IT Glossary
Plain-English definitions of the technical terms that come up in our work - written so you can have an informed conversation with your IT team, not just nod along.
Agentic AI
AI systems that autonomously plan and execute multi-step tasks using tools such as web search, code execution, and external APIs - without requiring human instruction at each step. Unlike a simple chatbot, an agentic AI breaks down a goal into sub-tasks and iterates until the objective is complete.
AI Agent
An autonomous AI system that can perceive its environment, make decisions, and take actions to complete multi-step goals - including calling external APIs, browsing the web, and managing files. Unlike a simple chatbot, an AI agent plans a sequence of steps to achieve an objective without requiring step-by-step human instruction.
AI Hallucination
When a large language model generates a response that sounds confident and well-formed but is factually incorrect or entirely fabricated. Hallucinations are an inherent property of statistical language models, not bugs. Mitigations include retrieval-augmented generation (RAG), grounding responses to verified sources, and human review for high-stakes outputs.
API
Application Programming Interface. A defined set of rules and protocols that allows software applications to communicate with each other. APIs are the connective tissue of modern IT automation - enabling data to flow between cloud services, internal systems, and third-party tools without custom integrations for each connection.
Auto-Scaling
A cloud capability that automatically adjusts the number of compute instances based on real-time demand, scaling out during traffic spikes and scaling in during quiet periods. Properly configured auto-scaling prevents both over-provisioning (wasted spend) and under-provisioning (performance degradation).
Related: Cloud Cost OptimizationAzure Arc
A Microsoft service that extends Azure management, governance, and security to infrastructure running outside of Azure - including on-premises servers, VMware environments, and other cloud providers. Azure Arc allows organisations to apply Azure Policy, Defender for Cloud, and Azure Monitor to non-Azure resources from a single control plane.
Related: Migrations & TransformationsBCP
Business Continuity Planning. A proactive framework that identifies potential threats to an organisation's operations and defines procedures to maintain critical functions during and after a disruption - including cyber incidents, natural disasters, and infrastructure failures. Closely related to Disaster Recovery (DR) but broader in scope.
Related: GRC & Compliance AdvisoryBIMI
Brand Indicators for Message Identification. A standard that allows organisations to display their verified brand logo in email clients (Gmail, Apple Mail, Yahoo). Requires DMARC enforcement at policy p=quarantine or p=reject and a Verified Mark Certificate (VMC). Dramatically increases open rates and reduces phishing risk.
Related: Email Infrastructure & DeliverabilityBlue/Green Deployment
A release strategy that maintains two identical production environments - Blue (current) and Green (new version). Traffic is switched from Blue to Green atomically, enabling zero-downtime releases and instant rollback if issues arise. Widely used in Kubernetes and serverless platforms; the additional infrastructure cost is the primary trade-off.
Related: Cloud Cost OptimizationBounce Rate (Email)
The percentage of sent emails that could not be delivered to the recipient's inbox. Hard bounces (permanent failures) damage sender reputation and should be removed from lists immediately. Soft bounces (temporary failures such as a full mailbox) are less critical but still require monitoring.
Related: Email Infrastructure & DeliverabilityBusiness Email Compromise
Business Email Compromise (BEC) is a sophisticated social-engineering attack where criminals impersonate company executives or vendors to trick employees into transferring money or sharing sensitive information. Proper DMARC enforcement at p=reject is the primary technical defence against domain impersonation used in BEC.
Related: Email Infrastructure & DeliverabilityCanary Release
A deployment strategy that routes a small percentage of production traffic (e.g. 5%) to the new version of a service while the rest continues on the old version. Metrics are monitored; if error rates remain acceptable, traffic is progressively shifted until the new version handles 100%. Limits the blast radius of a bad release.
Related: Cloud Cost OptimizationCapEx vs OpEx
Capital Expenditure (CapEx) refers to upfront spending on physical assets such as on-premises servers. Operational Expenditure (OpEx) refers to ongoing cloud subscription costs. Cloud migration converts most IT spend from CapEx to OpEx, shifting it to a variable cost model and improving cash flow flexibility.
