Skip to content
info@rootsektor.de
24/7 emergency: +49 2932 465265-0 Request a pentest quote Report an emergency
Emergency

Contact

Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.de

Mon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline

Request a pentest quote Report an emergency

Resources

IT Security Glossary

Kerberoasting, TLPT, prompt injection, or NIS2 – IT security is full of technical terms and acronyms. Our IT security glossary explains the most important terms from penetration testing, attack techniques, defense, and regulation – concisely, clearly, and accurately. Each entry also links to the related Rootsektor page.

Request a pentest quoteAsk a question

About this glossary

IT security glossary: technical terms explained clearly

Anyone dealing with penetration tests, threat detection, or new legal obligations quickly runs into technical jargon, acronyms, and the names of laws. This glossary – your compact cybersecurity dictionary – translates them into plain language, from pentest terms such as scope and retest to regulations such as NIS2 and DORA. Each entry explains in a few sentences what a term means and why it matters for the security of your organization.

The entries are sorted alphabetically. For terms rooted in German law or German institutions – such as the BSI, KRITIS, or the German Trade Secrets Act – the German original is given as well, so you can recognize it in German reports, contracts, and regulations. Each term links to a page with a more detailed explanation, and the link at the end of an entry takes you to the matching Rootsektor page – usually the service that addresses the topic in practice.

Terms from A to Z

A

  • Active Directory (AD)

    Active Directory is Microsoft’s directory service: in Windows networks, it centrally manages user accounts, groups, computers, and permissions and handles authentication, usually via Kerberos. Because AD holds the keys to the entire network, it is one of attackers’ most important targets: whoever obtains domain admin rights effectively controls the whole environment. Permissions that have grown over the years, outdated protocols, and weak service account passwords often open up attack paths that go unnoticed.

    Learn more about Active Directory (AD) Related service: Active Directory Assessment

  • Attack Path

    An attack path is the chain of individual steps an attacker takes to get from an initial point of entry to a valuable target – for example, from a compromised workstation via a service account with excessive permissions to domain admin. Often, each individual vulnerability looks harmless on its own; only the combination makes it dangerous. Penetration tests and Active Directory assessments make such paths visible so that you can break them at the most effective point.

    Learn more about Attack Path Related service: Active Directory Assessment

  • Attack Surface

    The attack surface includes every point where an attacker can strike – from publicly accessible servers, web applications, and interfaces to cloud services and VPN access to employees who can be reached by email or phone. Every new service, every forgotten test environment, and every additional user account expands it. The goal is to know your own attack surface completely, switch off anything unnecessary, and secure the rest in a targeted way.

    Learn more about Attack Surface Related service: OSINT Assessment

B

  • Black-Box Testing

    In black-box testing, the testing team receives hardly any information up front – often just a company name, a URL, or an IP address range. The team proceeds like an external attacker without insider knowledge and shows realistically what is visible and vulnerable from the outside. The downside: part of the testing time goes into information gathering, and deeper vulnerabilities are more likely to remain undetected than in a gray-box or white-box test.

    Learn more about Black-Box Testing Related service: Penetration Testing

  • Blue Team

    The blue team is the defending side: it monitors systems, detects attacks, responds to security incidents, and continuously improves protective measures. Depending on the organization, this includes the internal IT security team, a security operations center (SOC), or external service providers. In red teaming exercises, the blue team is the opponent whose detection and response capabilities are put to the test.

    Learn more about Blue Team Related service: Red Teaming & APT Simulation

  • Brute-Force Attack

    In a brute-force attack, an attacker systematically – and usually automatically – tries combinations until a password, PIN, or key works. Online, the attack targets login pages and services such as VPN or RDP; offline, it targets stolen password hashes, which can be cracked very quickly with powerful hardware. Effective countermeasures include long passwords, multi-factor authentication, rate limiting, and monitoring of failed logins.

