Security terms in plain English

Security has an unusually large vocabulary for a field with so few genuinely difficult ideas. Most of the words below describe something you already understand from running a business; they exist because a specialist needed a shorter way to say it, and they became a barrier by accident rather than by design.

Every definition here is written in the terms this product uses rather than in the abstract, because a general definition you cannot map onto what is in front of you is worse than none. Each entry also says why you should care, since a definition without a consequence is trivia.

Who and what has access

This first group is where almost every incident at an organisation your size begins. If you read only one section, read this one.

Identity

A person or a thing the system can recognise and make decisions about — usually an account in Microsoft 365. Why you care: identity is the unit almost everything here is organised around. Findings name identities, alerts attribute risk to identities, and the price is quoted per identity. An identity in your Microsoft 365 directory is a different thing from an account in the Qorionix console; the platform watches the first without any of those people signing in to the second. See Who actually needs a Qorionix account.

Credential

The thing that proves an identity is who it claims to be: a password, a key, a certificate, a token. Why you care: a credential is portable in a way a person is not. It can be stolen, shared, pasted into a chat window or left in a spreadsheet, and the system cannot tell the difference between the right person using it and the wrong one. The whole privileged access module exists to break that portability — the credential is held in a vault and injected into the session, so the person doing the work never sees it.

Privilege

What an identity is permitted to do. An account with high privilege can change other accounts, read anyone's data, or alter the settings that protect everything else. Why you care: privilege is what turns one compromised mailbox into a company-wide problem. Your first posture report is largely a list of who holds more privilege than their job requires, and the single most valuable change most organisations make is separating administrator accounts from the accounts used to read email all day. See Admin accounts used for daily email.

Least privilege

The habit of granting the smallest set of permissions that lets somebody do their job, and adding more only when they ask. Why you care: it is the cheapest security control in existence, and it is why the Qorionix role model has 85 named permissions rather than three tiers called admin, user and viewer — a coarse model forces you to over-grant. See Who can see and do what.

Non-human identity

An account that belongs to a system rather than a person: a service account, a scheduled job, a build runner, an application with its own credentials. Why you care: these accounts rarely have a second factor, rarely have an owner who would notice them behaving oddly, and frequently hold more privilege than any human in the building. The Qorionix connection to your Microsoft 365 tenant is itself one of these, which is why we describe exactly what it can read and encourage you to revoke it directly in your own tenant if you ever want to.

Phishing-resistant factor

A second authentication step that cannot be relayed to an attacker even if the person is successfully tricked — in practice a passkey or a hardware security key, bound cryptographically to the real website. Why you care: a six-digit code from an app and a push notification you tap can both be captured by a convincing fake sign-in page and replayed within seconds. A passkey cannot, because its signature is meaningless anywhere but the genuine origin. Qorionix does not treat text messages or push approvals as phishing-resistant, because they are not.

How much a mistake costs

Blast radius

How far the consequences of something reach. The blast radius of a stolen password on a shared printer account is small; the blast radius of a stolen global administrator password is your entire company. Why you care: it is the field that decides your priorities. Every change Qorionix proposes states its blast radius before you approve it — how many people are affected, what stops working, what the undo looks like — because severity alone does not tell you whether a fix is safe to apply on a Friday afternoon. See Severity, blast radius and what to fix first.

Dwell time

How long an intruder is inside before anybody notices. Why you care: almost all of the damage in a serious incident happens during dwell time rather than during the break-in, which is what makes continuous monitoring worth paying for. We publish no dwell-time claim of our own. What we claim is narrower and checkable: every alert is investigated within minutes, around the clock, with cited evidence — and there is no human on call unless you have your own.

What the platform can see

Three words that between them describe the entire supply chain from something happening in your business to something appearing on your screen.

Telemetry

The stream of small factual records a system emits about what it is doing — a sign-in happened, a process started, a file was written, a rule was changed. Why you care: telemetry is the raw material for everything else. No telemetry means no detection, however good the software is, which is why a check that cannot see its data is reported as skipped rather than as passed. A licence limitation must never become a false all-clear. See When a check cannot run.

Log source

One place telemetry comes from: your Microsoft 365 and Entra ID tenant, the Windows Event Log on a server, a firewall speaking syslog, a cloud audit trail. Why you care: each source you connect widens what can be detected, and each one you fail to connect is a hole you will not be told about by its absence. An integration that silently stopped syncing three weeks ago is an incident rather than a cosmetic problem, which is why source health is something to check rather than assume.

Normalisation

Translating records from different products into one common shape, so that a sign-in is a sign-in whether it came from Microsoft, from a Linux server or from a cloud provider. Qorionix normalises everything to an open industry schema, OCSF version 1.6.0. Why you care: without it, a detection rule has to be written once per vendor and a question like who signed in from this address becomes a different query for every product you own. With it, the rule is written once and your search does not need to know which system produced the answer.

