Glossary

Use of an account by someone other than its holder, through a leaked password, a replayed session or a bypassed second factor. VesperID classes every identity by the likelihood of that takeover: possible, likely or immediate.

See also Credential stuffingSession hijackingMulti-factor authentication (MFA)Exposure chain

The set of points through which an organisation can be reached from the outside: domains, exposed services, accounts, people, suppliers. It usually grows through legitimate routes and without an explicit decision.

See also Threat exposure managementSupply chain attack

The first six to eight digits of a payment card, which identify the issuer. Declared to VesperID, a BIN makes it possible to recognise an issuer’s cards in the batches put up for sale on illicit markets, without keeping any full number: a card is shown masked, BIN and last four digits.

See also Stealer logDark webInitial access broker

Public logs recording issued TLS certificates. Consulting them makes it possible to spot very early a certificate issued for a domain imitating yours, often before any page is published.

See also Lookalike domainPhishing

A group of accounts that share the same recommended action: awareness recommended, device to reinstall, access to harden, to watch or no exposure. A cohort reads as a list of security actions to organise, never as a ranking of people.

See also Exposure chainHuman riskPlaybookCredential

The pair formed by a username, often an email address, and an authentication factor. Exposed in a leak, it stays dangerous as long as the password has not been changed everywhere it was reused.

See also Credential stuffingHashInformation stealer

Automated testing of address and password pairs taken from other services’ breaches, betting on reuse. It is cheap and produces logins that look perfectly legitimate in the logs.

See also CredentialMulti-factor authentication (MFA)

The set of sites and services reachable only through anonymising networks. In practice the cybercriminal economy extends well beyond that perimeter: publicly reachable forums and messaging channels now make up a large share of it.

See also Leak siteInitial access brokerOpen-source intelligence (OSINT)

A policy published in DNS telling receiving servers how to handle an email claiming to come from your domain that fails authentication checks. A reject policy sharply reduces direct spoofing of your domain.

See also SPFPhishingLookalike domain

The practice of combining system encryption with the threat of publishing stolen data. It makes restoring backups insufficient on its own to close the incident.

See also RansomwareLeak site

The deliberate publication of private information about a person, address, phone, family, routines, in order to harm, intimidate or enable a targeted attack.

See also Open-source intelligence (OSINT)Takedown

A sequence of linked elements, sometimes called an attack chain, that together make an access possible: an infected device, the credentials it leaked, a still-valid session, the service it opens. The chain carries a probable origin, a confidence, its possible impacts and the action that cuts it.

See also PlaybookAccount takeoverInformation stealerSession cookie

An aggregated indicator, from 0 to 100, summarising the open detections in a perimeter, weighted by severity, freshness and asset criticality. It exists to track one organisation over time, not to compare organisations.

See also Threat exposure managementFalse positive

A detection raised in error: a legitimate domain taken for a lookalike, a namesake confused with your organisation, an example token taken for a secret. The false positive rate decides whether monitoring gets used or ignored.

See also Exposure scoreThreat exposure management

The output of a one-way function applied to data, for example a password. A weak or unsalted hash can be recovered by computation: its presence in a leak must be treated as a real exposure.

See also CredentialInformation stealer

A character visually identical to another but with a different code point, often from another alphabet. Used in a domain name, it produces an imitation the naked eye cannot detect.

See also Lookalike domainTyposquatting

The share of cyber risk that comes from people’s accounts rather than systems: a reused password, an infected personal device, a stolen session, a reply to a phishing message. It is reduced through targeted awareness and measures on the device and the access, never through sanctions.

See also CohortPhishingCredential stuffingStealer log

Malware designed to copy, in a single run, the secrets present on a machine: browser passwords, cookies, wallets, configuration files. It does not necessarily persist after the theft.

See also Stealer logSession cookieCredential

An actor specialised in obtaining and reselling access to organisations, without running the final attack themselves. Their role explains the frequent delay between an access being stolen and being used.

See also Dark webCredentialRansomware

A site published by a ransomware group to announce its victims and progressively release stolen data. The public claim almost always precedes the actual file release.

See also RansomwareDouble extortionSupply chain attack

An annual right of use, under a name, composed service by service: every service appears on it with its price, its activation fee and its quota, never as a bundle. An organisation, company or individual, can hold several licences, for instance one per subsidiary or one per protected executive.

See also Threat exposure managementExposure scorePlaybook

A domain name built to be mistaken for yours: an added or doubled character, an inserted hyphen, a different extension, a homoglyph. The preferred vehicle for phishing and payment fraud.

See also TyposquattingHomoglyphTakedown

Identity verification through at least two elements of different kinds: a password and a temporary code, a physical key, a fingerprint. It blocks reuse of a stolen password, but not theft of an already open session.

See also CredentialSession cookieSession hijacking

The collection and analysis of publicly available information. Applied to a person, it reconstructs routines, relationships and contact details, the raw material of targeted phishing and doxing.

See also DoxingDark web

A message or page imitating a trusted party to obtain credentials, a payment or the execution of a file. Modern kits also intercept the second factor and the session cookie in real time.

See also Lookalike domainSession hijackingDMARC

A written, ordered course of action for one kind of case: isolating a device, resetting credentials, responding to a lookalike domain, questioning a supplier. Each step first closes the access, then documents; the playbook named shows on the finding and in the alert.

See also Exposure chainCohortTakedown

An attack that encrypts or exfiltrates an organisation’s data in order to demand payment. Most groups exfiltrate before encrypting, so they retain leverage even over a victim able to restore from backup.

See also Leak siteDouble extortionSupply chain attack

A token placed by a site in the browser to keep an authenticated session. Stolen and replayed, it grants access to the account with no password and no second factor, until it expires or is invalidated.

See also Session hijackingInformation stealerMulti-factor authentication (MFA)

Taking over an account by replaying a stolen session cookie, with no password and no second factor. The only effective remediation is invalidating sessions, not changing the password.

See also Session cookieInformation stealerMulti-factor authentication (MFA)

The level assigned to a detection (critical, high, medium, low, informational) from the freshness of the information, the nature of the data and the criticality of the asset. It drives the notification channel and timing.

See also Exposure scoreFalse positive

A DNS record listing the servers allowed to send mail for your domain. Combined with DMARC it limits direct spoofing, but has no effect on a lookalike domain, which publishes records of its own.

See also DMARCLookalike domain

The archive produced by an information stealer on an infected machine: saved passwords, cookies, files, system fingerprint. It is the most common resale unit on access markets.

See also Information stealerSession cookieCredential

A compromise obtained by targeting a provider, vendor or subcontractor rather than the final target. Your data can be published without any of your systems being touched.

See also RansomwareLeak siteAttack surface

What changes on an organisation’s exposed surface from one synchronisation to the next: hosts and ports that appear, change or disappear, certificates about to expire. A newly reachable service matters more than a frozen inventory.

See also Attack surfaceExposure score

A request to a registrar, host or platform to suspend a domain or remove fraudulent content. Its outcome depends on the third party’s decision, never on the requester.

See also Lookalike domainDoxingPhishing

A continuous practice of identifying what an organisation exposes on the outside, qualifying what is genuinely exploitable and treating the exploitable first. It complements internal protection rather than replacing it.

See also Attack surfaceExposure scoreFalse positive

Registering domains that match common typing errors on a legitimate name. The oldest technique in the lookalike domain family, and still one of the most profitable.

See also Lookalike domainHomoglyph

Protocols for querying a domain name’s registration data: registrar, dates, contacts where published. Useful evidence for a takedown request, even when partially redacted.

See also Lookalike domainTakedown