitly programmed for each task.
- **Primary Source**: [ML Crash Course → → →](https://developers.google.com/machine-learning/crash-course)

### MSSP — Managed Security Services Provider.
- **Category**: Technical
- **Definition**: A specialized service organization that provides outsourced monitoring, management, and automated triage of cybersecurity systems and devices across multi-tenant customer environments.
- **Primary Source**: [NIST Glossary → →](https://csrc.nist.gov/glossary/term/managed_security_service_provider)

### MSSS — Managed Security Service System.
- **Category**: Technical
- **Definition**: Standardized service orchestration suites and automated telemetry pipelines used by MSSPs and MDR providers to deliver scalable, multi-tenant threat detection and response.
- **Primary Source**: [NIST CSRC Glossary → →](https://csrc.nist.gov/glossary/term/managed_security_service_system)

### NAC — Network Access Control.
- **Category**: Technical
- **Definition**: A capability that enforces policy on devices attempting to connect to a network, permitting, denying, or restricting access based on posture.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/network_access_control)

### NIST — National Institute of Standards and Technology.
- **Category**: Compliance
- **Definition**: A US agency whose Cybersecurity Framework and special publications (e.g., SP 800-53) are widely adopted standards for managing and reducing cybersecurity risk.
- **Primary Source**: [NIST CSF → → →](https://www.nist.gov/cyberframework)

### NLP — Natural Language Processing.
- **Category**: Technical
- **Definition**: The branch of AI concerned with enabling computers to understand, interpret, and generate human language.
- **Primary Source**: [What is NLP? → → →](https://www.ibm.com/topics/natural-language-processing)

### OAuth — Open Authorization.
- **Category**: Technical
- **Definition**: An open standard for delegated access that lets applications obtain limited access to a user's resources without exposing their credentials.
- **Primary Source**: [OAuth 2.0 → → →](https://oauth.net/2/)

### OpSec — Operational Security.
- **Category**: Compliance
- **Definition**: A systematic risk management process that identifies critical information and observable human or automated actions that adversaries could piece together to deduce sensitive operational plans.
- **Primary Source**: [NIST OpSec Glossary → →](https://csrc.nist.gov/glossary/term/operations_security)

### OT — Operational Technology.
- **Category**: Technical
- **Definition**: Hardware and software that detects or causes changes through the direct monitoring and control of physical devices, processes, and events in critical infrastructure, utility grids, fabs, and SCADA systems.
- **Primary Source**: [NIST Special Publication 800-82 → →](https://csrc.nist.gov/glossary/term/operational_technology)

### OWASP — Open Worldwide Application Security Project.
- **Category**: Technical
- **Definition**: A nonprofit foundation that works to improve the security of software, famous for their "Top 10" list of critical security vulnerabilities.
- **Primary Source**: [OWASP Foundation → → →](https://owasp.org/)

### PAM — Privileged Access Management.
- **Category**: Technical
- **Definition**: Controls and tooling that secure, monitor, and govern accounts with elevated permissions to limit misuse and lateral movement.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/privileged_access_management)

### PCAP — Packet Capture.
- **Category**: Technical
- **Definition**: A standardized application programming interface and binary file format used for intercepting and logging raw data packet transmissions crossing a network interface for deep protocol analysis.
- **Primary Source**: [NIST CSRC Glossary → →](https://csrc.nist.gov/glossary/term/packet_capture)

### PCI DSS — Payment Card Industry Data Security Standard.
- **Category**: Compliance
- **Definition**: A set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.
- **Primary Source**: [PCI SSC → → →](https://www.pcisecuritystandards.org/)

### PEAK — Prepare, Execute, Act with Knowledge (Threat Hunting Framework).
- **Category**: Technical
- **Definition**: A comprehensive threat hunting framework designed to structure hypothesis-driven investigations across network telemetry, identity stores, and cloud audits with iterative pivoting.
- **Primary Source**: [PEAK Hunting Framework Guide → →](https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html)

