Cloud Security Posture Management

Information Security

The practice of protecting information by mitigating information risks including unauthorised access, use, and disruption.

Security Audit

A systematic evaluation of an organisation's information system security by measuring compliance with established criteria.

Compliance Framework

A structured set of guidelines and best practices for meeting regulatory requirements and industry standards.

ISO 27001

An international standard for information security management systems specifying requirements for establishing and maintaining security.

SOC 2

An auditing framework that evaluates the security, availability, processing integrity, confidentiality, and privacy of service organisations.

NIST Cybersecurity Framework

A set of voluntary guidelines for managing and reducing cybersecurity risk developed by the US National Institute of Standards.

Cyber Insurance

Insurance coverage protecting organisations against financial losses from cyberattacks, data breaches, and related incidents.

Threat Modelling

A structured approach for identifying, quantifying, and addressing security threats to a system or application.

Security by Design

An approach that integrates security considerations into every stage of the software development lifecycle.

DevSecOps

An approach integrating security practices within the DevOps process, making security a shared responsibility.

Software Supply Chain Security

Practices and tools that protect the integrity of software components, dependencies, build pipelines, and distribution channels from compromise and tampering.

The specific path, method, or scenario used by an attacker to gain unauthorised access to a system.

An integrated security platform that protects cloud-native applications across the full lifecycle, combining workload protection, configuration management, and runtime security.

A group of security professionals who defend against both real attackers and simulated attacks from red teams.

A targeted phishing attack directed at specific individuals or organisations using personalised deceptive content.

The continuous discovery, inventory, classification, and monitoring of all external-facing digital assets to identify and reduce an organisation's exposure to cyber threats.

A decoy system designed to attract attackers and study their methods while protecting real systems.

Malicious software that encrypts a victim's files and demands payment for the decryption key.

The process of converting plaintext data into ciphertext using an algorithm, making it unreadable without the decryption key.

Compliance

Adherence to laws, regulations, guidelines, and specifications relevant to an organisation's business.