Reference

The words, defined plainly.

Terms used across defensive security and disclosure work — including several that are used loosely enough to cause real disagreements late in a contract.

This page describes the field, not this company. Nothing here is a claim about work Auctoritas has done.

Defensive operations

The vocabulary of the work itself. Several of these are used interchangeably in marketing copy and mean different things in practice.

Threat model: A statement of who you think would attack you, what they want, and what they are able to do. It is a set of assumptions, written down so they can be argued with.; A threat model nobody disagreed with was probably not specific enough to be useful.
Attack surface: Everything an attacker can reach and interact with: exposed services, accounts, integrations, third parties, and the people who can be asked to do things.; It grows every time something is connected, and shrinks only when something is deliberately removed.
Segmentation: Dividing an environment so that reaching one part does not mean reaching the rest. The control that decides how far a bad day travels.
Blast radius: What one compromised account, key or host can actually reach. The question is not whether something will be compromised but what it touches when it is.
Least privilege: Granting only the access a role needs to do its work, and only for as long as it needs it. Easy to state, and mostly a question of who is willing to review access after it is granted.
Detection engineering: Building and maintaining the rules and signals that surface an attack, and treating them as software: version-controlled, tested, and expected to break when the environment changes.; A detection written once and never re-tested is a detection whose current state is unknown.
Playbook vs procedure: A playbook describes what generally happens. A procedure states who does what, in what order, and what decision is made at each step.; Under pressure, the difference is whether anyone can follow it. Most organizations have the first and believe they have the second.
Containment: Stopping the spread before understanding the whole picture. It is deliberately not the same as eradication, and confusing the two costs time in the hours it matters.
Dwell time: How long an intruder is present before being detected. A measure of the detection, not of the attacker.
RTO and RPO: Recovery Time Objective is how long you can be down. Recovery Point Objective is how much data you can afford to lose. They are business decisions that get treated as technical settings.; Both are hypotheses until a restore has actually been performed from the backups you currently hold.

AI applied to defense

Where the terms are newest and used most loosely. Precision here is not pedantry: these words end up in contracts.

False positive / false negative: A false positive flags something benign. A false negative misses something real. Every detector trades one against the other; there is no setting that removes both.; A vendor quoting only one of the two numbers has chosen which one to show you.
Explainability: Whether a decision can be accounted for after the fact in terms a person can follow and challenge. Distinct from accuracy: a system can be right often and still be impossible to defend.; For a regulated buyer, an unexplainable decision is frequently an unusable one regardless of how well it performs.
Human in the loop: A person approves or can override the decision before it takes effect. Worth asking which of the two is meant, because they are very different guarantees.
Model drift: Performance degrading as the environment changes away from the conditions the model was built for. Not a fault; a maintenance requirement.
Asymmetry of defense: An attacker needs one path to work once. A defender needs every path to hold, every time, and has to explain the outcome afterwards. It is why offensive and defensive tooling are not mirror images of each other.

Disclosure and exposure

The vocabulary of the second practice. Most of it predates cybersecurity and is borrowed from operational security.

OPSEC: Protecting information that is individually unremarkable but revealing in combination. The discipline is about aggregation, not secrecy.
Disclosure review: Reading planned material for what it reveals rather than how it reads: capability, timing, structure, relationships. A separate pass from editing, done by someone looking for a different thing.
Aggregation risk: Where several public, harmless facts combine into one sensitive one. It is the reason a disclosure review starts with everything already published rather than with the draft in hand.; Job adverts are the most reliably overlooked source. They name the tools, the stack and the direction of travel.
Attribution: Assigning an intrusion to a particular actor. Hard, frequently contested, and routinely stated with more confidence in public than the underlying evidence supports.
Responsible disclosure: Reporting a vulnerability to the party that can fix it, and agreeing when it becomes public. The argument is almost always about the timeline rather than the principle.

On this page

Why a company with no product publishes definitions.

Because it is the one kind of depth an early company can add without borrowing credibility it has not earned. A definition is checkable by anyone who knows the field, which makes it the opposite of a claim.

If you find something here wrong or sloppily put, we would rather hear it than not.

Tell us we are wrong