Related: Cloud Cost OptimizationCASB (Cloud Access Security Broker)
A security enforcement point - either on-premise or cloud-hosted - that sits between users and cloud applications to apply data security policies, detect shadow IT, and provide visibility into cloud usage. CASBs enforce DLP, access control, and threat protection for SaaS apps like Microsoft 365, Salesforce, and Box. Microsoft Defender for Cloud Apps is a leading enterprise CASB.
Related: GRC & Compliance AdvisoryCCPA
California Consumer Privacy Act. A US state privacy law that grants California residents rights over their personal data: the right to know what is collected, the right to delete it, and the right to opt out of its sale. Organisations serving California residents must comply regardless of where they are headquartered.
Related: GRC & Compliance AdvisoryCDN
Content Delivery Network. A globally distributed network of edge servers that cache and deliver static assets (images, scripts, video) from the location closest to the end user. Reduces latency, improves page load times, and offloads origin server traffic. Major CDN providers include Cloudflare, AWS CloudFront, and Azure CDN.
Related: Cloud Cost OptimizationCI/CD
Continuous Integration and Continuous Delivery (or Deployment). A software development practice where code changes are automatically built, tested, and deployed through a pipeline. CI/CD reduces the risk of large, infrequent releases and enables rapid, reliable iteration. GitHub Actions, Azure DevOps, and GitLab CI are common CI/CD platforms.
Related: Cloud Cost OptimizationCloud Egress
The cost charged by a cloud provider for data transferred out of their network - to the internet, to another cloud provider, or between regions. Egress fees are often the largest hidden cost in cloud architectures. Designing for data locality, using CDNs, and choosing providers with generous egress allowances can reduce this significantly.
Related: Cloud Cost OptimizationCloud FinOps
The practice of maximising business value from cloud spending through financial accountability and cross-functional collaboration between engineering, finance, and product teams. Cloud FinOps moves cloud cost management from a retrospective finance function to a real-time operational practice, enabling faster and more informed decisions about cloud investment.
Related: Cloud Cost OptimizationCloud Migration
The process of moving workloads, data, and applications from on-premises infrastructure or one cloud environment to another. The six common migration strategies (6 Rs) are: Retire, Retain, Rehost (lift-and-shift), Replatform, Refactor, and Repurchase. Each carries different cost, risk, and operational profiles.
Related: Migrations & TransformationsConditional Access
A Microsoft Entra ID (formerly Azure AD) feature that applies access policies based on signals such as user identity, device compliance, location, and application sensitivity. Conditional Access is the primary enforcement point for Zero Trust in a Microsoft 365 environment - blocking risky sign-ins before they reach productivity apps.
Related: Migrations & TransformationsContainer
A lightweight, portable unit of software that packages an application with all its dependencies (code, runtime, libraries, configuration) so it runs identically across development, test, and production environments. Docker is the standard container runtime; Kubernetes is the standard container orchestration platform.
Related: Cloud Cost OptimizationContext Window
The maximum number of tokens (roughly words and punctuation) an LLM can process in a single request, including both the input prompt and the generated response. Larger context windows allow more document content, conversation history, or instructions to be passed to the model at once. GPT-4o supports 128K tokens; Claude supports up to 200K.
Copilot for Microsoft 365
Microsoft's AI assistant integrated across the Microsoft 365 suite (Word, Excel, Teams, Outlook). It draws on large language models and the Microsoft Graph (user emails, meetings, documents) to generate content, summarise meetings, and automate routine tasks. Requires specific licensing and a well-governed M365 tenant for safe deployment.
CVE
Common Vulnerabilities and Exposures. A publicly maintained dictionary of known cybersecurity vulnerabilities, each assigned a unique identifier (e.g. CVE-2024-12345). CVE identifiers allow security teams, vendors, and tools to reference the same vulnerability unambiguously. CVEs are scored for severity using the CVSS system.
Related: GRC & Compliance AdvisoryCVSS
Common Vulnerability Scoring System. An open framework for assessing the severity of software vulnerabilities on a scale from 0 to 10, where 9.0–10.0 is Critical. CVSS scores factor in attack vector, complexity, privileges required, and potential impact. Security teams use CVSS to prioritise remediation and patching schedules.
