SECURITY GLOSSARY
Clear definitions for modern security validation .
Terminology across continuous security validation, exposure management, control assurance, detection validation, runtime risk, attack paths, evidence, and AI security.
FEATURED TERMS
Three definitions using our entry template.
Every glossary term follows the same structure.
TERM
Evidence Contract
A structured specification of what artifacts and observations must be collected for a validation outcome to be considered proven.
WHY IT MATTERS
A finding without a matching evidence contract is not audit-ready. Contracts ensure every confirmed result is supported by the same artifacts across teams and runs.
HOW IT DIFFERS
Different from an evidence artifact (a single collected item) or evidence chain (the full linked history).
TERM
Attack Path
A validated sequence of conditions — exposure, identity, workload, control, and reachability — that connects an entry point to a business-critical asset.
WHY IT MATTERS
It converts scanner findings into a graph of reachable impact. Prioritization becomes reachability-driven, not just severity-driven.
HOW IT DIFFERS
Different from Attack Graph (the full set of validated relationships) and MITRE ATT&CK (a technique taxonomy).
TERM
Prompt Injection
A class of attacks in which untrusted input alters an AI system’s behavior, bypassing intended guardrails or tool constraints.
WHY IT MATTERS
LLM-backed applications, agents, and RAG systems increasingly reach sensitive data and privileged tools. Validation must include prompt-boundary and tool-abuse scenarios.
HOW IT DIFFERS
Different from jailbreaking (bypassing model policies) — prompt injection can occur even when the model itself is compliant.
TERM GROUPS
Six domains, dozens of terms.
CORE10 TERMS
Core Validation
Continuous Security ValidationGoverned Continuous Security ValidationExposure ValidationControl ValidationDetection ValidationRuntime Presence ValidationReachability AnalysisAttack Path SimulationAutonomous Penetration TestingRevalidation
EVIDENCE9 TERMS
Evidence
Evidence ArtifactEvidence ChainEvidence ContractEvidence PackageFinding EvidenceControl EvidenceDetection EvidenceRuntime EvidenceAudit-Ready Evidence
ATTACK8 TERMS
Attack Intelligence
Attack PathAttack GraphCrown JewelToxic CombinationBlast RadiusChoke PointBusiness ImpactIdentity Path
SECOPS7 TERMS
Security Operations
Detection CoverageTelemetry ReadinessDetection GapControl FailureControl DriftAlert LatencyCompensating Control
RUNTIME6 TERMS
Software & Runtime
Software Composition AnalysisSoftware Bill of MaterialsRuntime DependencyDependency ReachabilitySupply Chain RiskBring Your Own Scanner
AI7 TERMS
AI Security
Prompt InjectionAgent Tool AbuseRetrieval-Augmented GenerationRAG Data LeakageAI GuardrailModel Access ControlAI Attack Path
A-Z INDEX
Every term, alphabetically.
Click any term to jump to its full entry.
Attack Graph
AThe complete validated relationship model between assets, identities, controls, and impact.
Attack Path
AA validated chain from exposure to impact.
Alert Latency
ATime from behavior to actionable detection.
Blast Radius
BThe scope of impact if a condition is exploited.
Business Impact
BThe organizational consequence of reaching an asset.
Choke Point
CA node whose remediation breaks many paths at once.
Control Drift
CMeasured change in a control’s behavior over time.
Continuous Security Validation
COngoing testing of exposure, controls, detections, and reachability.
Detection Coverage
DShare of expected behaviors producing actionable alerts.
Detection Gap
DA behavior with no expected or actual detection.
Evidence Chain
EThe linked history of artifacts supporting a finding.
Evidence Contract
EThe required artifact specification for a validated result.
Governed Validation
GValidation executed under scope, policy, safety, and approval controls.
Identity Path
IA sequence of identity transitions used in an attack chain.
Prompt Injection
PAdversarial input that alters AI system behavior.
Reachability
RWhether a condition can be exercised from an entry point.
Revalidation
RRe-execution of a scenario after remediation.
Scenario
SA named, safe, and evidence-carrying validation procedure.
Toxic Combination
TIndividually low-risk conditions that combine to critical impact.
Telemetry Readiness
TWhether required data sources produce needed events on time.
Validated Finding
VA finding backed by an evidence contract.
Validation Objective
VThe security outcome an assessment aims to prove.
COMPANION READING
Handbooks that use this vocabulary in production.
Vocabulary of Modern Security
Field-tested definitions
The Evidence Contract Book
Templates & examples
Attack Paths in Plain English
A leader’s primer
AI Security Terminology
From prompts to agents
Speak the language of evidence-driven validation.
The Hayrok glossary is vendor-neutral where possible and product-aware where it matters.