Knowledge
Cybersecurity knowledge,
clearly explained
The key terms around network security, threat detection, and security testing — in plain language, without marketing. Each term explained individually, with a link to practice.
KNOWLEDGE
Threat detection & monitoring
NDR — Network Detection and Response
Analyzes real network traffic and catches attacks that log-based systems miss.
SIEM — Security Information and Event Management
Collects and correlates logs from many sources for central visibility, compliance, and forensics.
SOC — Security Operations Center
The team that assesses, triages, and responds to security alerts.
XDR — Extended Detection and Response
Bundles detection signals across multiple security layers into one correlated view.
EDR — Endpoint Detection and Response
Detects attacker activity directly on individual endpoints — laptops, servers, workstations.
IDS / IPS
Detects (IDS) or blocks (IPS) known attack patterns on the network.
KNOWLEDGE
Threats & attack techniques
Lateral Movement
An attacker's sideways spread through a network after the initial foothold.
Command-and-Control (C2)
The covert communication a compromised system uses to talk to the attacker.
Business Email Compromise (BEC)
Fraud carried out through compromised or spoofed business email accounts.
Ransomware
Malware that encrypts data and demands a ransom for its release.
APT — Advanced Persistent Threat
Long-term, well-resourced — often state-backed — attacker groups.
MITRE ATT&CK
The standard, open knowledge base of real-world attacker tactics and techniques.
KNOWLEDGE
Security testing
Penetration test
Authorized security assessment that exploits weaknesses and proves attack paths.
Vulnerability scan
Automated check against known security flaws — without proving exploitability.
Automated attack simulation
Proves attack paths like a pentest, but autonomous and repeatable.
Compromise Assessment
Point-in-time check of whether a network is already compromised.
Red Teaming
Realistic attack exercise against people, processes, and technology at once.
KNOWLEDGE
Fundamentals
Threat Intelligence
Structured knowledge about current attackers, their infrastructure, and their tools.
SPAN port / Network TAP
Technical connection points for passively reading network traffic.
Alert fatigue
When too many alerts mean none of them get read.
Encrypted network traffic
What network traffic reveals without being decrypted.
MDR — Managed Detection and Response
Detection as a managed service, and where AEGYS stops.
Shadow IT
Devices and services on the network that IT does not know about.