Related: GRC & Compliance AdvisoryData Residency
The requirement that data must physically reside within a specific geographic location or jurisdiction. Many regulated industries and government contracts in the UAE, UK, and EU require that personal or sensitive data cannot leave defined borders. Cloud architecture decisions (region selection, data replication settings) directly determine compliance.
Related: Data Residency & SecurityData Sovereignty
The principle that data is subject to the laws and governance of the country in which it is stored or processed. A company headquartered in the UK storing data on US cloud infrastructure may expose that data to US government subpoenas under laws like the CLOUD Act - a key driver of private cloud and local data residency deployments.
Related: Data Residency & SecurityDKIM
DomainKeys Identified Mail. A cryptographic email authentication method that attaches a digital signature to outgoing emails, allowing receiving servers to verify the email was sent by an authorised source and was not altered in transit. One of the three pillars of email authentication alongside SPF and DMARC.
Related: Email Infrastructure & DeliverabilityDKIM Selector
A DNS label included in a DKIM signature that tells receiving mail servers which public key to retrieve from DNS for signature verification. A domain can publish multiple DKIM selectors simultaneously - useful when rotating keys or authorising several email-sending services (e.g. your ESP and your CRM) to sign mail independently.
Related: Email Infrastructure & DeliverabilityDMARC
Domain-based Message Authentication, Reporting and Conformance. A policy framework that builds on SPF and DKIM, instructing receiving mail servers what action to take when authentication fails - none (monitor), quarantine, or reject. Aggregate (rua) and forensic (ruf) reports give visibility into who is sending on your behalf.
Related: Email Infrastructure & DeliverabilityDMARC Aggregate Report
A daily XML report (specified in the rua= tag of a DMARC record) sent by receiving mail servers that shows how many messages passed and failed SPF/DKIM/DMARC alignment for your domain. Analysing these reports is the first step toward safely moving to a p=reject policy without blocking legitimate mail.
Related: Email Infrastructure & DeliverabilityDNS
Domain Name System. The internet's distributed directory that translates human-readable domain names (huksonsit.com) into IP addresses that computers use to locate servers. DNS records (A, MX, TXT, CNAME, PTR) underpin email delivery, website resolution, and domain verification for cloud services.
Related: Email Infrastructure & DeliverabilityDPO
Data Protection Officer. A role required under GDPR for organisations that systematically process personal data at scale, operate as public authorities, or process special categories of data. The DPO advises on data protection obligations and acts as the primary point of contact for supervisory authorities.
Related: GRC & Compliance AdvisoryEDR (Endpoint Detection & Response)
A security solution that continuously monitors endpoint devices (laptops, servers, mobile devices) for malicious activity, providing real-time threat detection, automated response actions (isolating a device, killing a process), and forensic investigation capabilities. EDR replaces legacy antivirus, which relies on known-signature matching alone. Microsoft Defender for Endpoint is the leading enterprise EDR.
Related: GRC & Compliance AdvisoryEmail Authentication
The collective set of DNS-based standards - SPF, DKIM, and DMARC - that verify a sending domain's identity and protect against spoofing and phishing. All three work together: SPF authorises sending IPs, DKIM signs message content, and DMARC defines the policy and reporting when either check fails.
Related: Email Infrastructure & DeliverabilityEmail Blacklist
A real-time database of IP addresses and domains known to send spam or malicious email. Major blacklists (Spamhaus, Barracuda, SORBS) are checked by most enterprise mail gateways. A listing can cause near-total inbox delivery failure. Regular monitoring and prompt delisting are critical for maintaining sender reputation.
Related: Email Infrastructure & DeliverabilityEmail Warm-Up
The process of gradually increasing the sending volume from a new IP address or domain over several weeks, establishing a positive sending reputation with ISPs and mailbox providers. Sending large volumes from a cold IP immediately results in spam filtering and blacklisting.
Related: Email Infrastructure & DeliverabilityEmbedding
A numerical vector representation of text, image, or other data that captures semantic meaning. Similar content produces vectors that are close together in high-dimensional space. Embeddings are the foundation of semantic search and retrieval-augmented generation (RAG) - enabling AI systems to find conceptually related content rather than relying on exact keyword matches.