How the platform decides something is wrong

Detection rule

A written description of a pattern worth noticing — twenty failed sign-ins from one address in five minutes, a mailbox rule forwarding to an external domain, a process behaving the way credential-theft tools behave. Why you care: rules are why the product notices anything at all. Every rule in the library is authored in-house, and every one carries mandatory false-positive guidance plus, where it sets a threshold, a written reason for that threshold. See Alert severity, and what a match actually means.

False positive

An alert that turned out to describe legitimate behaviour. Your finance director really was in Lisbon. Why you care: false positives are not a defect to be eliminated, they are a cost to be managed, and a vendor claiming near-zero false positives is either measuring something narrow or not measuring at all. What matters is that each rule tells you the ordinary business situations that produce it, so you can dismiss one in thirty seconds rather than thirty minutes. Marking something as a false positive is a tuning signal that changes future behaviour, so use it only when it is true.

Shadow rule

A detection that runs, records its findings and feeds the risk score, but deliberately raises no alert for a human. Why you care: it is the correct setting for a rule that fires constantly on a condition you are still in the middle of remediating, and for a rule whose supporting data your estate does not yet emit. Shadow mode keeps the visibility without creating work, and it is why your active rule count is smaller than the shipped rule count. See Shadow detections, and why some rules stay quiet.

MITRE ATT&CK

A public, free catalogue of the techniques real attackers use, maintained by a non-profit and organised into tactics — the attacker's goals — and techniques, the ways of achieving them. Why you care: it is the only common vocabulary in this industry, so it lets you ask any vendor the same question and compare the answers. Qorionix publishes its coverage against it, including the two tactics it does not cover: Reconnaissance and Resource Development both happen outside your estate and produce no telemetry inside it, so claiming coverage would be a fabrication.

What you do about it

Alert versus incident

An alert is one detection that matched and was allowed to interrupt a human. An incident is the case file: one or more alerts about the same thing, with a timeline, a status and an owner. Why you care: a six-step business email compromise sequence should be one incident rather than six alerts, and the difference decides whether your queue is workable. It also decides what you tell a regulator, because a supervisory authority asks about incidents, not about individual detections. The two objects use different status vocabularies — see Alert states, and who owns one.

Containment

Stopping something spreading while you work out what it is: revoking a session, quarantining a file, isolating one machine from the network. Why you care: containment is not the fix and should not be confused with it. In Qorionix every containment action is reversible by construction and the undo path is recorded before the action is taken rather than reconstructed afterwards — a quarantined file goes into a vault named by its cryptographic digest, and isolating a host snapshots its firewall rules before changing them. That is what makes containment a control rather than an incident of its own. See Undo a change.

Autonomy tier

How much the platform's AI, Sentinel-Q, is allowed to do without asking you: report, explain, investigate, recommend, or act inside a pre-declared envelope. The default is recommend — it prepares a fully specified change with an exact target, a stated blast radius and an undo plan, and waits. Why you care: the tier is enforced by the server rather than by asking the model to behave, and three rules hold at every tier. Granting privileged access is never automated and is not exposed to the AI at all. A verdict whose cited evidence does not verify cannot trigger an action, however confident it sounds. Anything irreversible needs a human. See Autonomy tiers explained.

Evidence bundle

An export containing what was observed, what was decided, what was done and by whom, cryptographically stamped so that a later alteration is detectable. Why you care: this is the artefact an auditor, an insurer or a supervisory authority actually asks for, and it cannot be written from memory after the fact. If your organisation falls under NIS2 an incident starts a clock — a 24-hour early warning, a 72-hour notification, a final report within a month — and the bundle is what those documents are drafted from. See The evidence bundle.

Three phrases you should distrust, including from us

A glossary is also a good place to name the vocabulary that exists to obscure rather than to clarify. We publish the full list of sentences we refuse to write at /honesty; three are worth knowing as a buyer.

• "AI SOC" or "autonomous SOC". A security operations centre is a room with people in it. Software that triages alerts is an autonomous Tier 1 — the routine first pass — and you still keep Tier 2 and Tier 3, which is the judgement work.
• A bare confidence percentage. "87% malicious" is a number with no method behind it you could check. A qualitative band with its reason — Low: could not corroborate sign-in geography, source offline — tells you what to do next.
• "Compliant" as a product property. Software cannot make an organisation compliant with NIS2, GDPR or DORA, because most of those obligations are things people and processes must do. What software can do is produce the evidence your audit asks for.

Where to go next

1. What Qorionix does, and what it does not — the same honesty applied to the product rather than the vocabulary.
2. Your first week with Qorionix — eight tasks in the order that removes the most risk for the least disruption.
3. When to bring in a human — the boundary of what any software at this price can do for you.