Essential Cybersecurity Acronyms: The Practitioner’s Decoder Ring

By Manny Fernandez

October 12, 2026

Essential Cybersecurity Acronyms: The Practitioner’s Decoder Ring

27 acronyms you will hear in every SOC standup, vendor pitch, and audit meeting, explained in plain language with the context that actually matters.

Security is a field that speaks fluent alphabet soup. Sit in on a single incident bridge and you will hear someone say the EDR flagged an IOC tied to a known APT, the SIEM correlated it, SOAR kicked off a playbook, and the WAF is already blocking the RCE attempt. If you are new to the field, that sentence is noise. If you have been around a while, you probably still nod along to one or two acronyms you could not define on a whiteboard.

This guide breaks the essentials into four buckets: Vulnerabilities and Exploits, Threat Intel and Response, Network and Infrastructure, and Compliance, Governance and Identity. For each one you get the expansion, a plain-language definition, and a practitioner note on where it shows up in real work. At the end there is a section on the pairs people mix up most often, and a one-page quick reference table.

1. Vulnerabilities & Exploits

RCE, XSS, SQLi, CSRF, LFI / RFI, SSRF

2. Threat Intel & Response

IOC, TTPs, APT, EDR / XDR, SIEM, SOAR

3. Network & Infrastructure

SASE, ZTNA, VPN / IPsec, WAF, NAC

4. Compliance, Governance & Identity

IAM / IDaaS, MFA / 2FA, GRC, TPRM, DLP

1. Vulnerabilities & Exploits

These are the attack classes. Knowing them tells you what a scanner finding or a CVE advisory actually means for your environment, and which control is supposed to stop it.

RCE: Remote Code Execution

A flaw that lets an attacker run their own commands or code on a target system over the network, without physical access. RCE is the outcome many other bugs lead to: deserialization flaws, command injection, memory corruption, and unsafe file uploads can all end in RCE.

Practitioner note: When an advisory says “unauthenticated RCE” on an internet-facing appliance, that is a drop-everything patch. Pair the patch with egress filtering, because a working exploit almost always calls home next.

XSS: Cross-Site Scripting

An attacker gets a web application to deliver malicious JavaScript to another user’s browser. The script runs with the trust of the vulnerable site, so it can steal session cookies, rewrite the page, or perform actions as the victim. The three flavors are Reflected (in the request), Stored (saved in the app, like a comment), and DOM-based (entirely client-side).

<!-- Classic reflected XSS test string -->
<script>alert(document.domain)</script>

Practitioner note: Output encoding and a strict Content-Security-Policy header are the real fixes. A WAF signature is a useful safety net, not a substitute.

SQLi: SQL Injection

User input is concatenated directly into a database query, so the attacker can change the query’s logic. Outcomes range from bypassing a login to dumping every table in the database to, in some configurations, executing operating system commands.

-- Input: ' OR '1'='1
SELECT * FROM users WHERE name = '' OR '1'='1';

Practitioner note: Parameterized queries (prepared statements) eliminate the bug class. If you see string concatenation building SQL in a code review, flag it every time.

CSRF: Cross-Site Request Forgery

A malicious page tricks a logged-in user’s browser into sending a request to a trusted site, such as changing an email address or transferring funds. The browser attaches the user’s session cookie automatically, so the target site thinks the user meant it.

Practitioner note: Anti-CSRF tokens and the SameSite cookie attribute (Lax or Strict) are the standard defenses. Modern browsers default to SameSite=Lax, which has made classic CSRF much rarer, but not extinct.

LFI / RFI: Local / Remote File Inclusion

The application takes a file path from user input and includes or reads it. LFI reads files already on the server (configuration files, /etc/passwd, logs). RFI pulls in a file from an attacker-controlled URL and executes it, which usually means instant RCE.

GET /index.php?page=../../../../etc/passwd

Practitioner note: Closely related to path traversal. Allow-list the files an application may load, and never pass raw user input to include, require, or file open functions.

