# Whisper Security — Cybersecurity Glossary

> Plain-language definitions of cybersecurity and internet-infrastructure terms used in real investigations. Each entry links to its markdown sibling for citation use.

*Source: https://www.whisper.security/glossary*

---

- [ASN Footprint](https://www.whisper.security/glossary/asn-footprint.md) — An ASN footprint is everything an organization announces to the internet under its autonomous system numbers: the IP prefixes it routes, the addresses inside them, and the hosts and services those addresses run. Mapping it shows where a network really ends, including forgotten or unmanaged space that an asset inventory has missed.
- [ASN Reputation](https://www.whisper.security/glossary/asn-reputation.md) — ASN reputation assesses how trustworthy a whole network is — based on the threat activity observed across the prefixes it routes, not just a single blocklist hit.
- [Attack Path Analysis](https://www.whisper.security/glossary/attack-path-analysis.md) — Attack path analysis maps the chain of steps an attacker takes from an entry point to a target, then identifies the choke point that severs the most paths. Whisper extends it across the open internet — web, DNS, routing, and physical layers — rather than inside one organisation.
- [Attack Surface](https://www.whisper.security/glossary/attack-surface.md) — An attack surface is the complete set of points — domains, subdomains, IP addresses, exposed services, third-party integrations — where an unauthorized actor could probe, interact with, or attempt to enter an organization's systems.
- [Attack Surface Management](https://www.whisper.security/glossary/attack-surface-management.md) — Attack surface management (ASM) is the continuous discovery and monitoring of everything an organisation exposes to the internet — domains, subdomains, IPs, certificates, and the services on them. External ASM does this from the outside, the way an attacker sees you, so forgotten and shadow assets surface before they are exploited.
- [Autonomous System (ASN)](https://www.whisper.security/glossary/autonomous-system.md) — An Autonomous System is a network — or group of IP prefixes — operated by a single organization with one consistent routing policy. Each AS is identified by a unique Autonomous System Number (ASN) assigned by a Regional Internet Registry, and uses BGP to exchange routes with other ASNs.
- [BGP Hijacking](https://www.whisper.security/glossary/bgp-hijacking.md) — BGP hijacking is the unauthorized announcement of IP prefixes by an autonomous system that does not own them. Because BGP has no built-in authentication, peers may accept the false announcement and start routing traffic for the hijacked prefix to the wrong network — enabling interception, surveillance, or denial of service.
- [BGP Routing](https://www.whisper.security/glossary/bgp-routing.md) — Border Gateway Protocol (BGP) is the routing protocol that connects autonomous systems across the internet. It decides how traffic flows between organizations by exchanging announcements about which IP prefixes each network can reach. Every packet that crosses an organizational boundary is routed by BGP.
- [Blast Radius](https://www.whisper.security/glossary/blast-radius.md) — Blast radius is the set of systems, services and customers that one failure or compromise can reach before it is contained. In infrastructure it is measured outward from a shared dependency, such as a nameserver, hosting provider or network, and counts everything that stops working or becomes exposed when that one piece goes wrong.
- [Bulletproof Hosting](https://www.whisper.security/glossary/bulletproof-hosting.md) — Bulletproof hosting is hosting that is deliberately resistant to abuse complaints, takedown notices and law-enforcement requests. Operators advertise tolerance for content that mainstream providers remove, such as phishing kits, malware C2, spam infrastructure and illegal content, usually by operating in jurisdictions with weak enforcement and aggressive customer protection.
- [C2 (Command and Control) Infrastructure](https://www.whisper.security/glossary/c2-infrastructure.md) — Command-and-control (C2) infrastructure is the network of servers, domains, and channels an attacker uses to control compromised systems after initial access. C2 is how malware on a victim's machine receives instructions, exfiltrates data, and is updated. Mapping C2 is mapping the attacker's nervous system.
- [Certificate Transparency](https://www.whisper.security/glossary/certificate-transparency.md) — Certificate Transparency (CT) is a public-log system that records every TLS certificate issued by participating Certificate Authorities. Every modern browser refuses certificates that are not in CT, which means defenders, brand-protection teams, and attackers all have access to a near-complete public ledger of who has been issued certificates for which hostnames.
- [Choke Point Analysis](https://www.whisper.security/glossary/choke-point-analysis.md) — Choke point analysis finds the single node that, when removed, severs the largest number of attack paths. In Whisper's external graph, a choke point is a shared-infrastructure node — a common IP, prefix, ASN, registrant, or data center — that ties an attacker's assets together.
