The cybersecurity glossary and compliance glossary
From DNS to the ISO 27001 standard, including phishing and RGPD : more than 120 cybersecurity and compliance terms, explained simply and linked to the site pages where we develop them further.
Active Directory (security)
The Microsoft directory service that centralizes identities and access rights on an enterprise network, a prime target for attackers.
Learn more →AI Act
The European regulation governing the development and use of artificial intelligence systems according to their risk level.
Learn more →AIPD / DPIA
The data protection impact assessment, mandatory for high-risk GDPR processing operations.
Learn more →ANSSI
The French national authority for the security and defense of information systems.
Learn more →APT (Advanced Persistent Threat)
A targeted, stealthy, and prolonged attack, often carried out by an organized group.
Learn more →Man-in-the-middle attack (MITM)
An attack in which a third party intercepts, and sometimes modifies, exchanges between two parties without their knowledge.
Learn more →Supply chain attack
An attack that compromises a supplier or software dependency to indirectly reach its final target.
Learn more →Brute-force attack
A method that systematically tests combinations to guess a password or key.
Learn more →Audit services
A structured assessment of an organization's security, compliance, or processes against a given framework.
Learn more →Internal audit
The periodic assessment, carried out by the organization itself, of its ISMS compliance with its security framework.
Learn more →ISO 27001 auditor (role)
The professional who verifies, during an audit, an ISMS's compliance with the requirements of the ISO 27001 standard.
Learn more →Security audits
Technical assessments (penetration testing, configuration review, etc.) that measure the real exposure of an information system.
Learn more →Multi-factor authentication (MFA)
Authentication that combines at least two factors (password, code, application, physical key) to validate an identity.
Learn more →Botnet
A network of compromised machines, remotely controlled by an attacker without their owners' knowledge.
Learn more →Bug bounty
A program that rewards security researchers for identifying and responsibly reporting vulnerabilities.
Learn more →BYOD (Bring Your Own Device)
The use of personal devices (phone, computer) to access professional resources.
Learn more →Phishing campaign (simulation)
A simulated phishing exercise conducted with employees to assess and strengthen their vigilance.
Learn more →SSL/TLS certificate
A digital file that authenticates a website and enables encrypted exchanges with its visitors.
Learn more →Trojan horse (Trojan)
Malicious software hidden inside software that appears legitimate.
Learn more →Encryption
A technique that makes data unreadable without the appropriate decryption key.
Learn more →CISO Assistant
An open-source tool for managing governance, risk, and compliance (GRC).
Learn more →Clickjacking
A technique that tricks the user into clicking an invisible element overlaid on a legitimate page.
Learn more →Content Security Policy (CSP)
An HTTP header that defines the content sources allowed on a page, limiting the impact of an XSS vulnerability.
Learn more →Broken access control
A vulnerability where a user accesses resources or functions that should be forbidden to them.
Learn more →Cookies & consent
The GDPR/ePrivacy framework that governs cookie placement and requires the user's prior consent.
Learn more →CRA (Cyber Resilience Act)
The European regulation that imposes cybersecurity requirements on digital products throughout their life cycle.
Learn more →Credential stuffing
An attack that reuses stolen credentials at scale on one service to try to access other services.
Learn more →Cryptojacking
The covert hijacking of computing resources to mine cryptocurrencies without the victim's knowledge.
Learn more →CSRF (request forgery)
A vulnerability that forces an authenticated victim's browser to perform an unwanted action on another site.
Learn more →CVE (Common Vulnerabilities and Exposures)
A unique identifier assigned to a publicly known and referenced security vulnerability.
Learn more →Data centers (security)
The standards and regulations governing the physical and logical security of data hosting centers.
Learn more →Deepfake
Audio, image, or video content generated by artificial intelligence that appears realistic but is falsified.
Learn more →Defense in depth
A security principle that layers several independent protection mechanisms.
Learn more →Insecure deserialization
A vulnerability that occurs when an application rebuilds an object from untrusted data without appropriate validation.
Learn more →DevSecOps
An approach that integrates security from the earliest stages of software development and throughout the life cycle.
Learn more →Cybersecurity assessment
A quick, comprehensive assessment of an organization's cybersecurity maturity level.
Learn more →DNS (Domain Name System)
The system that translates domain names into IP addresses, and its security challenges.