SSRF: Server-Side Request Forgery

The attacker convinces a server to make an HTTP request on their behalf, often to internal systems the attacker cannot reach directly. The classic cloud target is the instance metadata service, which can hand out temporary credentials.

GET /fetch?url=http://169.254.169.254/latest/meta-data/

Practitioner note: Enforce IMDSv2 on AWS, block link-local and RFC 1918 destinations from application egress where possible, and validate URLs against an allow-list rather than a block-list.

2. Threat Intel & Response

This is the language of the SOC: how threats are described, detected, and handled once they are inside the walls.

IOC: Indicator of Compromise

A forensic artifact that suggests a system has been breached: a malicious file hash, a known command-and-control IP address or domain, a suspicious registry key, or an unusual user agent string.

Practitioner note: IOCs are fast to share and easy to block, but also easy for attackers to change. A new IP costs them a few dollars. Treat IOC feeds as useful but perishable.

TTPs: Tactics, Techniques, and Procedures

A description of how an adversary operates. Tactics are the goal (for example, credential access), techniques are the method (for example, dumping LSASS memory), and procedures are the specific implementation a particular group uses.

Practitioner note: TTPs are the language of the MITRE ATT&CK framework. Detecting behavior instead of artifacts is harder to build but far harder for an attacker to evade, because changing how you operate is expensive.

APT: Advanced Persistent Threat

A well-resourced, patient adversary, often nation-state sponsored or a top-tier criminal group, that gains access and stays quietly for months to steal data or position for disruption. Groups are tracked with names like APT29 or numbered designations from various vendors.

Practitioner note: The word that matters is “persistent.” APT activity is about long dwell time, so your detection strategy needs to look for living-off-the-land behavior, not just malware.

EDR / XDR: Endpoint Detection & Response / Extended Detection & Response

EDR is an agent on laptops and servers that records process, file, registry, and network activity, detects malicious behavior, and lets responders isolate a host or kill a process remotely. XDR extends that model by correlating telemetry across multiple control points (endpoint, network, email, identity, cloud) into a single incident view.

Practitioner note: EDR replaced signature-only antivirus as the endpoint baseline. When evaluating XDR, ask which data sources are native versus integrated, because “extended” varies a lot between vendors.

SIEM: Security Information and Event Management

A platform that collects logs from across the environment, normalizes them, stores them for search and retention, and runs correlation rules to raise alerts. It is the central record for investigations and for compliance log retention.

Practitioner note: A SIEM is only as good as the logs going into it and the rules running on it. Start with high-value sources (identity, firewall, EDR, DNS) before ingesting everything.

SOAR: Security Orchestration, Automation, and Response

A platform that runs automated playbooks across your security tools. When an alert fires, SOAR can enrich it with threat intel, query other systems, open a ticket, and take containment actions such as blocking an IP or disabling an account.

Practitioner note: Automate the boring, repeatable enrichment steps first. Fully automated containment needs high-confidence detections behind it, or you will end up blocking your own CEO.

3. Network & Infrastructure

These are the architecture and control acronyms. They describe how traffic is secured, who is allowed to connect, and where enforcement happens.

SASE: Secure Access Service Edge

An architecture, coined by Gartner, that converges wide area networking (SD-WAN) with cloud-delivered security services (secure web gateway, CASB, ZTNA, firewall as a service) so users get consistent policy whether they are in the office, at home, or on the road.

Practitioner note: SASE is a model, not a single product. Ask vendors whether networking and security run on one platform with one policy engine, or are stitched together from acquisitions.

ZTNA: Zero Trust Network Access

Grants access to specific applications, not entire networks, after verifying the user’s identity and the device’s posture on every session. Users never land on the network the way they do with a traditional VPN.

Practitioner note: ZTNA is often pitched as a VPN replacement. In practice most organizations run both for a while, moving web and well-defined apps to ZTNA first and leaving legacy protocols on VPN.

VPN / IPsec: Virtual Private Network / Internet Protocol Security

A VPN builds an encrypted tunnel across an untrusted network. IPsec is the standards-based protocol suite most commonly used for site-to-site VPNs and many remote access VPNs. It uses IKE (Internet Key Exchange) to negotiate keys and ESP (Encapsulating Security Payload) to encrypt traffic.

