Software-security domain ontology — the software-facing slice of security: threats, vulnerabilities, controls, actors, indicators, supply-chain, incidents, frameworks
Attack tactics, malware, and threat techniques
Attack campaigns and threat-intelligence reports
An adversary tactical objective (the why of a technique)
A course of action that mitigates one or more ATT&CK techniques
Describes the range of techniques adversaries commonly employ to gain initial entry into a network, from social engineering via phishing to exploitation of unpatched systems and abuse of legitimate credentials.
Software features or system components that can be selectively restricted or disabled to prevent their abuse by adversaries, including legacy protocols, scripting engines, and unnecessary services.
A large-scale compromise of a third-party managed file-transfer platform used by thousands of organizations, resulting in unauthorized data access and exfiltration through exploitation of a critical software vulnerability.
Compromise of a widely-used open-source package through insertion of obfuscated malicious code in build scripts or test files, targeting a critical downstream dependency used by millions of systems.
A coordinated multi-phase attack operation targeting critical infrastructure, using wiper-style payloads and network spreading techniques to cause widespread disruptive impact across interconnected systems.
A legitimate domain registered to support a kill-switch mechanism, serving to disable or control the behavior of a self-replicating worm if the kill-switch domain can be contacted.
An extortion and encryption attack offered as a service, where criminals provide the ransomware toolkit and infrastructure in exchange for a percentage of recovery payments from victims.
Stuxnet is cataloged as malware, but researchers attribute its development to a joint US-Israel operation targeting Natanz's centrifuges, a threat-actor question, not a malware catalog entry.
A CVE vulnerability instance in a product or component
An SBOM alone flags every CVE in its listed components; a VEX document, in OpenVEX or CSAF format, is what lets a vendor formally declare a finding unreachable and not affected.
A CWE weakness class (a flaw type, distinct from a CVE instance)
A security control or safeguard (the security specialization of the generic engineering-base `control`)
A prescriptive safeguard requires that code changes be reviewed and approved by a second person before merging, enforced through branch protection settings that reject pushes lacking required review status.
An allowlist-based input validation design pattern rejects any input that does not match a known-safe pattern rather than trying to blacklist dangerous patterns, reducing the risk of bypass attacks.
The failure to properly encode or sanitize user-supplied HTML and JavaScript in web application output, allowing an attacker to inject malicious scripts that execute in the browser of victim users.
Zero-trust adoption was driven by the Colonial Pipeline breach, where one compromised VPN credential without MFA gave broad network access, a perimeter-model failure, not a threat-actor catalog entry.
Falco detects runtime threats via kernel syscall events, such as a write to /etc/shadow, filling the gap static scanners and OPA/Gatekeeper miss, it's a security tool, not a threat actor.
An organized series of coordinated attacks targeting multiple major corporations, employing sophisticated phishing and zero-day exploitation techniques to achieve intellectual property theft and surveillance access.
A tiered command-and-control infrastructure consisting of multiple staged relay servers and domain registrations designed to obscure the true location and origin of attack communications.
An attack vector leveraging weak credential validation at login endpoints, allowing unauthorized access through reuse of previously compromised username-password pairs across multiple services.
A sophisticated, state-sponsored cyberweapon designed to target industrial control systems, featuring self-propagation across USB devices and zero-day exploitation of multiple operating system components.
A continuous process of collecting, analyzing, and responding to security events and anomalies across an organization's infrastructure to detect unauthorized access, data exfiltration, and malicious activity.
A large-scale retail data breach targeting millions of customer payment card records through exploitation of inadequately segmented network architecture and unpatched point-of-sale systems.
A grouping of adversarial behaviour over a period of time
An observable pattern that indicates malicious activity
Adversary or defensive infrastructure (servers, domains, hosting)
A package manager automatically verifies a cryptographic checksum against a public transparency log before trusting a downloaded module
An extension marketplace now requires developer-registered private-key signing on every future upload, rejecting anything unsigned
An official plugin directory applies automated security review to listings but explicitly cannot verify every server a plugin might call
Enforcing mTLS at the service-mesh layer guarantees workload-identity-authenticated encryption on every internal connection, rejecting perimeter-only segmentation as insufficient against post-foothold lateral movement.
