The security acronyms decoder

identity and access

The territory of who can reach what, and how they prove who they are.

IAM (Identity and Access Management). The whole discipline of managing digital identities and what they can reach.

IdP (Identity Provider). The system that holds your identities and confirms who is signing in, usually the one that came with your Microsoft or Google suite.

SSO (Single Sign-On). Signing in once to reach many applications, instead of a separate password for each.

MFA (Multi-Factor Authentication). Requiring more than a password to sign in, like a code or a tap on your phone.

2FA (Two-Factor Authentication). MFA with exactly two factors. The terms get used interchangeably.

FIDO2 and passkeys. A modern standard for phishing-resistant sign-in, where the login is tied to the real website and a key that never leaves your device, so a fake page has nothing to steal.

PAM (Privileged Access Management). Controlling and watching your most powerful accounts, the admins.

EPM or PEDM (Endpoint Privilege Management). Removing local administrator rights from everyday laptops and granting elevation only per-application.

IGA (Identity Governance and Administration). Managing who gets access and who loses it as people join, move, and leave, plus periodic access reviews.

JML (Joiner-Mover-Leaver). The lifecycle of someone's access: granted when they join, changed when they move roles, removed when they leave.

ITDR (Identity Threat Detection and Response). Watching your identity systems for attacks and acting on them.

ISPM (Identity Security Posture Management). Finding weak identity configuration before an attacker does, the preventive cousin of ITDR.

NHI (Non-Human Identity). Service accounts, API keys, tokens, and AI agents, the identities that are not people and now outnumber them.

SCIM (System for Cross-domain Identity Management). The standard that lets your identity provider automatically create and remove user accounts in connected apps.

SAML and OIDC (Security Assertion Markup Language; OpenID Connect). The two standards apps use to accept single sign-on from your identity provider.

OAuth (Open Authorization). The standard behind "sign in with Google" and behind the grants that let one app access your data in another.

LDAP and AD (Lightweight Directory Access Protocol; Active Directory). The older, often on-premises directory technologies many companies still run.

JIT (Just-in-Time access). Granting privileged access only when it is needed, for a bounded window, then removing it automatically.

ZSP (Zero Standing Privilege). The goal that no account holds powerful access all the time, only on demand.

SoD (Segregation of Duties). Splitting sensitive tasks across people so no single person can do something dangerous alone.

CIAM (Customer Identity and Access Management). Identity for your external customers signing into a product you run, a different problem from workforce identity.

endpoints and devices

The laptops, phones, and servers people work on.

EPP (Endpoint Protection Platform). Modern antivirus that blocks known malware on a device.

EDR (Endpoint Detection and Response). Goes further than EPP, watching device behavior for attacks and letting you respond.

XDR (Extended Detection and Response). EDR stretched across devices, identity, and more, correlating signals from several places.

AV (Antivirus). The original signature-based malware blocker, now usually part of EPP.

MDM and UEM (Mobile Device Management; Unified Endpoint Management). Tools to configure, secure, and if needed wipe company devices.

network

The connections between your systems and the outside world.

NGFW (Next-Generation Firewall). A firewall that inspects traffic more deeply than the old port-and-protocol kind.

VPN (Virtual Private Network). The old way to give remote staff access by putting them on the network. Increasingly replaced by ZTNA.

ZTNA (Zero Trust Network Access). Granting access to specific applications based on identity and device, without putting anyone on the network. The modern VPN replacement.

SWG (Secure Web Gateway). Filters web traffic, blocking malicious or disallowed sites.

IDS and IPS (Intrusion Detection System; Intrusion Prevention System). Watch network traffic for attacks, and in the case of IPS, block them.

FWaaS (Firewall-as-a-Service). Firewall capability delivered from the cloud instead of a box in your office.

SSE (Security Service Edge). A cloud-delivered bundle of ZTNA, SWG, and CASB.

SASE (Secure Access Service Edge). SSE plus the networking layer, converging security and your wide-area network.

SD-WAN (Software-Defined Wide Area Network). The networking side of SASE, managing connectivity across sites intelligently.

email and people

The front door for most attacks, and the people who open it.

SEG (Secure Email Gateway). Filters incoming email for phishing, malware, and fraud.

BEC (Business Email Compromise). A scam where an attacker poses as an executive or supplier to trick someone into a payment or data handover.

SPF, DKIM, and DMARC (Sender Policy Framework; DomainKeys Identified Mail; Domain-based Message Authentication, Reporting and Conformance). Email-authentication standards that help stop others from spoofing your domain.

data

The thing you are ultimately protecting.

DLP (Data Loss Prevention). Stops sensitive data leaving through email, the browser, AI tools, and other channels.

DSPM (Data Security Posture Management). Finds where your sensitive data lives across cloud and SaaS and how exposed it is.

PII (Personally Identifiable Information). Data that identifies a person, the kind you are legally responsible for protecting.

applications

The software you build or run.

AppSec (Application Security). The broad practice of securing the software you build.

SAST and DAST (Static and Dynamic Application Security Testing). Testing code for flaws, either by reading it (static) or by attacking the running app (dynamic).

