Learn
Plain-language, vendor-neutral definitions of the ideas behind modern cyber and operational risk — digital twins, Value at Risk and exceedance curves, shadow access and configuration drift, NIST 800-171 and CMMC. Short enough to read in a minute, with links when you want more.
Digital twin (cybersecurity)
A continuously updated virtual model of an IT environment, built from live telemetry.
ReadValue at Risk (VaR)
An estimate of potential loss over a period at a given confidence level.
ReadMonte Carlo simulation
A method that models uncertainty by sampling many randomized outcomes into a distribution.
ReadCyber Value at Risk (Cyber VaR)
Value at Risk applied to cybersecurity — expected and tail losses from cyber events, in dollars.
ReadBlast radius
The extent of systems and data an attacker could reach from an initial foothold.
ReadAttack surface management (ASM)
The continuous discovery and monitoring of an organization's exposed, attackable assets.
ReadNIST SP 800-171
A U.S. standard of 110 controls across 14 families for protecting Controlled Unclassified Information.
ReadCMMC
The U.S. DoD framework for verifying contractors implement required security controls.
ReadCyber risk quantification (CRQ)
Expressing cyber risk as money — a loss distribution and a value at risk — instead of colors or scores.
ReadLoss exceedance curve
A curve showing the probability that annual loss will exceed any given amount.
ReadConditional Value at Risk (CVaR)
The average loss in the worst cases beyond the VaR threshold — a measure of tail risk.
ReadShadow access
Access that is being used without any matching grant in the identity provider.
ReadDormant privilege
A grant that exists but has not been used for a long time — standing access only an attacker will exercise.
ReadConfiguration drift
The gap between the configuration a device should run and the one it actually runs.
ReadGolden configuration
The approved, known-good configuration a device or service is supposed to run.
ReadSingle point of failure (SPOF)
An asset whose failure takes down a disproportionate share of what depends on it.
Read