- [Co-hosted Domains](https://www.whisper.security/glossary/co-hosted-domains.md) — Co-hosted domains are hostnames that resolve to the same IP address — meaning they share a server. In bulk shared hosting this is benign and meaningless; in attacker infrastructure, co-hosting is one of the strongest signals available, because operators routinely group campaign assets on the same machine.
- [Concentration Risk](https://www.whisper.security/glossary/concentration-risk.md) — Concentration risk is the danger that too much of an organisation's infrastructure depends on a single provider, network, or facility — so one outage or compromise cascades across everything at once. DORA (Art. 28–30) now requires firms to analyse ICT concentration and hold exit strategies for it.
- [Coverage-Qualified Assessment](https://www.whisper.security/glossary/coverage-qualified-assessment.md) — A coverage-qualified assessment is a threat verdict that states how much the system actually knows about the target — distinguishing 'known clean' from 'no data'. It prevents the dangerous default where absence of evidence is read as evidence of safety, which matters most when an AI agent acts autonomously.
- [Cypher (Query Language)](https://www.whisper.security/glossary/cypher.md) — Cypher is a declarative query language for graph databases. Originally developed at Neo4j and now standardized as openCypher (and ISO/IEC GQL), Cypher uses ASCII-art-like patterns — **(a)-[:KNOWS]->(b)** — to describe nodes, edges, and traversals. It reads like a sentence and maps directly to how analysts already think about graph problems.
- [DMARC](https://www.whisper.security/glossary/dmarc.md) — DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with a message that claims to come from a domain but fails SPF and DKIM checks: deliver it, quarantine it or reject it. It also names where receivers should send reports about mail sent in the domain's name.
- [DNS](https://www.whisper.security/glossary/dns.md) — The Domain Name System (DNS) is the address book of the internet. It translates human-readable hostnames like example.com into the IP addresses, mail servers, and other records computers actually use to communicate. Almost every internet transaction begins with a DNS lookup.
- [DNSSEC](https://www.whisper.security/glossary/dnssec.md) — DNSSEC (Domain Name System Security Extensions) is a set of DNS protocol extensions that add cryptographic signatures to DNS records. Validating resolvers can use those signatures to confirm that an answer came from the legitimate authoritative server and was not modified in transit.
- [Dangling CNAME](https://www.whisper.security/glossary/dangling-cname.md) — A dangling CNAME is an alias record still pointing at a target that no longer exists. The record resolves to nothing — and to whoever claims the target next.
- [Domain Generation Algorithm (DGA)](https://www.whisper.security/glossary/domain-generation-algorithm.md) — A Domain Generation Algorithm (DGA) is a piece of malware logic that algorithmically produces a steady stream of pseudo-random domain names — often hundreds or thousands per day — for use as command-and-control rendezvous points. The malware tries to resolve each one until it finds a domain the attacker has registered, defeating static blocklists.
- [Fast Flux DNS](https://www.whisper.security/glossary/fast-flux-dns.md) — Fast flux is a DNS technique that rapidly rotates the IP addresses associated with a hostname — sometimes every few minutes — across a large pool of compromised hosts. The hostname stays alive while the IPs underneath churn, which makes IP-based blocking ineffective and helps malicious infrastructure stay reachable.
- [Forward Threat Intelligence](https://www.whisper.security/glossary/forward-threat-intelligence.md) — Forward threat intelligence is finding an adversary's infrastructure before it is used — the not-yet-weaponised domains and servers an operator has staged but no feed has flagged. It is the opposite of reactive intelligence: instead of listing what is already burned, it surfaces the next wave by pivoting on shared fingerprints.
- [Indicator of Compromise (IOC)](https://www.whisper.security/glossary/indicator-of-compromise.md) — An Indicator of Compromise (IOC) is a forensic artifact — an IP address, domain, file hash, URL, registry key, or network signature — whose presence on a system or in network traffic suggests the system has been targeted, infected, or breached. IOCs are how defenders translate threat intelligence into things they can actually search for.
- [Infrastructure Intelligence](https://www.whisper.security/glossary/infrastructure-intelligence.md) — Infrastructure intelligence is the real-time collection, correlation, and analysis of internet infrastructure data — BGP routing, DNS, hosting, WHOIS, DNSSEC, certificate transparency — so security teams can detect, attribute, and respond to threats based on how attackers actually deploy their tools.
- [Infrastructure Pivoting](https://www.whisper.security/glossary/infrastructure-pivoting.md) — Infrastructure pivoting is moving from one known indicator — a domain, IP, or certificate — to related infrastructure by following shared attributes: the same IP (co-hosting), the same WHOIS registrant, shared nameservers, or a shared TLS fingerprint. Each shared attribute is a pivot, and chaining pivots expands a single lead into a whole campaign.