Entra ID
Microsoft's cloud-based identity and access management service, formerly known as Azure Active Directory (Azure AD). Provides single sign-on (SSO), multi-factor authentication (MFA), conditional access, privileged identity management (PIM), and identity governance. The identity backbone for all Microsoft 365 and Azure workloads.
Related: Migrations & TransformationsExchange Online
Microsoft's cloud-hosted email service, part of the Microsoft 365 suite. Exchange Online handles email routing, mailbox hosting, anti-spam/anti-malware filtering, and compliance archiving. Migrating from on-premises Exchange Server to Exchange Online is one of the most common Microsoft 365 migration workloads.
Related: Migrations & TransformationsFine-tuning
The process of further training a pre-trained AI model on a smaller, domain-specific dataset so that it learns terminology, tone, or task patterns relevant to a particular use case. Fine-tuning is more expensive than prompt engineering but can produce more consistent and accurate results for specialised tasks.
FinOps
Financial Operations for cloud. A practice that brings financial accountability to cloud spending by establishing cross-functional collaboration between engineering, finance, and operations teams. Core FinOps practices include tagging enforcement, budget alerts, reserved instance purchasing, and right-sizing recommendations.
Related: Cloud Cost OptimizationFinOps Maturity Model
A staged framework that describes an organisation's progression in cloud cost governance - from Crawl (basic visibility, reactive cost control) to Walk (tagging standards, showback, reserved instance usage) to Run (automated optimisation, unit economics, real-time anomaly detection). Used to benchmark and prioritise FinOps improvement efforts.
Related: Cloud Cost OptimizationGDPR
General Data Protection Regulation. The European Union's primary data protection law, which applies to any organisation processing personal data of EU residents - regardless of where the organisation is based. Key principles include lawfulness, data minimisation, purpose limitation, and storage limitation. Fines reach €20M or 4% of global annual turnover.
Related: GRC & Compliance AdvisoryGitOps
An operational model that uses Git repositories as the single source of truth for infrastructure and application configuration. Automated operators (such as Argo CD or Flux) continuously reconcile the live cluster state with the desired state declared in Git. Changes are made via pull requests, providing an auditable history and enabling rollback by reverting a commit.
Related: Cloud Cost OptimizationGuardrails (AI)
Safety controls applied to AI systems that filter inputs and outputs to prevent harmful, off-topic, or policy-violating responses. Guardrails can be implemented at the model level (system prompts, RLHF), the infrastructure level (content moderation APIs), or the application level (output validation logic). Essential for enterprise AI deployments.
Hybrid Cloud
A computing environment that combines on-premises infrastructure (or a private cloud) with one or more public cloud providers, allowing workloads to move between them as demand and costs dictate. Common for organisations with data residency requirements or legacy systems that cannot be fully cloud-migrated.
Related: Cloud Cost OptimizationIaC
Infrastructure as Code. The practice of managing and provisioning infrastructure through machine-readable configuration files rather than manual processes, enabling consistent, repeatable deployments. Common IaC tools include Terraform, Pulumi, AWS CloudFormation, and Azure Bicep.
Related: Cloud Cost OptimizationIAM
Identity and Access Management. The discipline of managing digital identities and controlling what resources each identity can access. Core IAM concepts include authentication (proving who you are), authorisation (what you can do), RBAC (role-based access control), and the principle of least privilege. Microsoft Entra ID and AWS IAM are the leading enterprise IAM platforms.
Related: Migrations & TransformationsIMAP/POP3
Protocols for retrieving email from a mail server to a client. IMAP (Internet Message Access Protocol) keeps messages on the server and syncs across devices - the standard for modern email clients. POP3 (Post Office Protocol 3) downloads messages to a single device and deletes them from the server. Most enterprise platforms (Exchange Online, Gmail) use IMAP; POP3 is largely legacy.