    Learn more about Brute-Force Attack Related service: Web Applications & Online Shops

  • BSI (German Federal Office for Information Security)

    The BSI (Bundesamt für Sicherheit in der Informationstechnik), based in Bonn, is Germany’s federal cybersecurity authority. It publishes standards and recommendations such as the IT-Grundschutz Compendium, warns of current threats, and is the central point of contact for operators of critical infrastructure and for companies covered by NIS2. With its guide “Durchführungskonzept für Penetrationstests” (implementation concept for penetration tests), the BSI has also described a framework for planning and conducting pentests, which we use as a guide.

    Learn more about BSI (German Federal Office for Information Security) Related service: Penetration Testing

  • BSI IT-Grundschutz

    BSI IT-Grundschutz is a methodology from Germany’s Federal Office for Information Security that organizations use to systematically establish and maintain an appropriate level of security. Its core elements are BSI Standards 200-1 to 200-4 and the IT-Grundschutz Compendium, with modules for typical processes, applications, and systems. Government agencies and public institutions in particular work with it; ISO 27001 certification based on IT-Grundschutz is also possible. The BSI is currently migrating IT-Grundschutz step by step to “Grundschutz++”; the existing IT-Grundschutz remains usable during a transition period of several years.

    Learn more about BSI IT-Grundschutz Related service: Public Sector & Education

C

D

  • Dark Web (Darknet)

    The dark web refers to parts of the internet that can only be accessed with special software such as the Tor Browser and that conceal users’ identities. Besides legitimate uses – such as protecting journalists in authoritarian states – these areas serve as marketplaces for stolen credentials, customer data, malware, and access to compromised corporate networks. If you find out early that your data is being traded there, you can change passwords and prevent attacks before they happen.

    Learn more about Dark Web (Darknet) Related service: Dark Web Monitoring

  • DAST (Dynamic Application Security Testing)

    DAST tests a running application from the outside by sending deliberately manipulated requests and analyzing the responses – without access to the source code. This uncovers vulnerabilities such as injection flaws, misconfigurations, or missing security headers in real-world operation. Automated DAST tools find typical classes of errors efficiently; logic flaws and complex authorization issues, on the other hand, are only detected by a manual penetration test.

    Learn more about DAST (Dynamic Application Security Testing) Related service: Web Applications & Online Shops

  • Data Processing Agreement (DPA, German: AVV)

    A data processing agreement – in German, Auftragsverarbeitungsvertrag (AVV) – governs, under Art. 28 GDPR, how a service provider processes personal data on behalf of and on the instructions of a controller, including the subject matter, duration, types of data, technical and organizational measures, and audit rights. A DPA may also be required for security services, for example if the testing team gains access to personal data as part of the engagement. A non-disclosure agreement (NDA) does not replace a DPA but complements it. We clarify with you during scoping whether a security test will touch personal data.

    Learn more about Data Processing Agreement (DPA, German: AVV) Related service: Contact

  • DMZ (Demilitarized Zone)

    The DMZ is an isolated network segment between the internet and the internal network that hosts systems which must be reachable from the outside – such as web servers, mail gateways, or reverse proxies. Firewalls strictly control which connections are allowed from the internet into the DMZ and from there into the internal network. If a system in the DMZ is compromised, the separation is meant to prevent the attacker from reaching the corporate network directly; an infrastructure pentest shows whether it actually does.

    Learn more about DMZ (Demilitarized Zone) Related service: Network & Infrastructure

  • DORA (Digital Operational Resilience Act)

    DORA (Regulation (EU) 2022/2554) has applied since January 17, 2025, and harmonizes the requirements for the digital operational resilience of banks, insurers, payment service providers, and other financial entities in the EU. The regulation covers ICT risk management, the reporting of major ICT-related incidents, the management of ICT third-party service providers, and a digital operational resilience testing program. Selected financial entities must also carry out threat-led penetration testing (TLPT) on a regular basis.

    Learn more about DORA (Digital Operational Resilience Act) Related service: Financial Services

E

  • EDR / XDR (Endpoint / Extended Detection and Response)

    EDR solutions continuously monitor endpoints such as laptops and servers, detect suspicious behavior – such as passwords being read from memory – and can automatically isolate affected systems. XDR extends this approach by also correlating data from the network, email, cloud, and identity services. Whether detection works when it matters can only be verified with realistic attacks of the kind used in red teaming exercises.