### PGP — Pretty Good Privacy.
- **Category**: Technical
- **Definition**: An encryption program providing cryptographic privacy and authentication for data communication, commonly used for signing and encrypting emails, software packages, and vulnerability disclosures.
- **Primary Source**: [OpenPGP Standard →](https://www.openpgp.org)

### PHI — Protected Health Information.
- **Category**: Compliance
- **Definition**: Individually identifiable health information protected under HIPAA, covering a person's health status, care, or payment when linked to identifiers.
- **Primary Source**: [HHS Privacy Rule → → →](https://www.hhs.gov/hipaa/for-professionals/privacy/index.html)

### PhysSec — Physical Security.
- **Category**: Compliance
- **Definition**: The protection of personnel, hardware, networks, data centers, cleanroom fabs, and buildings from physical actions and events that could cause serious disruption or damage.
- **Primary Source**: [NIST CSRC Glossary →](https://csrc.nist.gov/glossary/term/physical_security)

### PII — Personally Identifiable Information.
- **Category**: Compliance
- **Definition**: Any data that could potentially identify a specific individual, such as name, Social Security number, biometric records, or any information linkable to a person.
- **Primary Source**: [NIST Definition → → →](https://csrc.nist.gov/glossary/term/personally_identifiable_information)

### PKI — Public Key Infrastructure.
- **Category**: Technical
- **Definition**: The framework of policies, hardware, and certificate authorities that manages digital certificates and public-key encryption to enable trusted communication.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/public_key_infrastructure)

### PoLP — Principle of Least Privilege.
- **Category**: Technical
- **Definition**: The security practice of granting users, processes, and systems only the minimum access required to perform their function, limiting the blast radius of a compromise.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/least_privilege)

### PT — Penetration Testing.
- **Category**: Technical
- **Definition**: An authorized, simulated attack against systems to find and demonstrate exploitable vulnerabilities before real adversaries do.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/penetration_testing)

### RAG — Retrieval-Augmented Generation.
- **Category**: Technical
- **Definition**: An AI technique that grounds a language model's output by retrieving relevant external documents at query time, improving accuracy and reducing hallucination.
- **Primary Source**: [What is RAG? → → →](https://research.ibm.com/blog/retrieval-augmented-generation-RAG)

### RBAC — Role-Based Access Control.
- **Category**: Technical
- **Definition**: An authorization model that grants permissions to roles rather than individuals, so users receive access based on the role they hold.
- **Primary Source**: [NIST RBAC → → →](https://csrc.nist.gov/projects/role-based-access-control)

### RCE — Remote Code Execution.
- **Category**: Technical
- **Definition**: A class of vulnerability that allows an attacker to run arbitrary code on a target machine over a network, often the most severe outcome of a security flaw.
- **Primary Source**: [OWASP on Code Injection → → →](https://owasp.org/www-community/attacks/Code_Injection)

### RFC — Request for Comments.
- **Category**: Technical
- **Definition**: Formal standards documents published by the Internet Engineering Task Force (IETF) defining core internet protocols, security specifications (such as RFC 9116 security.txt), and cryptographic standards.
- **Primary Source**: [IETF RFC Editor →](https://www.rfc-editor.org)

### RMF — Risk Management Framework (NIST SP 800-37 / AI RMF 1.0).
- **Category**: Compliance
- **Definition**: A structured lifecycle process integrating security, privacy, and cyber supply chain risk management activities into the development and operation of federal and commercial systems.
- **Primary Source**: [NIST RMF Framework →](https://csrc.nist.gov/projects/risk-management/about-rmf)

### RPO — Recovery Point Objective.
- **Category**: Compliance
- **Definition**: The maximum acceptable amount of data loss, measured in time, that an organization can tolerate after a disruption.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/recovery_point_objective)

### RSA — Rivest-Shamir-Adleman Cryptosystem.
- **Category**: Technical
- **Definition**: A widely deployed public-key cryptosystem used for secure data transmission, key exchange, and digital signatures based on the mathematical difficulty of factoring large composite integers.
- **Primary Source**: [NIST CSRC Glossary →](https://csrc.nist.gov/glossary/term/rsa)

