The words, without the fog.
Terms that come up in our writing and in buying conversations, defined as plainly as we can. Where a term touches what we build, there is one link to the place we show it.
- Air-gapped network
A network deliberately kept off the internet and off other networks. Updates and evidence cross the gap as files a person carries, so anything that has to call home does not work there.
- Alert fatigue
What happens when a tool reports more than anyone can read, so people stop reading it. The cost is not the noise itself; it is the one real finding that scrolls past with it.
- Audit trail
A record of who did what and when. It is worth something only if a later change to the record can be detected, which is why entries are chained or signed rather than simply stored.
- Baseline
The recorded state of a system at a chosen moment, kept so that later states can be compared against it. Taking one after a planned change is what keeps the next comparison meaningful.
- Coordinated vulnerability disclosure
Reporting a flaw to whoever can fix it, agreeing a period in which it gets fixed, and publishing afterwards. A security.txt file at a known address is how a reporter finds where to send it.
- CVE
A public identifier for one specific vulnerability, in the form CVE-2026-1234. It exists so that two parties can be certain they are discussing the same flaw.
SeeAdvisories
- Event tree
The chain behind a change: the user who signed in, the processes in between with their command lines, and the change at the end. It answers who and how, not only what.
- File integrity monitoring
Watching files for change and reporting what changed. On its own it reports change; the harder questions are whether the file is the original and whether the change was expected.
- Fileless attack
An attack that runs code without leaving an executable file on disk, for example straight from memory. A check that only reads files on disk does not see it.
- Hash
A short fingerprint computed from the content of a file. Two files with the same hash hold the same content, so a hash is a cheap way to ask whether something is exactly what it was.
- Inventory
The list of what is installed where: packages, versions and files across every machine. Which servers run this version is an inventory question before it is a security question.
- Legitimacy
Whether a file is the original, published by whoever is meant to have published it. This is a different question from whether the file changed: something that never changes can still not be the original.
- Living off the land
Using what is already installed and already trusted on a machine, such as a shell or an administration utility, so that the activity reads as ordinary work.
- Penetration test
A scoped, time-boxed attempt to break into a defined target, written up with the steps taken and what they produced. The scope and the report are what separate it from an open-ended exercise.
- Red team
An exercise run against an objective rather than a list of targets, and measured by what the defenders detect and how they respond. It answers how far someone gets before anyone notices.
- Reverse engineering
Working out what a binary does without its source: reading the code, watching the behaviour, naming the parts. It is how a sample becomes an explanation someone else can act on.
- Rootkit
Software that hides its own presence, for example by intercepting the calls that would list processes or files. It hides from the same system you would use to ask the question.
- Software supply chain
Everything a piece of software passes through before it runs: the source, the build, the package, the mirror it is fetched from. A compromise anywhere along that path arrives looking like a normal install.
- Zero trust
An approach that stops treating a position on the network as proof of trust and asks for evidence at each step instead. Applied to files, the question becomes whether this binary is the original, not whether it came from inside.
No term matches that.
See these terms in the product.
A 30-minute walkthrough on a fleet like yours shows where each one turns up: in an alert, a report and an audit bundle.
Book a demo