    Learn more about EDR / XDR (Endpoint / Extended Detection and Response) Related service: Red Teaming & APT Simulation

  • Entra ID (formerly Azure Active Directory)

    Microsoft Entra ID is Microsoft’s cloud-based identity and access service and controls sign-in to Microsoft 365, Azure, and many other applications. Until 2023, the service was called Azure Active Directory, but it works fundamentally differently from classic, on-premises Active Directory. Typical risks include missing or inconsistently enforced MFA, gaps in Conditional Access policies, too many global administrators, and app registrations with excessive permissions.

    Learn more about Entra ID (formerly Azure Active Directory) Related service: Microsoft 365 & Azure Review

  • EU AI Act

    The EU AI Act (Regulation (EU) 2024/1689) is considered the first comprehensive law regulating artificial intelligence and follows a risk-based approach: certain practices are prohibited, and high-risk AI systems are subject to strict requirements. For high-risk systems, it requires, among other things, an appropriate level of accuracy, robustness, and cybersecurity – including protection against attacks such as data poisoning or manipulated inputs. The obligations apply in stages; security testing of AI applications helps meet the requirements in a verifiable way.

    Learn more about EU AI Act Related service: AI & LLM Penetration Testing

  • Evil Twin

    An evil twin is a fake Wi-Fi access point that mimics the network name (SSID) of a legitimate network – such as the corporate or guest Wi-Fi. When devices connect to the look-alike, the attacker can intercept traffic, harvest passwords via fake login pages, or, with insecurely configured enterprise Wi-Fi, capture credentials for the real network. Protection comes from consistent certificate validation with WPA2-Enterprise and WPA3-Enterprise and from employees who are aware of the risk.

    Learn more about Evil Twin Related service: Wireless Penetration Testing

  • Executive Summary

    The executive summary is the section of a pentest report written for executives and decision-makers. Without technical jargon, it describes what was tested, how secure the environment is, which risks the organization faces, and which actions take priority. This enables those responsible to make well-founded decisions about budgets and priorities, while the technical part of the report gives the specialist team the details they need for implementation.

    Learn more about Executive Summary Related service: Penetration Testing

  • Exploit

    An exploit is code – such as a program, a script, or a sequence of commands – that takes advantage of a specific vulnerability, for example to execute arbitrary commands, escalate privileges, or bypass protection mechanisms. Exploits are publicly available for many known vulnerabilities, which significantly lowers the bar for attackers. In penetration tests, we use controlled exploits to prove that a vulnerability can actually be exploited – always within the agreed scope and with consideration for ongoing operations.

    Learn more about Exploit Related service: Penetration Testing

F

  • Firmware

    Firmware is software permanently embedded in a device that controls its basic functions – from routers and industrial controllers to surveillance cameras. It often contains security-critical weaknesses such as hard-coded passwords, private keys, outdated open-source libraries, or unprotected update mechanisms. In a firmware analysis, the image is extracted, unpacked, and examined using reverse engineering to find such vulnerabilities.

    Learn more about Firmware Related service: OT, ICS/SCADA & IoT

G

I

K

  • Kerberoasting

    Kerberoasting is an Active Directory attack technique in which any domain user requests Kerberos service tickets for accounts with a service principal name (SPN). Because these tickets are encrypted with a key derived from the service account’s password, the attacker can crack them offline – without failed login attempts attracting attention. Long, random passwords or group managed service accounts (gMSA), as well as abandoning outdated RC4 encryption, mitigate the risk.

    Learn more about Kerberoasting Related service: Active Directory Assessment

  • KRITIS (Critical Infrastructure in Germany)

    KRITIS (Kritische Infrastrukturen) refers to organizations and facilities whose failure would lead to significant supply shortages or threats to public safety – for example, in the sectors of energy, water, food, healthcare, finance, transport and traffic, and information technology and telecommunications. Operators of critical facilities must implement state-of-the-art IT security, report significant security incidents, and regularly demonstrate their protective measures to the BSI. With the implementation of the NIS2 Directive, the group of regulated companies has also grown significantly.