### RTO — Recovery Time Objective.
- **Category**: Compliance
- **Definition**: The targeted duration within which a business process or system must be restored after a disruption to avoid unacceptable impact.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/recovery_time_objective)

### SAML — Security Assertion Markup Language.
- **Category**: Technical
- **Definition**: An XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider, commonly powering SSO.
- **Primary Source**: [What is SAML? → → →](https://www.cloudflare.com/learning/access-management/what-is-saml/)

### SASE — Secure Access Service Edge.
- **Category**: Technical
- **Definition**: A cloud-delivered architecture that converges networking (SD-WAN) and security services (like CASB, SWG, ZTNA) into a single, identity-aware service.
- **Primary Source**: [Gartner on SASE → → →](https://www.gartner.com/en/information-technology/glossary/secure-access-service-edge-sase)

### SAST — Static Application Security Testing.
- **Category**: Technical
- **Definition**: A white-box testing method that analyzes source code, bytecode, or binaries for security vulnerabilities without executing the program.
- **Primary Source**: [OWASP SAST Tools → → →](https://owasp.org/www-community/Source_Code_Analysis_Tools)

### SBOM — Software Bill of Materials.
- **Category**: Compliance
- **Definition**: A formal, machine-readable inventory of software components, libraries, dependencies, and hierarchical relationships used in building a software application, mandated under U.S. Executive Order 14028.
- **Primary Source**: [CISA SBOM Community → →](https://www.cisa.gov/sbom)

### SCA — Software Composition Analysis.
- **Category**: Technical
- **Definition**: An automated application security testing methodology that scans source code, package managers, and container registries to identify known vulnerabilities (CVEs) and licensing risks in open-source dependencies.
- **Primary Source**: [NIST CSRC Glossary →](https://csrc.nist.gov/glossary/term/software_composition_analysis)

### SCADA — Supervisory Control and Data Acquisition.
- **Category**: Technical
- **Definition**: An industrial automation control system architecture comprising computers, networked data communications, and graphical user interfaces for high-level supervisory management of utility grids and physical plants.
- **Primary Source**: [NIST SP 800-82 →](https://csrc.nist.gov/glossary/term/supervisory_control_and_data_acquisition)

### SDLC — Software Development Life Cycle.
- **Category**: Technical
- **Definition**: The structured phases for building software (such as requirements, design, build, test, and maintenance) into which security should be integrated.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/system_development_life_cycle)

### SIEM — Security Information and Event Management.
- **Category**: Technical
- **Definition**: Technology that aggregates and analyzes log and event data across an organization in real time to detect, investigate, and respond to security threats.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/security_information_and_event_management)

### SLA — Service Level Agreement.
- **Category**: Compliance
- **Definition**: A formal commitment between a provider and customer defining expected service levels, metrics, and remedies if they are not met.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/service_level_agreement)

### SOAR — Security Orchestration, Automation, and Response.
- **Category**: Technical
- **Definition**: Platforms that automate and coordinate security workflows and playbooks across tools to speed up incident response.
- **Primary Source**: [NIST Glossary → → →](https://csrc.nist.gov/glossary/term/security_orchestration_automation_and_response)

### SOC — Security Operations Center.
- **Category**: Technical
- **Definition**: A centralized facility or organizational function where information security teams continuously monitor, detect, analyze, and respond to cybersecurity incidents across enterprise and cloud assets.
- **Primary Source**: [NIST Glossary →](https://csrc.nist.gov/glossary/term/security_operations_center)

### SOC 2 — System and Organization Controls 2.
- **Category**: Compliance
- **Definition**: An auditing procedure that ensures your service providers securely manage your data to protect the interests of your organization and the privacy of its clients.
- **Primary Source**: [AICPA SOC 2 Info → → →](https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome)

### SOCBench — Security Operations Center Evaluation Benchmark.
- **Category**: Technical
- **Definition**: An open benchmarking standard and evaluation suite designed to test, validate, and compare detection latency and automated remediation efficacy across AI and human SOC operations.
- **Primary Source**: [SOCBench.org Official → →](https://socbench.org/)

