SecOps
SecOps glossary
Plain-language definitions of the terms used in SecOps. The linked guides explain the app's counting rules and what the evidence can establish.
| Term | Meaning |
|---|---|
| SecOps | Security operations: the work of identifying, assessing and following up security concerns |
| Finding | A reported issue on a particular target |
| Vulnerability | A specific flaw that can be exploited to harm a system or its data |
| Weakness | A type of underlying condition that can lead to vulnerabilities |
| CVE | A shared identifier for a publicly disclosed vulnerability |
| CWE | A classification of security weakness types |
| Severity | The source's normalised Critical, High, Medium, Low or Info label |
| CVSS | A system for describing vulnerability severity with a numerical score |
| EPSS | An estimate of exploitation in the wild over the next 30 days for a published CVE |
| Percentile | A relative rank; an EPSS percentile differs from its probability |
| KEV | CISA's Known Exploited Vulnerabilities catalogue, based on exploitation evidence |
| Exposure | Whether and how a relevant target can be reached or affected |
| Triage | Checking relevance, impact, evidence and ownership before choosing an action |
| Target | The repository, resource or other affected system named by a finding |
| Remediation | A change addressing the reported issue |
| Fixed-in version | A version the advisory identifies as containing the relevant fix |
| Fix group | Findings grouped around one remediation change |
| Workstream | A collection of fixes needing a similar kind of action |
| SLA | In SecOps, the internal time allowance for remediation by severity |
| Breach | A finding remaining open after its remediation deadline |
| Risk acceptance | A temporary decision to retain a real risk, with a reason and recheck date |
| False positive | A report assessed as not applying to the target, with evidence to revisit |
| Owner team | The team responsible for following up a vulnerability finding |
| Provider | A connected system supplying accounts, roles or audit events |
| Service identity | An account or credential used by automation rather than a person |
| Privilege | Authority to perform sensitive or administrative actions |
| MFA or 2FA | Authentication using different factors; 2FA uses two |
| Audit trail | The access events providers recorded and SecOps holds |
| Expected activity | A matching rule suppressing certain event-based attention without deleting the events |
| Access review | A recorded inspection of changes over a stated period, with coverage and follow-up |
Guides
- Vulnerabilities, severity and exploit likelihood
- Working findings
- Remediation deadlines
- Exceptions
- Access
Official references
- CVE Program glossary
- MITRE CWE frequently asked questions
- FIRST CVSS documentation
- FIRST EPSS documentation
- CISA Known Exploited Vulnerabilities catalogue
- NIST authentication guidance
These references explain the broader concepts. SecOps's thresholds, default deadlines and available sources are product rules described in the guides, rather than requirements those references impose on every organisation.