    Learn more about KRITIS (Critical Infrastructure in Germany) Related service: Energy & Critical Infrastructure

L

M

N

  • NDA (Non-Disclosure Agreement)

    An NDA – also called a confidentiality agreement – obliges one or both contracting parties to keep confidential information they exchange secret and to use it only for a defined purpose. Before a penetration test, it protects sensitive details such as network diagrams, credentials, and test results. At the same time, an NDA can be one of the reasonable confidentiality measures that the German Trade Secrets Act requires for trade secrets to be legally protected. On request, we sign a non-disclosure agreement before scoping.

    Learn more about NDA (Non-Disclosure Agreement) Related service: Contact

  • Network Segmentation

    Network segmentation divides a network into separate zones – for example for clients, servers, administration, production, guests, and IoT devices – with only explicitly permitted connections between them. If an attacker breaks into one area, effective segmentation prevents them from spreading unhindered. In practice, firewall rules often deviate from the design; a segmentation test shows which connections between zones are actually open.

    Learn more about Network Segmentation Related service: Network & Infrastructure

  • NIS2

    The NIS2 Directive (EU) 2022/2555 raises the level of cybersecurity in the EU and covers significantly more companies than the previous rules – divided into important and essential entities from 18 sectors. Affected organizations must implement risk management measures, report significant security incidents within fixed deadlines, and also secure their supply chain; management is responsible for implementation. In Germany, the directive is implemented by the amended BSI Act (BSIG).

    Learn more about NIS2 Related service: Energy & Critical Infrastructure

O

P

  • Pass-the-Hash

    In a pass-the-hash attack, an attacker uses a stolen NTLM password hash directly to sign in to other systems – without needing to know the plaintext password. The attacker typically extracts the hashes from the memory or the local user database of a compromised computer. The technique is particularly dangerous when the same local administrator password is set on many computers; remedies include Windows LAPS, a tiered model for administrator accounts, and Credential Guard.

    Learn more about Pass-the-Hash Related service: Active Directory Assessment

  • Password Spraying

    In password spraying, an attacker tries a few commonly used passwords – such as “Summer2026!” – against a very large number of user accounts. Because only a few attempts are made per account, classic account lockouts don’t kick in, and the attack often goes unnoticed. Cloud logins such as Microsoft 365 are hit particularly often; MFA, password policies with banned-password lists, and monitoring of failed logins provide effective protection.

    Learn more about Password Spraying Related service: Microsoft 365 & Azure Review

  • Patch Management

    Patch management is the structured process of identifying, assessing, testing, and promptly installing security updates for operating systems, applications, firmware, and network devices. Many successful attacks exploit vulnerabilities for which an update had long been available. Effective patch management requires a complete inventory, clear responsibilities, deadlines based on criticality, and regular vulnerability scans that show where updates are missing.

    Learn more about Patch Management Related service: Vulnerability Assessment

  • Penetration Test (Pentest)

    A penetration test is an authorized, simulated attack on IT systems, applications, or processes in which experts use the methods of real attackers to search for exploitable vulnerabilities. Unlike an automated scan, it manually checks whether vulnerabilities can actually be exploited and combined, and what the consequences would be. The result is a report with verifiably documented findings, a risk assessment, and specific remediation recommendations.

    Learn more about Penetration Test (Pentest) Related service: Penetration Testing

  • Pentest Report

    The pentest report documents the scope, approach, and results of a penetration test. A good report addresses two audiences: the executive summary puts the results into context for management, while the technical part describes each vulnerability in a reproducible way with evidence, a CVSS rating, and a specific remediation recommendation. At Rootsektor, you also receive a test certificate that you can use to demonstrate the test to customers, partners, insurers, and auditors.

    Learn more about Pentest Report Related service: Penetration Testing

  • Phishing

    Phishing refers to fraudulent messages, usually sent by email, with which attackers try to get recipients to disclose credentials, open malware, or initiate payments. Targeted variants such as spear phishing use personally tailored content to target individuals, for example in accounting or senior management. Technical filters catch a lot, but not everything – that’s why trained employees and realistic phishing simulations are a key part of the defense.

