SOC provider glossary
Plain definitions for the terms buyers see when comparing SOC, MDR, MSSP, SIEM, XDR and response services.
Service models
A Security Operations Center is a centralized facility or team responsible for monitoring, detecting, analyzing,...
MSSP Managed Security Service ProviderA Managed Security Service Provider is a third-party company that provides outsourced monitoring and management of...
MDR Managed Detection and ResponseManaged Detection and Response is a cybersecurity service that combines technology and human expertise to perform...
SOCaaS SOC as a ServiceSOC as a Service is a subscription-based model where a third-party provider delivers full security operations...
Managed SIEMManaged SIEM is a service where a third-party provider deploys, manages, and monitors a SIEM platform on behalf of...
MEDR Managed EDRManaged EDR is a managed service that provides outsourced monitoring, investigation, and response for an...
XDR Extended Detection and ResponseExtended Detection and Response is a security approach that collects and correlates data across multiple security...
vCISO Virtual Chief Information Security OfficerA Virtual Chief Information Security Officer is an outsourced security executive who provides strategic security...
Detection and response
SIEM is a security solution that aggregates and analyzes log data from across an organization's IT infrastructure...
SOAR Security Orchestration, Automation, and ResponseSOAR refers to technologies that enable organizations to collect security threat data, automate responses to...
EDR Endpoint Detection and ResponseEndpoint Detection and Response is a cybersecurity technology that continuously monitors end-user devices to...
NDR Network Detection and ResponseNetwork Detection and Response is a security solution that monitors network traffic in real time, using behavioral...
IR Incident ResponseIncident Response is the organized approach to addressing and managing the aftermath of a security breach or...
DFIR Digital Forensics and Incident ResponseDigital Forensics and Incident Response combines the disciplines of investigating cyberattacks to determine what...
Threat HuntingThreat hunting is the proactive practice of searching through networks and systems to detect and isolate advanced...
Detection EngineeringDetection engineering is the practice of designing, building, testing, and maintaining threat detection rules and...
False PositiveA false positive is a security alert that incorrectly indicates a threat or malicious activity when none actually...
MTTD Mean Time to DetectMean Time to Detect is a key SOC performance metric that measures the average time elapsed between the onset of a...
MTTR Mean Time to RespondMean Time to Respond is a key SOC performance metric that measures the average time from when a security threat is...
UEBA User and Entity Behavior AnalyticsUser and Entity Behavior Analytics uses machine learning and statistical analysis to establish baseline behavior...
Cloud, identity and data
Cloud Security Posture Management is a category of security tools that continuously monitor cloud infrastructure...
CNAPP Cloud-Native Application Protection PlatformA Cloud-Native Application Protection Platform is a unified security solution that combines cloud security posture...
CWPP Cloud Workload Protection PlatformA Cloud Workload Protection Platform is a security solution designed to protect workloads — including virtual...
IAM Identity and Access ManagementIdentity and Access Management is the framework of policies and technologies that ensures the right individuals...
PAM Privileged Access ManagementPrivileged Access Management is a security discipline that controls and monitors access for accounts with elevated...
ITDR Identity Threat Detection and ResponseIdentity Threat Detection and Response detects and responds to identity-based attacks like credential theft,...
Zero TrustZero Trust is a security framework that requires all users and devices — whether inside or outside the network...
DLP Data Loss PreventionData Loss Prevention encompasses the strategies, tools, and processes used to prevent sensitive data from being...
EndpointAn endpoint is any device that connects to a network and can serve as an entry point for threats, including...
Attack SurfaceThe attack surface is the total sum of all points — including software, hardware, network endpoints, APIs, cloud...
Security program terms
Threat intelligence is evidence-based knowledge about existing or emerging cyber threats, including context,...
ATT&CK MITRE ATT&CKMITRE ATT&CK is a globally recognized knowledge base and framework of adversary tactics, techniques, and...
Vulnerability ManagementVulnerability management is the continuous process of identifying, evaluating, prioritizing, and remediating...
Penetration TestingPenetration testing is an authorized simulated cyberattack performed against an organization's systems to evaluate...
Red TeamA red team is a group of security professionals who simulate real-world adversary tactics, techniques, and...
Blue TeamA blue team is the defensive security team responsible for maintaining an organization's security posture,...
Purple TeamA purple team is a collaborative security exercise or function where red team (offensive) and blue team...
Security PostureSecurity posture refers to the overall strength and effectiveness of an organization's cybersecurity defenses,...
Compliance FrameworkA compliance framework is a structured set of guidelines, standards, and best practices — such as SOC 2, HIPAA,...
Cyber InsuranceCyber insurance is a specialized insurance product that helps organizations mitigate the financial impact of cyber...
Log ManagementLog management is the practice of collecting, storing, normalizing, and analyzing log data generated by systems,...
Breach WarrantyA breach warranty is a financial guarantee offered by some MDR providers that pays out a specified amount...
Threat LandscapeThe threat landscape is the full scope of current and emerging cyber threats facing an organization or industry,...