Learn more →DORA
The European regulation on digital operational resilience in the financial sector.
Learn more →DPO (role)
The Data Protection Officer, responsible for ensuring GDPR compliance within an organization.
Learn more →Data subject rights (GDPR)
All rights (access, rectification, erasure, portability, etc.) guaranteed by the GDPR to data subjects.
Learn more →Part-time CIO
An outsourced Chief Information Officer shared by several companies that do not need a full-time position.
Learn more →EBIOS Risk Manager
The cyber risk analysis method promoted by ANSSI, structured into five successive workshops.
Learn more →EDR / XDR
Tools that continuously monitor workstations and servers to detect and respond to malicious activity.
Learn more →Exploit
Code or a method that takes advantage of a vulnerability to obtain behavior not intended by the system.
Learn more →Zero-day vulnerability (0-day)
A vulnerability unknown to the software vendor, exploitable before a patch exists.
Learn more →Forensics (digital investigation)
The discipline that reconstructs the course of a security incident from digital traces left on systems.
Learn more →Cyber crisis management
The organization and procedures mobilized to steer a company during and after a major cyber incident.
Learn more →Cyber risk management (ISO 27005)
The process of identifying, assessing, and treating risks related to information security.
Learn more →GRC (Governance, Risk, Compliance)
The approach that jointly structures an organization's governance, risk management, and regulatory compliance.
Learn more →Hashing
A mathematical function that transforms data into a unique, non-reversible fingerprint.
Learn more →HDS (Health Data Hosting provider)
The mandatory certification for any provider hosting personal health data in France.
Learn more →Honeypot
A deliberately vulnerable system designed to attract an attacker and observe their methods.
Learn more →Host header attack
An attack that exploits a poorly validated HTTP Host header to hijack a web application's behavior.
Learn more →IAM (Identity and Access Management)
The processes and tools that manage the creation, permissions, and removal of user access rights.
Learn more →IDS / IPS
Systems that detect (IDS) or actively block (IPS) suspicious network traffic.
Learn more →Local file inclusion (LFI)
A vulnerability that allows a server file not intended by the application to be included and executed.
Learn more →Social engineering
The set of psychological manipulation techniques aimed at obtaining an action or sensitive information from a victim.
Learn more →Command injection
A vulnerability that allows an attacker to execute arbitrary system commands through a vulnerable application.
Learn more →Injection NoSQL
An injection that targets NoSQL databases, based on the same principle as SQL injection.
Learn more →Injection SQL (SQLi)
A vulnerability that allows malicious SQL code to be inserted into a query to manipulate a database.
Learn more →Blind SQL injection (Blind SQLi)
A variant of SQL injection where the attacker infers information without direct feedback displayed by the application.
Learn more →ISO/IEC 27001
The leading international standard for information security management (ISMS).
Learn more →ISO/IEC 27002
The standard that details the security controls associated with ISO 27001.
Learn more →Malware
A generic term for any software designed to harm a system or exploit its resources.
Learn more →NIS2
The European directive that strengthens cybersecurity requirements for a broad scope of essential and important entities.
Learn more →OWASP Top 10
The benchmark ranking of the ten most critical web vulnerability categories, published by the OWASP Foundation.
Learn more →Firewall
A device that filters incoming and outgoing network traffic according to defined security rules.
Learn more →Web application firewall (WAF)
A device that filters and blocks malicious requests aimed at a web application.
Learn more →Patch management
The process of identifying, testing, and deploying security patches on an information system.
Learn more →PCA / PRA
The business continuity plan and disaster recovery plan, which organize the continuation or resumption of activities after a disaster.
Learn more →Pentest (penetration test)
An authorized attack simulation designed to identify exploitable vulnerabilities in a system before a real attacker does.
Learn more →Phishing
A fraudulent technique designed to deceive a victim into revealing sensitive information or performing a harmful action.
Learn more →Security policy (PSSI)
The reference document that formalizes an organization's information security rules and principles.
Learn more →Principle of least privilege
A security principle that limits each user or system to only the rights strictly necessary for their function.
Learn more →Privacy by design
The principle that integrates personal data protection from the design stage of a product or service.
Learn more →Pseudonymisation
A technique that replaces identifying data with an indirect identifier, reducing risk in the event of a leak.
