Glossary

Cut through the cybersecurity jargon—our glossary makes complex identity and security terms clear, practical and easy to understand.

Identity Security

Identity Security is the discipline of protecting digital identities—human and non-human—from unauthorized access, abuse, and compromise.

New post

Cyber Insurance

Insurance designed to protect individuals or organizations from financial and operational losses caused by cyber events.

A-F

Access Management

The policies and controls that authenticate users and authorize exactly what they can do across apps, systems, and data.

Active Directory

Active Directory (AD) is Microsoft’s centralized directory service that organizes and manages user accounts, computers, groups, and other network resources, streamlining authentication, authorization, and administration in networked environments.

Adaptive Authentication

A dynamic security method that uses contextual signals like device, location, and user behavior to determine whether additional authentication is needed for access.

Adaptive Multi-Factor Authentication

A risk-based authentication system that evaluates login context using AI and machine learning, prompting for extra factors only when a request is deemed high‑risk.

Air-Gapped Network

A highly secure, physically isolated network with no external connectivity, used to safeguard highly sensitive systems in sectors like defense and critical infrastructure.

Attack Surface

The comprehensive set of digital and physical vulnerabilities and entry points through which an attacker might gain unauthorized access to a system or network.

Attack Surface Management

The ongoing process of discovering, monitoring, and reducing an organization’s vulnerabilities and exposed assets to shrink its attack surface.

Azure AD

Microsoft’s cloud-based identity and access management service offering single sign-on, multifactor authentication, and integration with on‑premises Active Directory for hybrid identity solutions.

Cloud IAM Permissions

Fine-grained, cloud-provider rules that define which identities can perform which actions on specific cloud resources.

Cloud Infrastructure Entitlements Management (CIEM)

A security discipline that discovers, rightsizes, and governs excessive permissions across multi-cloud environments to reduce identity risk.

Compromised Credential

Login details—such as usernames and passwords—that have been stolen or exposed and can be misused for unauthorized access or lateral movement attacks.

Credential Access

A stage in the cyberattack lifecycle where adversaries obtain legitimate credentials to impersonate users and bypass security controls.

Credential Stuffing

A cyberattack technique where automated tools test stolen or leaked credentials across multiple services to gain unauthorized access due to reused login details.

Credential Theft

The act of stealing login credentials through methods like phishing, malware, brute-force attacks, or data breaches, allowing unauthorized access and potential lateral movement.

Cyber Insurance

Insurance designed to protect individuals or organizations from financial and operational losses caused by cyber events, such as data breaches or attacks, through first-party and third-party coverage.

Cyber Security Compliance

Adherence to laws, regulations, and standards (e.g., HIPAA, GDPR, PCI DSS, SOX) governing how sensitive data must be handled and protected.

Directory Service

A centralized database and protocol set (e.g., LDAP, AD) that stores identities and enables authentication and lookups for networked resources.

DtHash (Okta)

An Okta dynamic token hash/identifier used in authentication workflows that, if exposed or misused, can be abused for unauthorized session access.

G-L

Honeypot Account

A decoy user account planted in a system solely to entice attackers and instantly alert the security team when accessed, enabling early breach detection.

Identity and Access Management (IAM)

A framework of policies, processes, and technologies for creating, managing, authenticating, and authorizing digital identities to ensure that the right users access the right resources at the right times.

Identity as a Service (IDaaS)

Cloud-hosted IAM delivering SSO, MFA, and user lifecycle capabilities without on-prem infrastructure.

Identity Fabric

A unified, interconnected IAM architecture that dismantles siloed identity systems to centrally coordinate provisioning, authentication, and access governance across hybrid environments.

Identity Governance and Administration (IGA)

Processes and tools that govern who should have access, certify entitlements, and automate provisioning/deprovisioning to maintain compliance.

Identity Infrastructure

The collection of systems, authentication mechanisms, and access control policies enabling secure creation, verification, and management of digital identities within an organization.