    Learn more about Phishing Related service: Security Awareness & Phishing Simulation

  • PLC (Programmable Logic Controller)

    A PLC – in German, speicherprogrammierbare Steuerung (SPS) – is an industrial computer that controls machines and equipment in real time based on a control program. It reads in sensor values, processes them, and switches actuators such as motors, valves, or pumps. Many PLCs can be reprogrammed over the network with no or only weak authentication – an attacker with network access can thus intervene directly in physical processes.

    Learn more about PLC (Programmable Logic Controller) Related service: OT, ICS/SCADA & IoT

  • Privilege Escalation

    In privilege escalation, an attacker gains higher privileges than they are entitled to – for example, from a regular user account to local administrator or from domain user to domain admin. Causes include unpatched vulnerabilities, incorrectly set file permissions, insecurely configured services, or passwords stored in plaintext. There are two forms: vertical privilege escalation, in which an ordinary account gains administrator functions, for example, and horizontal privilege escalation, in which an attacker accesses the data of other accounts at the same level.

    Learn more about Privilege Escalation Related service: Network & Infrastructure

  • Prompt Injection

    Prompt injection is an attack technique against applications built on large language models: crafted text overrides the application’s system instructions, causing the model to ignore safeguards, reveal internal information, or trigger unintended actions via connected tools. In the direct variant, the instructions are in the user input; in the indirect variant, they are hidden in content the model processes – such as websites, emails, or documents. The OWASP Top 10 for LLM Applications ranks prompt injection first.

    Learn more about Prompt Injection Related service: AI & LLM Penetration Testing

  • Purple Teaming

    In purple teaming, attackers (red team) and defenders (blue team) work together openly and closely instead of facing each other as in a covert exercise. The red team executes attack techniques step by step – often along MITRE ATT&CK – while the blue team checks whether and how its systems detect them. This allows gaps in detection and response to be closed immediately and tested again. Rootsektor offers purple teaming as a variant of, or complement to, red teaming.

    Learn more about Purple Teaming Related service: Red Teaming & APT Simulation

R

  • Ransomware

    Ransomware is malware that encrypts data and systems in order to extort a ransom for decryption. Today, attackers usually also steal data beforehand and threaten to publish it (double extortion). The most effective defenses against ransomware are consistently closing entry points such as unpatched VPN gateways, a segmented infrastructure, separate administrator accounts, and regularly tested offline backups. If an attack has already happened: disconnect affected systems from the network, but don’t switch them off, and get expert help immediately.

    Learn more about Ransomware Related service: Ransomware Response

  • RCE (Remote Code Execution)

    Remote code execution refers to vulnerabilities that allow an attacker to run their own code on someone else’s system remotely. Causes include insecure deserialization, command or template injection, unchecked file uploads, or memory corruption bugs. Because RCE often allows complete takeover of a server, such flaws are among the most critical findings of a penetration test.

    Learn more about RCE (Remote Code Execution) Related service: Web Applications & Online Shops

  • Red Team

    A red team simulates a real, targeted attacker and tries over an extended period to achieve a predefined objective – such as access to financial data or production systems. Unlike a classic penetration test, the goal is not to find as many vulnerabilities as possible but to carry out a realistic attack chain across technical, human, and physical vectors. At the same time, the exercise shows whether your organization detects the attack and responds appropriately; in an APT simulation, the approach is modeled on the techniques of professional threat actor groups.

    Learn more about Red Team Related service: Red Teaming & APT Simulation

  • Retest

    In a retest, the reported vulnerabilities are checked again after remediation to verify that they have been effectively closed. Only the retest confirms that the remediation actually works – often a prerequisite for demonstrating a remediated state to auditors or customers. For Rootsektor penetration tests and security assessments, the retest of remediated vulnerabilities is free of charge.

    Learn more about Retest Related service: Pentest Quote

  • Reverse Engineering

    Reverse engineering is the analysis of a finished product to understand its structure and how it works – in IT security, usually software, apps, firmware, or communication protocols without access to the source code. Programs are disassembled or decompiled, and their runtime behavior is observed. This can uncover hidden functions, hard-coded credentials, weak cryptography, or vulnerabilities in proprietary protocols.