Learn more →Qualiopi
The mandatory quality certification for training organizations wishing to access public and pooled funding.
Learn more →Ransomware
Malware that encrypts a victim's data and demands a ransom to restore access.
Learn more →Red Team / TIBER-EU
A realistic and prolonged attack simulation that tests an organization's detection and response capabilities.
Learn more →Record of processing activities
The GDPR document that lists all personal data processing activities carried out by an organization.
Learn more →Incident response
All coordinated actions implemented to contain, investigate, and resolve a security incident.
Learn more →Rootkit
A set of tools designed to hide an attacker's presence on a compromised system.
Learn more →RSSI / CISO (role)
The Chief Information Security Officer, responsible for cybersecurity strategy and management — RSSI RSSI in French, CISO in English.
Learn more →RTO / RPO
Two indicators that define the acceptable recovery time and tolerable data loss after an incident.
Learn more →Sandbox
An isolated environment that allows a program to be run or a suspicious file to be opened without risk to the real system.
Learn more →SecNumCloud
The security qualification issued by ANSSI for cloud service providers operating in France.
Learn more →Application security
All practices aimed at securing an application throughout its development life cycle.
Learn more →API security
The protection of programming interfaces, access points increasingly targeted by attackers.
Learn more →Container & Kubernetes security
Practices that secure containerized environments and their orchestration.
Learn more →Website & CMS security
Security practices specific to websites and content management systems (CMS).
Learn more →Cloud security
All practices that adapt traditional security to the specific characteristics of cloud environments.
Learn more →Shadow IT
All digital tools and services used within an organization without validation from the IT department.
Learn more →SIEM (Security Information and Event Management)
A platform that centralizes and correlates security logs to detect incidents.
Learn more →SIM swapping
A fraud technique that consists of fraudulently transferring a victim's phone number to a SIM card controlled by the attacker.
Learn more →SMSI
The information security management system, an organizational framework structured by the ISO 27001 standard.
Learn more →SOC (Security Operations Center)
The team and setup that continuously monitor the security of an information system.
Learn more →SOC 2
A U.S. audit report that assesses a service provider's security controls according to the criteria Trust Services.
Learn more →Spoofing
A technique consisting of falsifying an address or identity to deceive a system or victim.
Learn more →SSO (Single Sign-On)
A single authentication mechanism that allows access to multiple applications with one login.
Learn more →SSRF (Server-Side Request Forgery)
A vulnerability that forces a server to make requests, without its knowledge, to unintended internal or external resources.
Learn more →SSTI (template injection)
An injection that exploits a server-side template engine to execute arbitrary code.
Learn more →Secure password storage
Best practices (hashing, salting, dedicated algorithms) for storing passwords without exposing them in clear text.
Learn more →Cybersecurity grants & subsidies
Public funding schemes that can be used to support a compliance or security improvement project.
Learn more →Attack surface
All exposed points of a system that are potentially exploitable by an attacker.
Learn more →File upload (security)
The precautions to apply to prevent a file uploaded to an application from becoming an attack vector.
Learn more →Threat Intelligence
The collection and analysis of information on active threats to anticipate them and defend more effectively.
Learn more →Data transfers outside the EU
The GDPR framework governing transfers of personal data to countries outside the European Union.
Learn more →Typosquatting
A technique consisting of registering a domain name close to a brand in order to trap internet users.
Learn more →Computer worm (Worm)
Malware capable of spreading automatically from one system to another.
Learn more →Personal data breach (Data Breach)
A security incident resulting in the destruction, loss, alteration, or unauthorized disclosure of personal data.
Learn more →Account takeover
The unauthorized takeover of a user account, often using compromised credentials.
Learn more →VPN (Virtual Private Network)
An encrypted tunnel that connects a user to a remote network over the Internet.
Learn more →XSS (Cross-Site Scripting)
A vulnerability that allows code, often JavaScript, to be injected and executed in other users' browsers.
Learn more →Zero Trust
A security model that trusts no access by default and systematically verifies every identity and every request.
Learn more →Not ready to talk yet? Discover our cybersecurity assessment →
Still unsure about a term? Let's talk 🚀
Our team is here to clarify a technical or regulatory point and help you move from definition to action.
