Guides, checklists and plain-English explainers.

Glossary

VAPT

Vulnerability Assessment and Penetration Testing: finding weaknesses, then safely exploiting them to prove real-world risk.

CVE

Common Vulnerabilities and Exposures — a public ID for a specific, known vulnerability, e.g. CVE-2024-3400.

CVSS

Common Vulnerability Scoring System — a 0–10 severity score used to prioritise fixes.

Zero-day

A vulnerability that attackers exploit before a patch is available.

Ransomware

Malware that encrypts or steals data and demands payment. Many strains also threaten to leak the data.

Phishing / BEC

Deceptive emails or messages that trick people into revealing credentials or paying fake invoices (business email compromise).

SIEM

Security Information and Event Management — collects and correlates logs to detect attacks.

EDR / XDR

Endpoint (or Extended) Detection and Response — tools that detect and contain threats on devices and across systems.

SOC / MDR

Security Operations Centre / Managed Detection and Response — people and tooling monitoring for threats around the clock.

SPF, DKIM, DMARC

Email authentication records that stop attackers sending mail that appears to come from your domain.

IoC

Indicator of Compromise — evidence such as a malicious IP, file hash or domain that shows an intrusion.

Chain of custody

A documented record of who handled evidence and when, so it stays admissible.

CCMP

Cyber Crisis Management Plan — the documented plan for responding to a major cyber incident, expected by Indian regulators.

vCISO

Virtual Chief Information Security Officer — part-time, senior security leadership as a service.

CSCRF

SEBI's Cybersecurity and Cyber Resilience Framework for regulated entities in India's securities market.