Practitioner note: Prefer IKEv2 over IKEv1, retire weak Diffie-Hellman groups, and keep VPN gateways patched aggressively. Edge VPN appliances are among the most exploited assets on the internet.

WAF: Web Application Firewall

A Layer 7 control that sits in front of web applications and inspects HTTP and HTTPS traffic for attacks such as SQLi, XSS, file inclusion, and bot abuse. It can run as an appliance, a reverse proxy, or a cloud service.

Practitioner note: A WAF buys you time (virtual patching) when a fix is not available yet. It works best tuned to the specific app, so plan for a learning period before switching to blocking mode.

NAC: Network Access Control

Identifies devices as they connect to wired or wireless networks, checks who and what they are, and places them in the right segment or blocks them. Common building blocks include 802.1X, MAC authentication, device profiling, and posture checks.

Practitioner note: The biggest NAC win is visibility: most organizations discover far more unmanaged IoT and OT devices than they expected. Start in monitor mode before you start enforcing.

4. Compliance, Governance & Identity

These acronyms live where security meets business: proving who someone is, managing risk, and keeping data where it belongs.

IAM / IDaaS: Identity & Access Management / Identity-as-a-Service

IAM is the discipline and tooling for creating identities, authenticating them, and controlling what they can access across their lifecycle (joiner, mover, leaver). IDaaS delivers those capabilities from the cloud: single sign-on, MFA, directory services, and provisioning.

Practitioner note: Identity is the new perimeter. Prompt deprovisioning of departed employees and regular access reviews close more real-world gaps than most fancy tools.

MFA / 2FA: Multi-Factor / Two-Factor Authentication

Requires proof from more than one category: something you know (password), something you have (token, phone, security key), and something you are (biometric). 2FA is simply MFA with exactly two factors.

Practitioner note: Not all MFA is equal. SMS codes and simple push approvals can be phished or fatigued. FIDO2 security keys and passkeys are phishing-resistant and should be the target for privileged accounts.

GRC: Governance, Risk, and Compliance

The framework an organization uses to set security policy (governance), identify and prioritize risks (risk), and prove it meets laws, regulations, and standards such as PCI DSS, HIPAA, SOC 2, or ISO 27001 (compliance).

Practitioner note: Good GRC translates technical findings into business risk. If you can explain a vulnerability in terms of dollars and downtime, you will get budget faster.

TPRM: Third-Party Risk Management

The process of assessing and monitoring the security posture of vendors, suppliers, and partners who touch your data or systems. It includes security questionnaires, contract requirements, SOC 2 report review, and ongoing monitoring.

Practitioner note: Supply-chain incidents have shown that your exposure includes your vendors’ exposure. Tier vendors by the data and access they hold, and focus effort on the top tier.

DLP: Data Loss Prevention

Technology and policy that discover, classify, and control sensitive data (credit card numbers, health records, source code, intellectual property) to keep it from leaving through email, web uploads, cloud apps, USB drives, or printing.

Practitioner note: DLP fails when it is deployed before data is classified. Know what you are protecting, start in monitor mode, and tune aggressively to keep false positives from burying your analysts.

5. Commonly Confused Pairs

EDR vs. XDR: EDR watches endpoints. XDR correlates endpoints plus network, email, identity, and cloud. Every XDR includes EDR-style telemetry, but not every EDR is an XDR.

SIEM vs. SOAR: SIEM collects logs and decides something is suspicious. SOAR takes the alert and does something about it. One detects, the other acts.

IOC vs. TTP: An IOC is a specific artifact (a hash, an IP). A TTP is a behavior (how the attacker moves laterally). IOCs expire fast, TTPs last.

CSRF vs. SSRF: CSRF abuses the victim’s browser to send a request to a trusted site. SSRF abuses the server to send a request to somewhere the attacker cannot reach.