The cybersecurity glossary and compliance glossary
From DNS to the ISO 27001 standard, including phishing and RGPD : more than 120 cybersecurity and compliance terms, explained simply and linked to the site pages where we develop them further.
Active Directory (security)
The Microsoft directory service that centralizes identities and access rights on an enterprise network, a prime target for attackers.
Learn more →AI Act
The European regulation governing the development and use of artificial intelligence systems according to their risk level.
Learn more →AIPD / DPIA
The data protection impact assessment, mandatory for high-risk GDPR processing operations.
Learn more →ANSSI
The French national authority for the security and defense of information systems.
Learn more →APT (Advanced Persistent Threat)
A targeted, stealthy, and prolonged attack, often carried out by an organized group.
Learn more →Man-in-the-middle attack (MITM)
An attack in which a third party intercepts, and sometimes modifies, exchanges between two parties without their knowledge.
Learn more →Supply chain attack
An attack that compromises a supplier or software dependency to indirectly reach its final target.
Learn more →Brute-force attack
A method that systematically tests combinations to guess a password or key.
Learn more →Audit services
A structured assessment of an organization's security, compliance, or processes against a given framework.
Learn more →Internal audit
The periodic assessment, carried out by the organization itself, of its ISMS compliance with its security framework.
Learn more →ISO 27001 auditor (role)
The professional who verifies, during an audit, an ISMS's compliance with the requirements of the ISO 27001 standard.
Learn more →Security audits
Technical assessments (penetration testing, configuration review, etc.) that measure the real exposure of an information system.
Learn more →Multi-factor authentication (MFA)
Authentication that combines at least two factors (password, code, application, physical key) to validate an identity.
Learn more →Botnet
A network of compromised machines, remotely controlled by an attacker without their owners' knowledge.
Learn more →Bug bounty
A program that rewards security researchers for identifying and responsibly reporting vulnerabilities.
Learn more →BYOD (Bring Your Own Device)
The use of personal devices (phone, computer) to access professional resources.
Learn more →Phishing campaign (simulation)
A simulated phishing exercise conducted with employees to assess and strengthen their vigilance.
Learn more →SSL/TLS certificate
A digital file that authenticates a website and enables encrypted exchanges with its visitors.
Learn more →Trojan horse (Trojan)
Malicious software hidden inside software that appears legitimate.
Learn more →Encryption
A technique that makes data unreadable without the appropriate decryption key.
Learn more →CISO Assistant
An open-source tool for managing governance, risk, and compliance (GRC).
Learn more →Clickjacking
A technique that tricks the user into clicking an invisible element overlaid on a legitimate page.
Learn more →Content Security Policy (CSP)
An HTTP header that defines the content sources allowed on a page, limiting the impact of an XSS vulnerability.
Learn more →Broken access control
A vulnerability where a user accesses resources or functions that should be forbidden to them.
Learn more →Cookies & consent
The GDPR/ePrivacy framework that governs cookie placement and requires the user's prior consent.
Learn more →CRA (Cyber Resilience Act)
The European regulation that imposes cybersecurity requirements on digital products throughout their life cycle.
Learn more →Credential stuffing
An attack that reuses stolen credentials at scale on one service to try to access other services.
Learn more →Cryptojacking
The covert hijacking of computing resources to mine cryptocurrencies without the victim's knowledge.
Learn more →CSRF (request forgery)
A vulnerability that forces an authenticated victim's browser to perform an unwanted action on another site.
Learn more →CVE (Common Vulnerabilities and Exposures)
A unique identifier assigned to a publicly known and referenced security vulnerability.
Learn more →Data centers (security)
The standards and regulations governing the physical and logical security of data hosting centers.
Learn more →Deepfake
Audio, image, or video content generated by artificial intelligence that appears realistic but is falsified.
Learn more →Defense in depth
A security principle that layers several independent protection mechanisms.
Learn more →Insecure deserialization
A vulnerability that occurs when an application rebuilds an object from untrusted data without appropriate validation.
Learn more →DevSecOps
An approach that integrates security from the earliest stages of software development and throughout the life cycle.
Learn more →Cybersecurity assessment
A quick, comprehensive assessment of an organization's cybersecurity maturity level.
Learn more →DNS (Domain Name System)
The system that translates domain names into IP addresses, and its security challenges.