    Learn more about Reverse Engineering Related service: Code Review & Reverse Engineering

  • Rogue Access Point

    A rogue access point is an unauthorized Wi-Fi access point on the corporate network – such as a router connected for convenience or a device hidden by attackers. Because it provides access to the internal network that bypasses the central security architecture, it circumvents firewalls and access controls. Wireless intrusion prevention systems (WIPS), port-based network access control based on IEEE 802.1X, and regular wireless scans help track down such devices.

    Learn more about Rogue Access Point Related service: Wireless Penetration Testing

  • Rules of Engagement (RoE)

    The rules of engagement set out in binding terms, before a penetration test or red teaming engagement, how testing will be carried out: target systems and exclusions, testing periods, permitted and prohibited techniques, contacts, and escalation paths – for example, who is notified immediately of critical findings. They protect both sides and ensure that the test does not impair ongoing operations in an uncontrolled way. Together with the written engagement, they provide the basis on which a simulated attack is authorized and therefore lawful.

    Learn more about Rules of Engagement (RoE) Related service: Red Teaming & APT Simulation

S

T

V

W

  • WAF (Web Application Firewall)

    A web application firewall filters HTTP traffic to web applications and blocks typical attack patterns such as SQL injection or cross-site scripting before they reach the application. It is a useful additional layer of protection but does not replace secure coding: cleverly obfuscated attacks and logic flaws, such as in authorization checks, usually go undetected by a WAF. For penetration tests, we agree with you whether to test with the WAF active or directly against the application.

    Learn more about WAF (Web Application Firewall) Related service: Web Applications & Online Shops

  • White-Box Testing

    In white-box testing, the testing team receives comprehensive insight: architecture and configuration documentation, accounts with different privileges, and, on request, the source code. This enables the most thorough assessment, because vulnerabilities that are difficult or impossible to find from the outside also become visible. The approach is particularly suitable for critical applications, before go-live, and in combination with a code review.

    Learn more about White-Box Testing Related service: Penetration Testing

  • WPA3

    WPA3 is the current security standard for Wi-Fi networks and is gradually replacing WPA2. In Personal mode, SAE (Simultaneous Authentication of Equals) replaces the previous pre-shared key authentication, so captured handshakes can no longer be cracked offline with dictionary attacks; in addition, protected management frames are mandatory. In mixed operation with WPA2 (transition mode) or with a faulty configuration, however, attacks remain possible.

    Learn more about WPA3 Related service: Wireless Penetration Testing

X

Z

  • Zero Trust

    Zero trust is a security model based on the principle “never trust, always verify”: no person, device, or network segment is automatically considered trustworthy – not even inside the corporate network. Every access request is checked based on identity, device state, and context and granted only with the minimum necessary privileges. Zero trust is not a single product but an architecture that is introduced step by step, for example through strong authentication, microsegmentation, and continuous monitoring.

    Learn more about Zero Trust Related service: Network & Infrastructure

  • Zero-Day

    A zero-day vulnerability is a security flaw that is still unknown to the vendor or for which no patch exists yet – defenders have had “zero days” to respond. Exploits for such flaws are particularly valuable and are used for targeted attacks or sold at high prices. Since updates don’t help here, what matters is hardening, segmentation, least privilege, and attack detection that doesn’t rely solely on known signatures. A penetration test shows how far an attacker would get after a successful breach.

    Learn more about Zero-Day Related service: Penetration Testing

Which of these terms affect your organization?

Knowing the terms is the first step – a penetration test shows which vulnerabilities in your systems can actually be exploited. After scoping, you’ll receive a fixed-price quote within 24 hours (on business days).

Request a pentest quote

Related pages

Can’t find a term?

Missing a technical term or have a specific question about the security of your systems? Write to us using the form or call us at +49 2932 465265-0 – we’re happy to explain.

Fields marked with * are required.

For questions or a callback

We will get in touch and, if you wish, sign the non-disclosure agreement before our first conversation – including on the basis of your own template.

We use your information solely to process your request. For more information, see our privacy policy. Please do not send passwords or login credentials through this form.