Security glossary

The terms used on Securelyn Intel, in plain English.

A

Aggregate: A total or count across many events, such as the number of ransomware claims in a month. Counts on the ransomware pages are aggregates. Where the page also names organisations, those names are claims made by criminal groups, never proof of an attack.

Breach notification: Telling a regulator and the people affected about a data breach. Many countries and states require it when a breach is likely to cause serious harm, and the deadlines and thresholds differ by jurisdiction.

CIS Controls: A prioritised list of security safeguards from the Center for Internet Security, starting with knowing what devices and software you have. CIS: Critical Security Controls
Claim (ransomware): A ransomware group's own statement that it attacked an organisation, usually posted on its own site. Claims can be false, duplicated or late. A claim is not proof that an attack happened or that data was taken.
Credential stuffing: When criminals try email and password pairs from one breach on many other sites, hoping people reused a password. Unique passwords and multi-factor authentication stop it.
CVE: Common Vulnerabilities and Exposures. A CVE ID, such as CVE-2026-12345, is a shared name for one publicly known security flaw, so everyone talks about the same problem. CVE Program
CVSS: Common Vulnerability Scoring System. A score from 0 to 10 for how severe a flaw is in general: 9 to 10 is critical, 7 to 8.9 high, 4 to 6.9 medium and under 4 low. It does not measure your own risk. FIRST: CVSS
CWE: Common Weakness Enumeration. A numbered list of the kinds of mistakes in software that cause flaws, such as CWE-79 for cross-site scripting. It names the type of weakness, not the individual flaw. MITRE: CWE

Data breach: When personal information is lost, or seen or taken by someone who should not have it. A breach can come from an attack, a mistake such as an email sent to the wrong person, or a faulty system. What counts as a reportable breach depends on the law where the organisation and the people affected are.

EPSS: Exploit Prediction Scoring System. A probability from 0 to 1, published by FIRST, that exploitation activity will be seen in the next 30 days. It describes the flaw in general, not your business. FIRST: EPSS
Essential Eight: One of several security frameworks: eight practical steps published by the Australian Signals Directorate, including patching, multi-factor authentication and backups. ASD: Essential Eight

GDPR: The European Union's General Data Protection Regulation. It sets rules for handling personal information about people in the EU, including reporting certain data breaches. EUR-Lex: GDPR

Have I Been Pwned: A free service run by security researcher Troy Hunt. It keeps a list of data breaches it has checked and lets people see whether their email address appears in one. Securelyn Intel shows the list of breaches, not anyone's email address. haveibeenpwned.com

ISO/IEC 27001: An international standard for running an information security management system. Organisations can be certified against it by an independent auditor. ISO: ISO/IEC 27001

KEV: Known Exploited Vulnerabilities. A catalogue kept by the US cyber agency CISA of flaws it has evidence attackers are using. A listed flaw deserves attention first. CISA: KEV catalogue

Multi-factor authentication (MFA): Signing in with something more than a password, such as a code from an app. It makes a stolen password far less useful to an attacker.

NIST Cybersecurity Framework: A widely used framework from the US National Institute of Standards and Technology that groups security work into six functions: govern, identify, protect, detect, respond and recover. NIST: Cybersecurity Framework

Patching: Installing the update a vendor releases to fix a security flaw. Patching promptly is one of the most effective ways to close the door on known attacks.

Ransomware: Malicious software that locks or steals a business's data and demands payment. Many attackers get in through an unpatched system, a stolen password or a booby-trapped email.