SCA (Software Composition Analysis). Checking the open-source components your software depends on for known vulnerabilities.

WAF (Web Application Firewall). Filters attacks aimed at your web applications.

API (Application Programming Interface). The connections that let systems talk to each other; securing them is its own discipline now.

SBOM (Software Bill of Materials). A list of the components and dependencies inside a piece of software.

CI/CD (Continuous Integration / Continuous Delivery). The automated pipeline that builds and ships software, a sensitive target because it often holds broad access.

saas

The cloud applications your teams actually run.

SaaS (Software as a Service). Software you subscribe to and access over the web rather than install.

SMP (SaaS Management Platform). Discovers the apps in use and manages licenses and spend.

SSPM (SaaS Security Posture Management). Finds risky settings and connected-app risk inside your major SaaS.

CASB (Cloud Access Security Broker). Sits between users and cloud apps to give visibility and control over usage.

cloud infrastructure

The security of workloads you run in a public cloud.

IaaS and PaaS (Infrastructure and Platform as a Service). Cloud service models, where you rent infrastructure or a platform rather than buy hardware.

CSPM (Cloud Security Posture Management). Finds misconfigurations in your cloud setup, like an exposed storage bucket.

CWPP (Cloud Workload Protection Platform). Secures the workloads running in your cloud.

CIEM (Cloud Infrastructure Entitlement Management). Manages who and what has permissions in the cloud, including machine identities.

CNAPP (Cloud-Native Application Protection Platform). A bundle of CSPM, CWPP, and CIEM in one platform.

ai

The newest territory.

LLM (Large Language Model). The kind of AI behind tools like ChatGPT and Claude.

BYOAI (Bring Your Own AI). Employees using personal or unsanctioned AI tools for work, the most common form of shadow AI.

AI-SPM (AI Security Posture Management). Finds and assesses the risk in your AI integrations and the access they hold.

detection and response

Owning protective tools is not the same as watching for attacks. This cross-cutting layer is where mid-market stacks most often fall short.

SIEM (Security Information and Event Management). Collects and correlates logs from across your stack to spot attacks.

SOC (Security Operations Center). The team, in-house or outsourced, that watches for and responds to threats.

MDR (Managed Detection and Response). The watching and responding bought as a managed service, common for companies without their own team.

MSSP (Managed Security Service Provider). A company that runs security services for you, from monitoring to management.

SOAR (Security Orchestration, Automation and Response). Automates parts of the response to security alerts.

UEBA (User and Entity Behavior Analytics). Spots threats by noticing when people or systems behave abnormally.

IoC (Indicator of Compromise). A piece of evidence, like a suspicious file or address, that suggests a breach.

TTP (Tactics, Techniques, and Procedures). The recognizable patterns of how an attacker operates.

governance, risk, and compliance

The deciding layer, where you set your approach and prove it.

GRC (Governance, Risk, and Compliance). The discipline and tooling for managing all three together.

NIST CSF (National Institute of Standards and Technology Cybersecurity Framework). A widely used framework that sorts security into six functions: Govern, Identify, Protect, Detect, Respond, Recover.

CIS Controls (Center for Internet Security Controls). A prioritized, practical list of security actions, useful for smaller teams.

ISO 27001. An international standard for an information security management system, often required by enterprise customers.

SOC 2. A widely requested attestation, mainly in North America, that you handle customer data securely.

NIS2 (Network and Information Security Directive 2). The EU directive setting security and reporting obligations across many sectors.

DORA (Digital Operational Resilience Act). The EU regulation for financial entities and their critical ICT providers.

GDPR (General Data Protection Regulation). The EU's data-protection law.

EU AI Act. The EU regulation governing the use of AI by risk tier.

DPIA and FRIA (Data Protection and Fundamental Rights Impact Assessment). Structured assessments required in certain cases under the GDPR and the AI Act.

TPRM (Third-Party Risk Management). Assessing and managing the risk that comes from your vendors and suppliers.

VSQ (Vendor Security Questionnaire). The security questionnaire a customer sends you before buying, or that you send your own suppliers.

resilience and recovery

What happens after something goes wrong.

BCP (Business Continuity Plan). The plan for keeping the business running through a disruption.

DR (Disaster Recovery). The plan and tooling for restoring systems and data after a major incident.

RTO and RPO (Recovery Time Objective; Recovery Point Objective). How fast you need to be back up, and how much data you can afford to lose.

IR (Incident Response). The plan and process for handling a security incident when it happens.

threats and attacks

The terms you will meet on the other side of the fight.

APT (Advanced Persistent Threat). A skilled, well-resourced attacker, often state-backed, that gets in and stays quietly.

AitM and MitM (Adversary-in-the-Middle; Man-in-the-Middle). An attack that sits between a user and a real service, relaying the session to steal it, the technique that defeats older MFA.

C2 (Command and Control). The infrastructure an attacker uses to control compromised systems.

Ransomware. Malware that encrypts your data and demands payment, often delivered through a stolen credential or a phished employee.

Phishing. Tricking someone into handing over credentials or money through a fake message, still the most common way attackers get in.