Related: Email Infrastructure & DeliverabilityIntune MAM
Mobile Application Management - a capability within Microsoft Intune that applies data protection policies at the application layer without requiring full device enrolment. MAM is used for BYOD (Bring Your Own Device) scenarios: corporate data in Outlook or Teams is protected by encryption and copy/paste restrictions, while the employee's personal data and apps remain untouched.
Related: Migrations & TransformationsISO 27001
The international standard for Information Security Management Systems (ISMS). Certification demonstrates that an organisation has systematic processes in place to manage information security risk. Increasingly required by enterprise procurement teams as a baseline vendor requirement, particularly for cloud and managed IT service providers.
Related: GRC & Compliance AdvisoryITIL
Information Technology Infrastructure Library. A widely adopted framework of best practices for IT service management (ITSM) covering processes such as incident management, change management, problem management, and service request fulfilment. ITIL 4, the current version, aligns these practices with Agile and DevOps approaches.
Related: Staff AugmentationKubernetes
An open-source container orchestration platform that automates deployment, scaling, and management of containerised applications. Kubernetes has become the de-facto standard for running production container workloads. Managed Kubernetes services include AWS EKS, Azure AKS, and Google GKE.
Related: Cloud Cost OptimizationLift and Shift
A cloud migration strategy (also called rehosting) where applications are moved to the cloud with no changes to architecture or code. The fastest way to migrate but often the most expensive to run long-term because the application is not optimised for cloud-native pricing models.
Related: Migrations & TransformationsLLM
Large Language Model. A type of AI model trained on vast amounts of text data to understand and generate human language. GPT-4, Claude, Gemini, and Llama are examples. LLMs power tools like Copilot for Microsoft 365, ChatGPT Enterprise, and custom AI assistants. Deployment in enterprise environments requires careful data governance to prevent sensitive data leakage.
MFA
Multi-Factor Authentication. A security control that requires users to provide two or more verification factors to access a system - typically something they know (password), something they have (authenticator app or hardware key), and/or something they are (biometric). MFA is the single most effective control against account takeover attacks.
Related: Migrations & TransformationsMicrosoft Defender for Business
Microsoft's SME-tier endpoint security solution, bundled with Microsoft 365 Business Premium. It provides EDR/XDR capabilities - threat detection, automated investigation and remediation, and vulnerability management - at a price point designed for organisations without a dedicated security operations team.
Related: Migrations & TransformationsMicrosoft Intune
A cloud-based Mobile Device Management (MDM) and Mobile Application Management (MAM) solution in Microsoft 365. Intune enforces device compliance policies (encryption, PIN requirements, OS version) and controls which apps can access corporate data. A key component of any Zero Trust endpoint strategy.
Related: Migrations & TransformationsMicrosoft Purview
Microsoft's unified data governance, compliance, and information protection platform. Purview encompasses data classification and sensitivity labelling, data loss prevention (DLP), eDiscovery, audit logging, insider risk management, and data cataloguing across Microsoft 365 and Azure. Relevant for organisations with GDPR, SOC 2, and ISO 27001 obligations.
Related: GRC & Compliance AdvisoryModel Quantization
A technique that reduces the numerical precision of an AI model's weights (for example, from 32-bit floats to 4-bit integers), significantly lowering memory requirements and inference costs with minimal accuracy loss. Quantized models can run on consumer-grade GPUs or CPU-only hardware, making local LLM deployment feasible for privacy-sensitive use cases.
MSP
Managed Service Provider. A company that remotely manages a client's IT infrastructure and end-user systems under a subscription model. MSPs typically provide monitoring, patching, helpdesk, backup, and security services. The distinction from a traditional IT consultancy is the ongoing, proactive, and contractually defined service delivery.
Related: Staff AugmentationMTA-STS
Mail Transfer Agent Strict Transport Security. A standard that enables domain owners to declare that emails sent to their domain must be encrypted in transit using TLS, preventing downgrade attacks and opportunistic interception. Works alongside TLS-RPT (SMTP TLS Reporting) to provide compliance visibility.
Related: Email Infrastructure & DeliverabilityMulti-Cloud
A strategy of using two or more public cloud providers (e.g. AWS and Azure) to avoid vendor lock-in, leverage best-of-breed services, or meet regulatory requirements. Multi-cloud increases resilience but also introduces operational complexity in networking, identity, and cost management.