### SOX — Sarbanes-Oxley Act.
- **Category**: Compliance
- **Definition**: A US federal law that sets requirements for financial reporting and internal controls at public companies, with significant implications for IT controls and data integrity.
- **Primary Source**: [SEC SOX Text → → →](https://www.sec.gov/about/laws/soa2002.pdf)

### SPDX — Software Package Data Exchange (ISO/IEC 5962).
- **Category**: Compliance
- **Definition**: An international open standard for communicating Software Bill of Materials (SBOM) information, including software component provenance, licenses, copyrights, and security attributes.
- **Primary Source**: [SPDX Workgroup → →](https://spdx.dev)

### SPF — Sender Policy Framework.
- **Category**: Technical
- **Definition**: An email authentication standard that lets a domain publish which mail servers are authorized to send on its behalf.
- **Primary Source**: [IETF RFC 7208 → → →](https://datatracker.ietf.org/doc/html/rfc7208)

### SQLi — SQL Injection.
- **Category**: Technical
- **Definition**: A code-injection technique where malicious SQL statements are inserted into application queries, allowing attackers to read, modify, or destroy database contents.
- **Primary Source**: [OWASP on SQLi → → →](https://owasp.org/www-community/attacks/SQL_Injection)

### SSH — Secure Shell.
- **Category**: Technical
- **Definition**: A cryptographic network protocol providing secure remote command-line login, automated command execution, SFTP file transfer, and network tunneling over untrusted networks.
- **Primary Source**: [IETF RFC 4253 →](https://www.rfc-editor.org/rfc/rfc4253)

### SSO — Single Sign-On.
- **Category**: Technical
- **Definition**: An authentication scheme that lets a user log in once with a single set of credentials to access multiple related but independent applications and services.
- **Primary Source**: [What is SSO? → → →](https://www.cloudflare.com/learning/access-management/what-is-sso/)

### SSRF — Server-Side Request Forgery.
- **Category**: Technical
- **Definition**: A vulnerability that lets an attacker coerce a server into making requests to unintended internal or external resources, often reaching systems behind a firewall.
- **Primary Source**: [OWASP on SSRF → → →](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)

### STAR — Security Trust Assurance and Risk (Cloud Security Alliance).
- **Category**: Compliance
- **Definition**: A publicly accessible cloud security assurance registry documenting the security and privacy controls of cloud service and AI platform providers against the Cloud Controls Matrix (CCM).
- **Primary Source**: [CSA STAR Registry →](https://cloudsecurityalliance.org/star/)

### TaHiTi — Target-Hunting-Threat-Intelligence (TNO Threat Hunting Framework).
- **Category**: Technical
- **Definition**: A structured threat hunting methodology established by TNO enabling hunting teams to pivot from strategic threat intelligence into actionable, iterative endpoint and network telemetry queries.
- **Primary Source**: [TNO TaHiTi Methodology → →](https://www.tno.nl/en/focus-areas/defence-safety-security/roadmaps/information-security/threat-hunting-tahiti/)

### TLS — Transport Layer Security.
- **Category**: Technical
- **Definition**: The cryptographic protocol that encrypts data in transit over networks, securing HTTPS and most other internet communications (the successor to SSL).
- **Primary Source**: [What is TLS? → → →](https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/)

### ToS — Terms of Service & Autonomous Agent Governance.
- **Category**: Compliance
- **Definition**: Legal and operational contracts defining acceptable boundaries, rate limits, and access constraints governing interactions between users, cloud service providers, and autonomous AI agents.
- **Primary Source**: [NIST Glossary →](https://csrc.nist.gov/glossary/term/terms_of_service)

### TPRM — Third-Party Risk Management.
- **Category**: Compliance
- **Definition**: The practice of identifying, assessing, and controlling the security and compliance risks introduced by vendors and suppliers.
- **Primary Source**: [NIST SP 800-161 → → →](https://csrc.nist.gov/pubs/sp/800/161/r1/final)