- [Internet Exchange Point (IXP)](https://www.whisper.security/glossary/internet-exchange-point.md) — An Internet Exchange Point (IXP) is a shared switching platform, usually inside a data centre, where many networks connect to exchange traffic directly with each other instead of paying a transit provider to carry it. Networks that meet at an exchange agree to peer, which keeps traffic between them local, cheaper and faster.
- [Knowledge Graph](https://www.whisper.security/glossary/knowledge-graph.md) — A knowledge graph is a data structure that represents real-world entities as nodes and the relationships between them as edges. Both nodes and edges carry typed properties. The shape is purpose-built for the multi-hop questions analysts actually ask — "show me everything connected to X within N steps along these specific relationships."
- [Lame Delegation](https://www.whisper.security/glossary/lame-delegation.md) — A lame delegation is a domain pointed at a nameserver that will not answer authoritatively for it. The delegation exists, the answer does not, and the gap is something an attacker can fill.
- [MITRE ATT&CK](https://www.whisper.security/glossary/mitre-attack.md) — MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised into a matrix. It gives defenders a shared vocabulary (technique IDs like T1059) for describing how an actor operates, from initial access to exfiltration.
- [MOAS Conflict](https://www.whisper.security/glossary/moas-conflict.md) — A MOAS (Multiple Origin AS) conflict is when the same BGP prefix is announced by more than one autonomous system — sometimes a route hijack, sometimes legitimate anycast.
- [Model Context Protocol (MCP)](https://www.whisper.security/glossary/mcp.md) — Model Context Protocol (MCP) is an open standard introduced by Anthropic in late 2024 that lets AI assistants connect to external tools and data sources through a uniform interface. Instead of every model integrating every tool one by one, an MCP server exposes its capabilities and any MCP-aware client — Claude Desktop, Cursor, VS Code, custom agents — can use them.
- [Nameserver](https://www.whisper.security/glossary/nameserver.md) — A nameserver is the host that answers DNS queries for a zone. Every domain delegates to at least two, and which ones a domain uses is a durable fingerprint of who runs it.
- [Origin-IP Discovery](https://www.whisper.security/glossary/origin-ip-discovery.md) — Origin-IP discovery — also called de-cloaking or de-CDN — is finding the true server IP behind a CDN or reverse proxy like Cloudflare. The CDN hides the origin, but historical DNS, certificates, SPF records, and sibling domains often leak it, so an attack-surface or pentest team can reach the real host their scanner actually needs to test.
- [Passive DNS (pDNS)](https://www.whisper.security/glossary/passive-dns.md) — Passive DNS is the historical record of every DNS resolution observed in the wild — capturing every hostname-to-IP mapping over time without ever issuing a query of its own. Where active DNS gives you the answer right now, passive DNS gives you every answer the system ever returned, with timestamps, so you can replay the past.
- [Prompt Injection](https://www.whisper.security/glossary/prompt-injection.md) — Prompt injection is an attack that smuggles malicious instructions into the text an AI model reads, hijacking its behaviour. In agentic systems it extends to tool poisoning — corrupting the data a tool returns so the agent acts on attacker-controlled input. OWASP ranks goal hijacking the top risk for agentic applications.
- [RDAP (Registration Data Access Protocol)](https://www.whisper.security/glossary/rdap.md) — RDAP (Registration Data Access Protocol) is the structured successor to WHOIS for looking up who holds a domain name, an IP address block or an autonomous system number. It returns registration data as JSON over HTTPS, with standard fields for the holder, their contacts and roles, and the dates a record was created and last changed.
- [RPKI / Route Origin Authorization (ROA)](https://www.whisper.security/glossary/rpki-roa.md) — RPKI lets a network cryptographically authorize which AS may originate a prefix. The signed record is a ROA — a Route Origin Authorization.
- [Reconciled Verdict](https://www.whisper.security/glossary/reconciled-verdict.md) — A reconciled verdict is Whisper's single, blocking-aware threat assessment for an indicator — a score, a level, and a block/allow recommendation reconciled across many feeds and signals.
- [Reverse DNS / PTR](https://www.whisper.security/glossary/reverse-dns.md) — Reverse DNS (rDNS) is the lookup that goes the other way: given an IP address, return the hostname assigned to it. The mapping is published as PTR records under the special **.in-addr.arpa** (IPv4) and **.ip6.arpa** (IPv6) zones, and is controlled by whoever owns the IP block — the network operator, not the domain owner.