LFI vs. RFI: LFI reads files already on the server. RFI loads attacker-hosted code from a remote URL. RFI usually means immediate code execution.

SASE vs. ZTNA: ZTNA is one access component. SASE is the full architecture that includes ZTNA alongside SD-WAN, SWG, CASB, and cloud firewalling.

2FA vs. MFA: 2FA is a subset of MFA. Two factors is MFA, but MFA can be three or more. The factor type matters more than the count.

WAF vs. NGFW: A next-generation firewall inspects traffic across the whole network. A WAF specializes in protecting web applications at Layer 7. Many environments need both.

6. Quick Reference Table

Acronym	Stands For	Category
RCE	Remote Code Execution	Vulnerabilities & Exploits
XSS	Cross-Site Scripting	Vulnerabilities & Exploits
SQLi	SQL Injection	Vulnerabilities & Exploits
CSRF	Cross-Site Request Forgery	Vulnerabilities & Exploits
LFI / RFI	Local / Remote File Inclusion	Vulnerabilities & Exploits
SSRF	Server-Side Request Forgery	Vulnerabilities & Exploits
IOC	Indicator of Compromise	Threat Intel & Response
TTPs	Tactics, Techniques, and Procedures	Threat Intel & Response
APT	Advanced Persistent Threat	Threat Intel & Response
EDR / XDR	Endpoint Detection & Response / Extended Detection & Response	Threat Intel & Response
SIEM	Security Information and Event Management	Threat Intel & Response
SOAR	Security Orchestration, Automation, and Response	Threat Intel & Response
SASE	Secure Access Service Edge	Network & Infrastructure
ZTNA	Zero Trust Network Access	Network & Infrastructure
VPN / IPsec	Virtual Private Network / Internet Protocol Security	Network & Infrastructure
WAF	Web Application Firewall	Network & Infrastructure
NAC	Network Access Control	Network & Infrastructure
IAM / IDaaS	Identity & Access Management / Identity-as-a-Service	Compliance, Governance & Identity
MFA / 2FA	Multi-Factor / Two-Factor Authentication	Compliance, Governance & Identity
GRC	Governance, Risk, and Compliance	Compliance, Governance & Identity
TPRM	Third-Party Risk Management	Compliance, Governance & Identity
DLP	Data Loss Prevention	Compliance, Governance & Identity

Wrapping Up

Acronyms are shorthand, and shorthand only helps when everyone agrees what it means. The fastest way to lose credibility in a customer meeting or an incident bridge is to use a term loosely, so it is worth knowing not just the expansion but where each control sits and what it does not do.

Bookmark the quick reference table, share it with the new analyst on your team, and the next time someone says the XDR handed an IOC to SOAR to update the WAF, you will know exactly what happened and which tool to check first.

Essential Cybersecurity Acronyms: The Practitioner’s Decoder Ring

1. Vulnerabilities & Exploits

RCE: Remote Code Execution

XSS: Cross-Site Scripting

SQLi: SQL Injection

CSRF: Cross-Site Request Forgery

LFI / RFI: Local / Remote File Inclusion

SSRF: Server-Side Request Forgery

2. Threat Intel & Response

IOC: Indicator of Compromise

TTPs: Tactics, Techniques, and Procedures

APT: Advanced Persistent Threat

EDR / XDR: Endpoint Detection & Response / Extended Detection & Response

SIEM: Security Information and Event Management

SOAR: Security Orchestration, Automation, and Response

3. Network & Infrastructure

SASE: Secure Access Service Edge

ZTNA: Zero Trust Network Access

VPN / IPsec: Virtual Private Network / Internet Protocol Security

WAF: Web Application Firewall

NAC: Network Access Control

4. Compliance, Governance & Identity

IAM / IDaaS: Identity & Access Management / Identity-as-a-Service

MFA / 2FA: Multi-Factor / Two-Factor Authentication

GRC: Governance, Risk, and Compliance

TPRM: Third-Party Risk Management

DLP: Data Loss Prevention

5. Commonly Confused Pairs

6. Quick Reference Table

Wrapping Up

Recent posts