←All the glossaryGlossary

Cyber

The vocabulary of digital risk as it is underwritten and settled: attack patterns, defensive measures, accumulation, and the clauses through which a contract names or silences cyber.

253 terms

Accidental cyber Accumulation and aggregation Active Directory compromise Advanced persistent threat (APT)Air gap ALPHV (BlackCat)Anticipatory collection Application control (allowlisting)APT28 (Fancy Bear, GRU Unit 26165)APT29 (Cozy Bear, SVR)APT41 (Double Dragon)Ascension ransomware attack (2024)Attribution of a cyber operation to a state Backup restore testing Betterment cover (cyber)Big game hunting Blockchain analytics Botnet Breach call center Breach coach Bricking Bring your own vulnerable driver (BYOVD)British Library cyberattack (2023)Business Email Compromise (BEC)Bybit hack (2025)Bystander cyber asset (LMA cyber war clauses)Bystanding cyber asset CDK Global attack (2024)Chain of custody (digital evidence)Chain-hopping Change Healthcare CIS Critical Security Controls Citrix Bleed (CVE-2023-4966)CL380 Institute Cyber Attack Exclusion Clause Cloud security posture management (CSPM)CNA Financial ransom (2021)Cobalt Strike Colonial Pipeline attack Combined tech E&O and cyber policy Command and control infrastructure (C2/C&C)Commercial spyware Conditional access Conti (ransomware group)Cost of a Data Breach Report (IBM and Ponemon)Credential stuffing Credit and identity monitoring Crisis communication costs Critical ICT third-party provider (DORA CTPP)CrowdStrike outage (July 2024)Cryptographic provenance Cryptojacking CVE and CVSS score Cyber act Cyber crisis exercise Cyber Essentials (United Kingdom)Cyber extortion cover Cyber hygiene Cyber incident Cyber incident response panel Cyber insurance application Cyber kill chain Cyber Monitoring Center Cyber operation (LMA cyber war definition)Cyber Safety Review Board (CSRB)Cyberattack on Polish energy sites (December 2025)Cyberattacks on Estonia (2007)Cyberterrorism Dark web Data and system restoration Data encryption Data exfiltration Data mining and document review DDoS attack (Distributed Denial of Service)Deepfake Defend forward and persistent engagement Digital forensics DMARC, SPF and DKIM Domain generation algorithm (DGA)Double extortion Düsseldorf University Hospital ransomware attack (2020)Dwell time EBIOS Risk Manager eBPF (Extended Berkeley Packet Filter)EDR / XDR (Endpoint Detection and Response / Extended Detection and Response)End-of-life software EPSS (Exploit Prediction Scoring System)Equifax data breach (2017)Essential Eight (Australia)Essential service EternalBlue Exploit Exposed remote desktop (RDP)False flag (cyber)FBI IC3 report (Internet Crime Report)First-party cyber covers Fraud-as-a-service Government internet shutdown and insurance Hack-and-leak operation Hacktivism Hive takedown (2023)Honeypot Hybrid warfare (gray-zone conflict)Hypervisor ransomware Immutable and isolated backups Impacted state (LMA cyber war exclusion)Incident response Incident response retainer Indicators of compromise (IoC)Indirect prompt injection Infostealer Infrastructure exclusion (cyber)Initial Access Broker (IAB)Injection attack Insider threat Irish Health Service Executive cyberattack (HSE, 2021)IT Army of Ukraine IT asset inventory Jaguar Land Rover cyberattack (2025)Joint public attribution KA-SAT satellite network attack (2022)Kaseya VSA attack (2021)Kernel mode and Blue Screen of Death (BSoD)Kill switch Killnet Known Exploited Vulnerabilities catalog (KEV)Kyivstar cyberattack (2023)LAPS (Local Administrator Password Solution)Lateral movement Lazarus Group (North Korea)Legacy authentication Liveness detection Living off the land (LotL)Local administrator rights LockBit Log4Shell Logging and log retention Man-in-the-middle attack (MitM)Managed service provider (MSP)Media liability Medical device cybersecurity Merck v. ACE American MFA (multi-factor authentication)MFA fatigue attack MGM Resorts and Caesars attacks (2023)Mirai (IoT botnet, 2016)MITRE ATT&CK (attack techniques)Mondelez v. Zurich MOVEit campaign (2023)National CSIRT (computer security incident response team)NCSC (National Cyber Security Centre, United Kingdom)Network security and privacy liability Network segmentation No More Ransom Notification costs NotPetya (2017) and the war exclusion disputes Office macro blocking Olympic Destroyer (Pyeongchang Games, 2018)Operation Aurora (2010)Operation Cronos Operation Duck Hunt (Qakbot, 2023)Operation Endgame (2024)OPSEC (operational security)Outside-in attack surface scanning Password policy Patch management PCI DSS and card network assessments Penetration testing (pentest)Personal liability of the CISO Phishing Phishing-resistant MFA Post-incident root cause analysis Post-quantum cryptography Pre-positioning in critical infrastructure Privacy coin Privilege escalation Privileged access management (PAM)Protective DNS (DNS filtering)ProxyLogon (Microsoft Exchange, 2021)QR code phishing (quishing)Questionnaire-to-scan discrepancy Race condition Ransomware Ransomware as a Service (RaaS)Ransomware attacks on hospitals Ransomware coinsurance Ransomware data leak site Ransomware negotiator Recovery time and recovery point objectives (RTO and RPO)Red teaming Reputational harm cover REvil (Sodinokibi)Ronin bridge hack (2022)Rootkit Salt Typhoon (telecom carrier espionage)Sandworm (GRU Unit 74455)SCADA system Scattered Spider Secure email gateway (SEG)Security awareness training and phishing simulation Security rating Service accounts Session hijacking Shadow IT Shamoon (Saudi Aramco, 2012)Side-channel attack SIEM and SOAR Silent cyber (non-affirmative cyber)SIM swapping Single Point of Failure (cyber accumulation)Snowflake customer campaign (2024)SOC / CIRT (Security Operations Center / Cyber Incident Response Team)SOC 2 report Social engineering Software bill of materials SolarWinds (Sunburst) compromise Sony Pictures hack (2014)Spear phishing State cyber proxy Storm-0558 (Microsoft cloud email intrusion, 2023)Stuxnet Substitutability Sud Francilien hospital (CHSF) ransomware attack (2022)Supply chain attack Synnovis attack (2024)Synthetic identity System failure cover (non-malicious)Systemic cyber risk Technical security debt Telephone hacking (toll fraud)Threat hunting Threat intelligence (cyber threat intelligence)Tiered administration model Time deductible Tornado Cash sanctions Triton / Trisis (2017)TV5Monde attack (2015)Typosquatting Uber breach cover-up (2016)Ukrainian power grid attacks (2015 and 2016)UN Regulations R155 and R156 (vehicle cybersecurity)Unpatched vulnerability exclusion Verizon DBIR (Data Breach Investigations Report)Voluntary shutdown VPN and remote access Vulnerability management WannaCry Watering-hole attack WhisperGate (Ukraine, January 2022)Wiper malware Written incident response plan xz Utils backdoor (2024)Zero trust architecture Zero-day vulnerability

Other categories

Insurance Reinsurance Actuarial science AI Law & regulation Finance Markets Special risks Sustainable insurance Infrastructure & data centers Space risks Alternative risk transfer Transport Life & protection Claims & settlement Construction Credit & surety