A legitimate tool that can be used by adversaries or defenders
A package manager's chain-of-trust verifies a signed release manifest against trusted keys before installing anything, blocking by default on failure
A command-line tool verifies a file's signature keylessly by pinning a certificate identity and issuer rather than a static key
A package manager's opt-in attestation verification wraps another CLI tool to hard-fail an install when provenance verification fails
A TLS/SSL fingerprint artifact associated with a particular remote-access framework, allowing defenders to identify command-and-control communications even when encrypted.
Cobalt Strike team servers serve both authorized red teams and criminal C2 infrastructure; defenders fingerprint them via JA3/JARM TLS and malleable-C2 beacon-interval analysis rather than default signatures.
A curated threat-intelligence report grouping related CTI objects
Mean time to detect (MTTD) and dwell time together measure the elapsed time from when a breach occurs (or evidence of compromise is logged) to when security operations detect and confirm it, serving as a key indicator of detection capability maturity.
A sophisticated, long-duration attack operation targeting industrial control systems and critical infrastructure, employing living-off-the-land techniques and prioritizing stealth and persistence over disruptive impact.
Equifax attackers lingered roughly 76 days, exfiltrating data on nearly half the US population, leading to a $700 million FTC settlement, a report on patch-delay consequences, not a threat actor.
A cyber supply-chain (C-SCRM) supplier or component risk
A package registry verifies integrity only by checksum, with no cryptographic signing yet, leaving a gap versus other language ecosystems
A verification command silently returned success even when no attestation existed at all, until a later patched version fixed it
An attacker compromised a maintainer's credentials and repointed every version tag of a widely used action to a malicious commit
A security policy grounded in an OSCAL system security plan / profile
An API gateway deployed as a policy enforcement point is a design pattern where all service-to-service requests flow through a gateway that applies authentication, authorization, and rate-limiting rules before forwarding.
The implementation of multi-factor authentication across all user authentication endpoints as a required technical control for reducing unauthorized access risk through credential compromise.
Technical implementation of cryptographic algorithms and key-management procedures for protecting data at rest and in transit, including cipher-strength requirements and key-derivation practices.
A security assessment, audit, or test of a system
Unlike a fixed-duration penetration test, a bug bounty program run through a platform like HackerOne or Bugcrowd operates continuously with a defined scope, an ongoing practice, not a discrete assessment.
A control runs at push time to detect credentials matching known patterns before they reach shared branches, paired with a documented incident-response runbook for when real credentials are detected as already pushed.
The metric tracking the number of open critical security findings in the backlog measures the aggregate count of unresolved vulnerabilities above a severity threshold, updated daily to reflect the current remediation queue depth.
The fail-secure design pattern ensures that when a system encounters an error or component failure, it defaults to denying access or rejecting operations rather than inadvertently granting permissions.
A security design review gate discipline requires that all architectural changes above a size threshold undergo formal security design review by the security team before implementation, documenting the threat model and mitigations.
A dual-purpose network utility that performs port scanning and service enumeration through TCP/IP-level probes, equally useful for both legitimate infrastructure inventory and attacker reconnaissance.
A behavioral pattern in Windows Event Logs showing access to the LSASS process memory in a manner consistent with credential extraction, used to identify systems with unauthorized access activity.
A documented remediation plan that schedules correction of identified compliance deficiencies against a baseline security framework, including specific actions, responsible parties, and target completion dates.
A compliance requirement from a payment-card security standard for maintaining separate network segments containing systems that store, process, or transmit cardholder data.
A plan of action and milestones tracking risks to remediation
A coordinated vulnerability disclosure process discipline defines the steps for responsible reporting of security flaws (notification timelines, embargo periods, credit assignment) to avoid alarming users before patches are available.