Related: Cloud Cost OptimizationNIS2 Directive
The EU's updated Network and Information Security Directive, effective October 2024. NIS2 significantly expands the scope of its predecessor (NIS1), covering more sectors including cloud providers, managed services, and digital infrastructure. It imposes mandatory incident reporting, supply chain security requirements, and management-level accountability - with fines up to €10M or 2% of global turnover.
Related: GRC & Compliance AdvisoryObservability
The ability to understand the internal state of a system from its external outputs. Observability is built on three pillars: logs (discrete event records), metrics (aggregated numerical measurements over time), and traces (end-to-end records of requests across services). High observability reduces mean time to resolution (MTTR) when incidents occur.
Related: Cloud Cost OptimizationPDPA
Personal Data Protection Act. A data privacy law enacted in several countries (Thailand, Pakistan, Singapore, and others) modelled broadly on GDPR principles. For organisations operating in MENA and South Asia, PDPA compliance sits alongside GDPR requirements when processing personal data across jurisdictions.
Related: GRC & Compliance AdvisoryPenetration Testing
An authorised simulated cyberattack on a system, network, or application designed to identify exploitable vulnerabilities before real attackers do. Penetration tests differ from vulnerability scans in that a human tester actively attempts to chain weaknesses together to achieve a meaningful compromise.
Related: GRC & Compliance AdvisoryPhishing Simulation
A controlled security exercise where an organisation sends realistic-but-fake phishing emails to its own employees to measure susceptibility and identify training needs. Simulations are typically run by the security team or an MSP using platforms such as KnowBe4 or Microsoft Attack Simulator. Click-through rates inform security awareness training priorities.
Related: GRC & Compliance AdvisoryPower Platform
Microsoft's low-code/no-code development suite comprising Power Apps (custom business applications), Power Automate (workflow automation), Power BI (business intelligence and dashboards), and Copilot Studio (custom AI copilot builder). Power Platform integrates natively with Microsoft 365 and Dataverse, enabling business users to build and automate workflows without traditional software development.
Prompt Engineering
The practice of crafting and iterating on natural-language inputs (prompts) to an AI model to reliably produce accurate, relevant, and well-structured outputs. Effective prompt engineering includes techniques such as few-shot examples, chain-of-thought reasoning, system instructions, and output format constraints.
PTR Record
Pointer record. A DNS record that performs reverse DNS lookup - mapping an IP address back to a hostname. Most enterprise mail servers perform a PTR check on the sending IP; a missing or mismatched PTR record is a common cause of deliverability failures and spam classification.
Related: Email Infrastructure & DeliverabilityRAG
Retrieval-Augmented Generation. An AI architecture that enhances large language model responses by first retrieving relevant documents from a knowledge base (using vector search), then passing those documents as context to the LLM before generating a response. RAG enables AI systems to answer questions based on private, up-to-date company knowledge rather than general training data.
Reserved Instances
A cloud pricing model where you commit to a specific instance type and region for 1 or 3 years in exchange for discounts of up to 72% compared to on-demand pricing. FinOps best practice is to cover steady-state baseline workloads with reservations and use on-demand or spot instances for variable workloads.
Related: Cloud Cost OptimizationRPA
Robotic Process Automation. Software that automates repetitive, rule-based tasks by mimicking human interactions with desktop applications and web interfaces - clicking buttons, extracting data from screens, and entering information into forms. RPA bridges the gap between legacy systems that lack APIs and modern automation workflows. Microsoft Power Automate Desktop and UiPath are leading RPA platforms.
RPO
Recovery Point Objective. The maximum acceptable amount of data loss measured in time - i.e. how far back in time can you afford to go when restoring from a backup after an incident. An RPO of 1 hour means your backups must run at least every hour. RPO drives backup frequency and replication strategy decisions.
Related: GRC & Compliance AdvisoryRTO
Recovery Time Objective. The maximum acceptable amount of time to restore a system or service after a disruption or failure. An RTO of 4 hours means the system must be back online within 4 hours of an incident. RTO directly informs failover architecture choices: hot standby (minutes), warm standby (hours), or cold backup (hours to days).