- [Route Origin Validation](https://www.whisper.security/glossary/route-origin-validation.md) — Route Origin Validation (ROV) is the check a router makes against RPKI data before accepting a BGP route: does a signed Route Origin Authorization allow this autonomous system to announce this prefix, at this length? Routes that fail are marked invalid and can be dropped, which stops many accidental leaks and simple hijacks from spreading.
- [SPF](https://www.whisper.security/glossary/spf.md) — SPF (Sender Policy Framework) is a DNS record listing the mail servers authorized to send email for a domain. Receiving servers check it to detect forged sender addresses, making SPF a first line of defense against domain spoofing and phishing.
- [Subdomain Enumeration](https://www.whisper.security/glossary/subdomain-enumeration.md) — Subdomain enumeration is the discovery of all the subdomains beneath a domain — mail, vpn, staging, dev — to map an organisation's external footprint. Passive enumeration finds them from data the internet already exposes (the DNS hierarchy, Certificate Transparency logs, passive DNS) without sending a single packet to the target.
- [Subdomain Takeover](https://www.whisper.security/glossary/subdomain-takeover.md) — A subdomain takeover is an attacker claiming the abandoned target of a DNS record you still publish. They serve content on your hostname, with your name on it, without touching your DNS.
- [Submarine Cable](https://www.whisper.security/glossary/submarine-cable.md) — Submarine cables are the undersea fibre-optic lines that carry almost all intercontinental internet traffic. Because a handful of cables and their landing stations carry so much, they are a physical single point of dependency — now a focus of the FCC's 2026 cable-security rules and the EU's Cable Security Toolbox.
- [Supply-Chain Risk](https://www.whisper.security/glossary/supply-chain-risk.md) — Supply-chain risk in cybersecurity is exposure inherited from the third parties an organisation depends on — hosting providers, DNS operators, registrars, and the networks beneath them. A compromise or outage anywhere in that chain becomes your incident, which is why NIS2 Art. 21 makes supply-chain security a board-level duty.
- [TLS Fingerprint (JA3 / JARM)](https://www.whisper.security/glossary/tls-fingerprint.md) — A TLS fingerprint is a short hash that summarizes how a client or server behaves during the TLS handshake: the protocol versions, cipher suites and extensions it offers, and the order it offers them in. JA3 and JA4 fingerprint clients, JARM fingerprints servers, and the hash often stays the same while domains and IP addresses change.
- [TTPs (Tactics, Techniques, and Procedures)](https://www.whisper.security/glossary/ttp.md) — TTPs — tactics, techniques, and procedures — describe how a threat actor operates: the goals they pursue (tactics), the methods they use (techniques), and the specific way they execute them (procedures). Because TTPs are harder to change than tools or domains, they are the most durable way to track an adversary.
- [Threat Hunting](https://www.whisper.security/glossary/threat-hunting.md) — Threat hunting is the proactive, hypothesis-driven search for adversaries inside an environment — under the assumption that prevention will fail and that automated detection has missed something. Hunters start with a hypothesis ("if X actor were here, we would see Y"), gather evidence, and either confirm an intrusion or sharpen detection for next time.
- [Threat Intelligence](https://www.whisper.security/glossary/threat-intelligence.md) — Threat intelligence is information about cyber threats — the actors, campaigns, tools, and infrastructure behind attacks — that has been collected, analysed, and refined into context defenders can act on. The goal is not raw data; it is helping security teams make faster, better-informed decisions about what to block, what to investigate, and what to ignore.
- [Tor Exit Node](https://www.whisper.security/glossary/tor-exit-node.md) — A Tor exit node is the last relay in a Tor circuit, the machine that sends a Tor user's traffic out to the open internet. To the website or service receiving it, the connection appears to come from the exit node's IP address rather than from the user, which is why exit addresses turn up so often in logs and threat feeds.
- [Typosquatting](https://www.whisper.security/glossary/typosquatting.md) — Typosquatting is the registration of domain names that imitate a legitimate brand — usually by exploiting common typos, character substitutions, or visually similar Unicode characters. The squatter relies on users mistyping a URL or failing to spot a swapped character, then collects the misdirected traffic for phishing, malvertising, or credential theft.
- [WHOIS](https://www.whisper.security/glossary/whois.md) — WHOIS is the public registration record for domain names and IP allocations. It tells you who registered a domain (or who an IP block is assigned to), through which registrar, when, and how to contact them. WHOIS has been the canonical answer to "who owns this" on the internet since the early 1980s.