A security threat, attack class, or vulnerability affecting the software lifecycle (SDLC-facing supertype refined by attack-tactic/weakness/vulnerability)
Malicious instructions embedded in tool descriptions parsed as trusted context
Silently altering approved tool definitions to inject behavior without re-authorization
A command injection chain of published vulnerabilities sharing one unsanitized root cause
Poisoned release tags exfiltrating credentials from continuous integration
Generating an SBOM automatically at build time, rather than manually, was chosen because the Log4j incident showed exposure often traces through unexpected transitive dependencies, not itself a security threat.
Mean time to remediation (MTTR) for critical vulnerabilities measures the elapsed time from a critical vulnerability being identified to a fix being deployed to production, tracked as a team performance metric to monitor patch velocity.
Threat modeling using STRIDE is an engineering practice where teams systematically enumerate potential security threats to a system across spoofing, tampering, repudiation, information disclosure, denial of service, and elevation categories.
The improper handling of special characters in user-supplied input when constructing database queries allows attackers to manipulate query logic and gain unauthorized access to sensitive data.
A vulnerability in a transitive dependency inherited through a software package's supply chain, exposing downstream applications to exploitation even though the application itself has no direct vulnerable code.
Physical or logical isolation of security-critical network segments from general-purpose networks to limit the blast radius of a compromise and prevent lateral movement across organizational boundaries.
An exploitation framework providing payload generation, multi-stage delivery, and post-exploitation automation for penetration testers, equally valuable for defenders simulating attacks and adversaries conducting real intrusions.
ATT&CK technique/sub-technique (e.g. T1566) or CAPEC ID
A security or assurance framework, taxonomy, or standard (e.g. OWASP Top 10, MITRE ATLAS, SLSA, NIST SSDF/CSF)
A peer-reviewed top-ten risk taxonomy for an emerging application class
A provenance standard defining leveled requirements from machine-readable to isolated builds
A management-system standard with a reference set of controls in an annex
Federal guidance organizing risk actions across govern, map, measure, and manage functions
A secure SDLC gating discipline requires that each stage of the software development lifecycle (design, development, testing, deployment) must pass defined security criteria and automated scans before proceeding to the next stage.
Under DoD RMF, a POA&M, tracked operationally in eMASS, is the remediation record an Authorizing Official reviews; RMF is the framework itself, not the POA&M.
A classification scheme for sensitive data based on compliance frameworks, including categories like public, internal-use-only, confidential, and restricted, with associated handling and protection requirements.
What the framework governs (e.g. application risk, supply-chain integrity, adversary TTPs)
Organization that maintains the framework
How it relates to or composes with other frameworks
Framework version/edition (e.g. CSF 2.0, OWASP Top 10:2025)
Framework structure (e.g. CSF: 6 functions / 22 categories / 106 subcategories)
A security breach/incident carrying the VERIS four A's (Actor + Action + Asset + Attribute)
VERIS Actor — external / internal / partner
VERIS Action — malware / hacking / social / error / misuse
A campaign is attributed to a threat actor (stix:attributed-to)
A weakness class categorizes a vulnerability instance (CWE CanPrecede / rdfs:subClassOf)
A framework defines a control (OSCAL profile import->include-controls)
A threat-intelligence report documents a campaign (STIX Report object_refs)
Malware exploits a vulnerability (stix:exploits, Malware -> Vulnerability)
Infrastructure hosts malware (stix:hosts, Infrastructure -> Malware)
An indicator of compromise indicates malware (stix:indicates, Indicator -> Malware)
A mitigation mitigates a threat technique (stix:mitigates, course-of-action -> attack-pattern)
A control mitigates a vulnerability (RO:0000056 participates-in; OSCAL control satisfies risk)
An incident realizes a threat (RO:0000056 participates-in)
A POA&M tracks a vulnerability to remediation (OSCAL poam:risks / poam-item)
A threat actor uses a security tool (stix:uses, threat-actor -> tool)
\b(APT\d+|Lazarus Group|FIN\d+|Sandworm|Volt Typhoon)\b
\b(IOC|YARA|Sigma rule|STIX pattern|TLP:)\b
\b(pen test|red team|audit finding|compliance review)\b
\b(acceptable use policy|data classification policy)\b
\b(Mimikatz|WannaCry|Cobalt Strike|S\d{4})\b