Related: GRC & Compliance AdvisoryServerless
A cloud execution model where the provider dynamically manages server allocation. Developers deploy functions or containers and pay only for actual execution time rather than idle server capacity. AWS Lambda, Azure Functions, and Google Cloud Run are the leading serverless platforms.
Related: Cloud Cost OptimizationService Mesh
A dedicated infrastructure layer that manages service-to-service communication in a microservices architecture, providing traffic management, mutual TLS encryption, observability, and circuit breaking without requiring changes to application code. Istio and Linkerd are the leading open-source service mesh implementations.
Related: Cloud Cost OptimizationSIEM
Security Information and Event Management. A platform that aggregates log data from across an IT environment (servers, firewalls, endpoints, cloud services) and correlates events to detect threats in real time. Microsoft Sentinel, Splunk, and IBM QRadar are leading SIEM platforms. A core component of SOC operations.
Related: GRC & Compliance AdvisorySLA
Service Level Agreement. A contractual commitment between a service provider and customer that defines the expected service level - typically including uptime percentage, response times, and resolution times. An SLA of 99.9% uptime permits approximately 8.7 hours of downtime per year. SLAs are the accountability mechanism in any managed services engagement.
Related: Staff AugmentationSMTP
Simple Mail Transfer Protocol. The foundational protocol used to send email between servers over the internet. SMTP runs on port 25 (server-to-server), 587 (authenticated submission), and 465 (legacy SSL). Misconfigurations in SMTP relay settings are one of the most common causes of email delivery failures.
Related: Email Infrastructure & DeliverabilitySOAR
Security Orchestration, Automation, and Response. A category of platform that integrates with SIEM and other security tools to automate repetitive investigation and response workflows - such as blocking a malicious IP, resetting a compromised account, or creating a ticket. SOAR reduces analyst workload and mean time to respond (MTTR). Microsoft Sentinel includes built-in SOAR capabilities.
Related: GRC & Compliance AdvisorySOC 2
Service Organisation Control 2. A US auditing standard developed by the AICPA that evaluates service providers on five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. SOC 2 Type II reports (covering a 6–12 month audit period) are increasingly required by enterprise clients before engaging SaaS or IT service providers.
Related: GRC & Compliance AdvisorySpam Trap
An email address used by ISPs and anti-spam organisations to identify senders with poor list hygiene. Pristine spam traps were never valid addresses; recycled spam traps are former valid addresses reactivated to catch senders who never remove bounced or inactive contacts. Hitting a spam trap damages sender reputation and can trigger blacklisting.
Related: Email Infrastructure & DeliverabilitySPF
Sender Policy Framework. A DNS TXT record that publishes the IP addresses and mail servers authorised to send email for a domain. Receiving servers check SPF to detect forged sender addresses. One of the three pillars of email authentication alongside DKIM and DMARC. An SPF record that includes too many mechanisms can result in a PermError due to the 10-lookup limit.
Related: Email Infrastructure & DeliverabilitySPF Flattening
The technique of resolving all nested include: mechanisms in an SPF record into a single list of IP addresses, ensuring the record stays within the 10 DNS-lookup limit defined in RFC 7208. Exceeding the limit causes a PermError, which can result in DMARC failures and legitimate mail being rejected. SPF flattening tools automate this resolution and keep the record current.
Related: Email Infrastructure & DeliverabilitySpot/Preemptible Instances
Discounted cloud compute instances (up to 90% cheaper than on-demand) that the cloud provider can reclaim with short notice when capacity is needed elsewhere. AWS calls them Spot Instances; GCP calls them Spot VMs; Azure calls them Spot VMs. Suitable for fault-tolerant, stateless, or batch workloads - not for databases or stateful services.
Related: Cloud Cost OptimizationSRE (Site Reliability Engineering)
A discipline that applies software engineering principles to IT operations problems - treating reliability, scalability, and efficiency as engineering challenges to be solved with code rather than manual processes. Originally developed at Google, SRE introduced concepts such as error budgets, SLOs (Service Level Objectives), and toil reduction that are now standard in cloud-native operations.