### TTP — Tactics, Techniques, and Procedures.
- **Category**: Technical
- **Definition**: The patterns of behavior that describe how a threat actor operates, forming the backbone of frameworks like MITRE ATT&CK.
- **Primary Source**: [MITRE ATT&CK → → →](https://attack.mitre.org/)

### TTPs — Tactics, Techniques, and Procedures.
- **Category**: Technical
- **Definition**: The patterns of behavior, attack methods, tools, and technical execution strategies utilized by threat actors across the cyber kill chain, cataloged in MITRE ATT&CK and ATLAS™.
- **Primary Source**: [NIST Glossary →](https://csrc.nist.gov/glossary/term/tactics_techniques_and_procedures)

### VigilSOC — Vigil Security Operations Center (Open Source AI SOC).
- **Category**: Technical
- **Definition**: An Apache 2.0 open-source framework bridging foundation models with 13+ specialized agents, 30+ Model Context Protocol (MCP) connectors, and dynamic DAG hunting workflows for autonomous defense.
- **Primary Source**: [VigilSOC Project Hub → →](https://vigilsoc.org)

### VM — Vulnerability Management.
- **Category**: Technical
- **Definition**: The ongoing cycle of discovering, prioritizing, remediating, and verifying security weaknesses across systems and software.
- **Primary Source**: [NIST SP 800-40 → → →](https://csrc.nist.gov/pubs/sp/800/40/r4/final)

### VPN — Virtual Private Network.
- **Category**: Technical
- **Definition**: A technology that creates an encrypted tunnel over a public network, protecting traffic and masking the user's network location.
- **Primary Source**: [CISA Guidance → → →](https://www.cisa.gov/news-events/news/securing-network-infrastructure-devices)

### WAF — Web Application Firewall.
- **Category**: Technical
- **Definition**: A security filter that monitors, filters, and blocks malicious HTTP traffic to and from a web application, protecting against attacks such as XSS and SQL injection.
- **Primary Source**: [OWASP on WAF → → →](https://owasp.org/www-community/Web_Application_Firewall)

### White Team — White Team Deconfliction & Rules of Engagement.
- **Category**: Compliance
- **Definition**: The supervisory governance body in cybersecurity exercises and autonomic defense swarms responsible for establishing safety guardrails, adjudicating results, and preventing operational disruption.
- **Primary Source**: [NIST White Team Glossary → →](https://csrc.nist.gov/glossary/term/white_team)

### XDR — Extended Detection and Response.
- **Category**: Technical
- **Definition**: An approach that unifies telemetry across endpoints, network, cloud, and identity into a single detection and response platform.
- **Primary Source**: [What is XDR? → → →](https://www.paloaltonetworks.com/cyberpedia/what-is-extended-detection-response-xdr)

### XSS — Cross-Site Scripting.
- **Category**: Technical
- **Definition**: A web vulnerability that lets attackers inject malicious client-side scripts into pages viewed by other users, enabling session theft, defacement, or redirection.
- **Primary Source**: [OWASP on XSS → → →](https://owasp.org/www-community/attacks/xss/)

### XZ — XZ Utils Supply Chain Compromise (CVE-2024-3094).
- **Category**: Technical
- **Definition**: A landmark multi-year social-engineering and supply-chain attack where a malicious contributor inserted an obfuscated backdoor into upstream XZ Utils tarballs targeting SSH authentication across Linux distributions.
- **Primary Source**: [NIST NVD Entry →](https://nvd.nist.gov/vuln/detail/CVE-2024-3094)

### ZTA — Zero Trust Architecture.
- **Category**: Technical
- **Definition**: A security model based on the principle "never trust, always verify," requiring continuous authentication and authorization for every user and device regardless of network location.
- **Primary Source**: [NIST SP 800-207 → → →](https://csrc.nist.gov/pubs/sp/800/207/final)

### ZTNA — Zero Trust Network Access.
- **Category**: Technical
- **Definition**: A model that grants application access per session based on identity and context, replacing implicit trust in the network perimeter.
- **Primary Source**: [NIST SP 800-207 → → →](https://csrc.nist.gov/pubs/sp/800/207/final)