Learn more →DORA
The European regulation on digital operational resilience in the financial sector.
Learn more →DPO (role)
The Data Protection Officer, responsible for ensuring GDPR compliance within an organization.
Learn more →Data subject rights (GDPR)
All rights (access, rectification, erasure, portability, etc.) guaranteed by the GDPR to data subjects.
Learn more →Part-time CIO
An outsourced Chief Information Officer shared by several companies that do not need a full-time position.
Learn more →EBIOS Risk Manager
The cyber risk analysis method promoted by ANSSI, structured into five successive workshops.
Learn more →EDR / XDR
Tools that continuously monitor workstations and servers to detect and respond to malicious activity.
Learn more →Exploit
Code or a method that takes advantage of a vulnerability to obtain behavior not intended by the system.
Learn more →Zero-day vulnerability (0-day)
A vulnerability unknown to the software vendor, exploitable before a patch exists.
Learn more →Forensics (digital investigation)
The discipline that reconstructs the course of a security incident from digital traces left on systems.
Learn more →Cyber crisis management
The organization and procedures mobilized to steer a company during and after a major cyber incident.
Learn more →Cyber risk management (ISO 27005)
The process of identifying, assessing, and treating risks related to information security.
Learn more →GRC (Governance, Risk, Compliance)
The approach that jointly structures an organization's governance, risk management, and regulatory compliance.
Learn more →Hashing
A mathematical function that transforms data into a unique, non-reversible fingerprint.
Learn more →HDS (Health Data Hosting provider)
The mandatory certification for any provider hosting personal health data in France.
Learn more →Honeypot
A deliberately vulnerable system designed to attract an attacker and observe their methods.
Learn more →Host header attack
An attack that exploits a poorly validated HTTP Host header to hijack a web application's behavior.
Learn more →IAM (Identity and Access Management)
The processes and tools that manage the creation, permissions, and removal of user access rights.
Learn more →IDS / IPS
Systems that detect (IDS) or actively block (IPS) suspicious network traffic.
Learn more →Local file inclusion (LFI)
A vulnerability that allows a server file not intended by the application to be included and executed.
Learn more →Social engineering
The set of psychological manipulation techniques aimed at obtaining an action or sensitive information from a victim.
Learn more →Command injection
A vulnerability that allows an attacker to execute arbitrary system commands through a vulnerable application.
Learn more →Injection NoSQL
An injection that targets NoSQL databases, based on the same principle as SQL injection.
Learn more →Injection SQL (SQLi)
A vulnerability that allows malicious SQL code to be inserted into a query to manipulate a database.
Learn more →Blind SQL injection (Blind SQLi)
A variant of SQL injection where the attacker infers information without direct feedback displayed by the application.
Learn more →ISO/IEC 27001
The leading international standard for information security management (ISMS).
Learn more →ISO/IEC 27002
The standard that details the security controls associated with ISO 27001.
Learn more →Malware
A generic term for any software designed to harm a system or exploit its resources.
Learn more →NIS2
The European directive that strengthens cybersecurity requirements for a broad scope of essential and important entities.
Learn more →OWASP Top 10
The benchmark ranking of the ten most critical web vulnerability categories, published by the OWASP Foundation.
Learn more →Firewall
A device that filters incoming and outgoing network traffic according to defined security rules.
Learn more →Web application firewall (WAF)
A device that filters and blocks malicious requests aimed at a web application.
Learn more →Patch management
The process of identifying, testing, and deploying security patches on an information system.
Learn more →PCA / PRA
The business continuity plan and disaster recovery plan, which organize the continuation or resumption of activities after a disaster.
Learn more →Pentest (penetration test)
An authorized attack simulation designed to identify exploitable vulnerabilities in a system before a real attacker does.
Learn more →Phishing
A fraudulent technique designed to deceive a victim into revealing sensitive information or performing a harmful action.
Learn more →Security policy (PSSI)
The reference document that formalizes an organization's information security rules and principles.
Learn more →Principle of least privilege
A security principle that limits each user or system to only the rights strictly necessary for their function.
Learn more →Privacy by design
The principle that integrates personal data protection from the design stage of a product or service.
Learn more →Pseudonymisation
A technique that replaces identifying data with an indirect identifier, reducing risk in the event of a leak.