Identity Lifecycle Management

The end-to-end automation of creating, modifying, and removing digital identities and their access as people join, move, and leave.

Identity Protection

Measures and proactive monitoring aimed at safeguarding individuals’ personal data and accounts from theft, fraud, or unauthorized use.

Identity Provider

The trusted service that authenticates users and issues tokens/assertions consumed by applications for access.

Identity Security

Identity Security is the discipline of protecting digital identities—human and non-human—from unauthorized access, abuse, and compromise.

Identity Security Posture Management

The continuous process of auditing and strengthening IAM environments—such as user access, authentication methods, and entitlements—to remediate vulnerabilities and reduce identity risk.

Identity Segmentation

A cybersecurity strategy that isolates users into groups based on roles, attributes, or behavior in order to enforce least‑privilege access and minimize lateral movement risks.

Identity Threat Detection and Response

A security approach that monitors and analyzes identity‑related activities to detect credential theft, privileged misuse, or lateral movement, triggering automated and manual responses to contain threats.

Identity Threat Exposure

Security weaknesses—such as misconfigurations, outdated identity systems, or exploitable built-in features—that expose organizations to identity-based threats like credential theft, privilege escalation, or lateral movement.

Identity Verification

The process of validating that an individual is who they claim to be, often through document checks, biometrics, knowledge-based methods, or multifactor authentication, to prevent fraud and ensure secure access.

Identity Zero Trust

A security model where no identity—whether of users, devices, or apps—is inherently trusted; instead, every access request is individually verified with strong identity validation and granular controls.

Identity-Based Attack

Cyberattacks that exploit compromised credentials to misuse legitimate authentication paths, enabling attackers to evade detection and access both on‑premises and cloud resources.

Kerberoasting

A stealthy AD attack where adversaries request Kerberos Ticket Granting Service (TGS) tickets for service accounts, then crack them offline to reveal service account credentials.

Kerberos Delegation

A Kerberos mechanism that allows services to act on behalf of authenticated users to access other services, with variants—unconstrained, constrained, and resource-based—offering differing levels of security control.

Lateral Movement

A tactic used by threat actors to stealthily navigate across compromised systems within a network, escalating privileges and reaching high-value assets while avoiding detection.

M-R

Machine Identity

The digital credentials (such as certificates, cryptographic keys, and service account accounts) assigned to devices, applications, and services, enabling trusted and authenticated machine-to-machine interactions.

MFA Fatigue

A vulnerability where users become overwhelmed by constant multi-factor authentication prompts, potentially leading to inadvertent approval of fraudulent access attempts.

MFA Prompt Bombing

A targeted attack in which adversaries flood users with authentication requests to wear them down into approving false login attempts.

Microsoft Entra ID

Microsoft Entra is a suite of identity and access management (IAM) products offered by Microsoft, designed to help organizations manage and secure access to applications and resources across their digital environments.

MITRE ATT&CK Framework

A globally recognized knowledge base of adversarial tactics, techniques, and procedures used to simulate, understand, and defend against cybersecurity threats.

Multi-Factor Authentication (MFA)

A security measure requiring two or more distinct forms of identity verification—such as a password plus a token or biometric—for user authentication.

Non-Human Identity

Digital identities assigned to systems, bots, or services rather than people—like service accounts or automated agents—that require management and protection just like human identities.

Nudge Security Strategy

A behavioral approach that uses timely prompts and defaults to steer users toward secure actions without adding friction.

OIDC (OpenID Connect)

A modern identity layer atop OAuth 2.0 that standardizes user authentication and profile exchange with signed JSON tokens.

Open Authorization (OAuth)

A delegated authorization framework that lets apps access resources on a user’s behalf without sharing passwords.

Passwordless Authentication

Verifying users with phishing-resistant factors like passkeys, biometrics, or hardware tokens instead of passwords.