Related: Cloud Cost OptimizationSupply Chain Attack
A cyberattack that targets a software vendor, managed service provider, or open-source library in order to compromise the downstream customers who depend on that software. The 2020 SolarWinds attack, which affected thousands of organisations via a compromised software update, is the canonical example. Supply chain risk is now a core concern in enterprise vendor due diligence.
Related: GRC & Compliance AdvisoryTerraform
An open-source Infrastructure as Code tool by HashiCorp that enables engineers to define and provision cloud infrastructure across multiple providers (AWS, Azure, GCP) using a declarative configuration language (HCL). The de-facto standard for cloud infrastructure automation.
Related: Cloud Cost OptimizationTLS
Transport Layer Security. The cryptographic protocol that encrypts data in transit between clients and servers - the 'S' in HTTPS. TLS 1.3 is the current recommended version; TLS 1.0 and 1.1 are deprecated. Email security standards including MTA-STS and TLS-RPT depend on TLS for protecting messages in transit between mail servers.
Related: Email Infrastructure & DeliverabilityTLS-RPT
SMTP TLS Reporting. A standard that allows sending mail servers to report on TLS negotiation failures when delivering email to a domain. Works in conjunction with MTA-STS to provide visibility into whether encrypted delivery is succeeding or being silently downgraded.
Related: Email Infrastructure & DeliverabilityTool Calling (Function Calling)
A capability in modern LLMs that allows the model to invoke external APIs, run code, or query databases as part of generating a response. The model emits a structured function-call specification; the application executes it and returns the result; the model incorporates the result into its final answer. The mechanism underlying most AI agent architectures.
Vector Database
A database purpose-built for storing, indexing, and querying high-dimensional embedding vectors. Vector databases power semantic search and retrieval-augmented generation (RAG) by finding the embeddings most similar to a query vector. Examples include Pinecone, Weaviate, Qdrant, and the pgvector extension for PostgreSQL.
VMC
Verified Mark Certificate. A digital certificate issued by a Certificate Authority (DigiCert or Entrust) that cryptographically verifies ownership of a brand's trademarked logo for use with BIMI. Required for BIMI logo display in Gmail and Apple Mail. The logo must be in SVG Tiny PS format.
Related: Email Infrastructure & DeliverabilityWAF
Web Application Firewall. A security layer that sits in front of web applications and filters incoming HTTP/S traffic to detect and block attacks such as SQL injection, cross-site scripting (XSS), and bot abuse. AWS WAF, Azure Front Door WAF, and Cloudflare WAF are common enterprise solutions.
Related: GRC & Compliance AdvisoryWorkflow Automation
The use of software to execute a series of tasks, approvals, or data transformations automatically based on predefined triggers and rules - eliminating manual handoffs between people and systems. Microsoft Power Automate, Zapier, and n8n are popular workflow automation platforms for business processes.
XDR (Extended Detection & Response)
An evolution of EDR that unifies threat detection and response across multiple security layers - endpoints, email, network, cloud workloads, and identity - into a single platform with correlated alerts and automated investigation. XDR reduces alert fatigue by connecting signals that would appear unrelated in siloed tools. Microsoft Defender XDR is a leading enterprise implementation.
Related: GRC & Compliance AdvisoryZero Trust
A security model that assumes no user, device, or network segment is inherently trustworthy - including those already inside the corporate network. Every access request is verified against identity, device health, location, and behaviour before being granted. Microsoft's Zero Trust framework underpins its Entra ID, Defender, and Intune product suite.
Related: Data Residency & SecurityZero Trust Network Access (ZTNA)
A security model that provides application-level access based on verified identity and device posture rather than network location - replacing the traditional VPN model where connecting to the network grants broad access. ZTNA enforces least-privilege access dynamically: users only reach the specific applications they are authorised to use. Microsoft Entra Private Access and Zscaler Private Access are leading ZTNA solutions.
Related: GRC & Compliance AdvisoryWant a term added?
If there is a technical term you keep encountering that is not in this glossary, email us and we will add a definition.