Learn more →Qualiopi
The mandatory quality certification for training organizations wishing to access public and pooled funding.
Learn more →Ransomware
Malware that encrypts a victim's data and demands a ransom to restore access.
Learn more →Red Team / TIBER-EU
A realistic and prolonged attack simulation that tests an organization's detection and response capabilities.
Learn more →Record of processing activities
The GDPR document that lists all personal data processing activities carried out by an organization.
Learn more →Incident response
All coordinated actions implemented to contain, investigate, and resolve a security incident.
Learn more →Rootkit
A set of tools designed to hide an attacker's presence on a compromised system.
Learn more →RSSI / CISO (role)
The Chief Information Security Officer, responsible for cybersecurity strategy and management — RSSI RSSI in French, CISO in English.
Learn more →RTO / RPO
Two indicators that define the acceptable recovery time and tolerable data loss after an incident.
Learn more →Sandbox
An isolated environment that allows a program to be run or a suspicious file to be opened without risk to the real system.
Learn more →SecNumCloud
The security qualification issued by ANSSI for cloud service providers operating in France.
Learn more →Application security
All practices aimed at securing an application throughout its development life cycle.
Learn more →API security
The protection of programming interfaces, access points increasingly targeted by attackers.
Learn more →Container & Kubernetes security
Practices that secure containerized environments and their orchestration.
Learn more →Website & CMS security
Security practices specific to websites and content management systems (CMS).
Learn more →Cloud security
All practices that adapt traditional security to the specific characteristics of cloud environments.
Learn more →Shadow IT
All digital tools and services used within an organization without validation from the IT department.
Learn more →SIEM (Security Information and Event Management)
A platform that centralizes and correlates security logs to detect incidents.
Learn more →SIM swapping
A fraud technique that consists of fraudulently transferring a victim's phone number to a SIM card controlled by the attacker.
Learn more →SMSI
The information security management system, an organizational framework structured by the ISO 27001 standard.
Learn more →SOC (Security Operations Center)
The team and setup that continuously monitor the security of an information system.
Learn more →SOC 2
A U.S. audit report that assesses a service provider's security controls according to the criteria Trust Services.
Learn more →Spoofing
A technique consisting of falsifying an address or identity to deceive a system or victim.
Learn more →SSO (Single Sign-On)
A single authentication mechanism that allows access to multiple applications with one login.
Learn more →SSRF (Server-Side Request Forgery)
A vulnerability that forces a server to make requests, without its knowledge, to unintended internal or external resources.
Learn more →SSTI (template injection)
An injection that exploits a server-side template engine to execute arbitrary code.
Learn more →Secure password storage
Best practices (hashing, salting, dedicated algorithms) for storing passwords without exposing them in clear text.
Learn more →Cybersecurity grants & subsidies
Public funding schemes that can be used to support a compliance or security improvement project.
Learn more →Attack surface
All exposed points of a system that are potentially exploitable by an attacker.
Learn more →File upload (security)
The precautions to apply to prevent a file uploaded to an application from becoming an attack vector.
Learn more →Threat Intelligence
The collection and analysis of information on active threats to anticipate them and defend more effectively.
Learn more →Data transfers outside the EU
The GDPR framework governing transfers of personal data to countries outside the European Union.
Learn more →Typosquatting
A technique consisting of registering a domain name close to a brand in order to trap internet users.
Learn more →Computer worm (Worm)
Malware capable of spreading automatically from one system to another.
Learn more →Personal data breach (Data Breach)
A security incident resulting in the destruction, loss, alteration, or unauthorized disclosure of personal data.
Learn more →Account takeover
The unauthorized takeover of a user account, often using compromised credentials.
Learn more →VPN (Virtual Private Network)
An encrypted tunnel that connects a user to a remote network over the Internet.
Learn more →XSS (Cross-Site Scripting)
A vulnerability that allows code, often JavaScript, to be injected and executed in other users' browsers.
Learn more →Zero Trust
A security model that trusts no access by default and systematically verifies every identity and every request.
Learn more →Not ready to talk yet? Discover our cybersecurity assessment →
Still unsure about a term? Let's talk 🚀
Our team is here to clarify a technical or regulatory point and help you move from definition to action.