Principle of Least Privilege

A security principle where users and systems are granted only the minimal access levels necessary to perform their functions, limiting potential misuse or compromise.

Privilege Escalation

A type of attack in which an adversary acquires higher access controls—either by exploiting bugs or misconfigurations—to perform unauthorized operations.

Privileged Access Management (PAM)

Technologies and policies that manage and monitor elevated-level user access (e.g., administrators), enforcing strict controls and reducing security risk.

Privileged Account

An account with elevated permissions (such as administrator or root access) that allows extensive control over systems and data—making it a high-value target for attackers.

Prolific User

A user who frequently accesses multiple systems or performs numerous actions, often generating high volumes of identity activity that may require monitoring for anomalies.

PsExec

A Windows command-line tool used for executing processes on remote systems, commonly leveraged by attackers for lateral movement and remote code execution in network breaches.

Ransomware

Malicious software that encrypts an organization’s data or systems and demands a ransom to release the decryption key, often coupled with extortion tactics.

Risk-based Authentication

A dynamic authentication method that assesses contextual risk factors—such as location, device, and behavior—in real time and adjusts authentication strength accordingly.

S-Z

SAML

An XML-based standard for exchanging authentication and authorization assertions between an IdP and a service provider to enable SSO.

Service Account

A non-human identity used by applications, services, or automated processes to interact with systems—often needing stringent security oversight.

Unconstrained Delegation

A Kerberos delegation type that allows a service to act on behalf of a user to any other service, posing significant security risks if misused.

Unified Identity Protection

A consolidated security approach that provides centralized visibility and automated safeguards across all identity types—human and machine—to detect and respond to threats universally.

User Account

A digital identity representing a specific person—used to authenticate and control access to systems, applications, and data.

User Authentication

The process of verifying an individual's claimed identity (e.g., via passwords, tokens, or biometrics) before granting access to systems or resources.

Zero Trust

A cybersecurity framework that eliminates any implicit trust within a network by continuously verifying every user and device, enforcing least-privilege access, micro-segmentation, and automated threat response to proactively minimize breaches and lateral movement.

We dared to push identity security further. 
Discover what’s possible.

Set up a demo to see the Silverfort Identity Security Platform in action.

Glossary

Identity Security

Cyber Insurance

A-F

Access Management

Active Directory

Adaptive Authentication

Adaptive Multi-Factor Authentication

Air-Gapped Network

Attack Surface

Attack Surface Management

Azure AD

Cloud IAM Permissions

Cloud Infrastructure Entitlements Management (CIEM)

Compromised Credential

Credential Access

Credential Stuffing

Credential Theft

Cyber Insurance

Cyber Security Compliance

Directory Service

DtHash (Okta)

G-L

Honeypot Account

Identity and Access Management (IAM)

Identity as a Service (IDaaS)

Identity Fabric

Identity Governance and Administration (IGA)

Identity Infrastructure

Identity Lifecycle Management

Identity Protection

Identity Provider

Identity Security

Identity Security Posture Management

Identity Segmentation

Identity Threat Detection and Response

Identity Threat Exposure

Identity Verification

Identity Zero Trust

Identity-Based Attack

Kerberoasting

Kerberos Delegation

Lateral Movement

M-R

Machine Identity

MFA Fatigue

MFA Prompt Bombing

Microsoft Entra ID

MITRE ATT&CK Framework

Multi-Factor Authentication (MFA)

Non-Human Identity

Nudge Security Strategy

OIDC (OpenID Connect)

Open Authorization (OAuth)

Passwordless Authentication

Principle of Least Privilege

Privilege Escalation

Privileged Access Management (PAM)

Privileged Account

Prolific User

PsExec

Ransomware

Risk-based Authentication

S-Z

SAML

Service Account

Unconstrained Delegation

Unified Identity Protection

User Account

User Authentication

Zero Trust

We dared to push identity security further. Discover what’s possible.

We dared to push identity security further. 
Discover what’s possible.