Cloud security glossary: 62 terms, defined plainly
A
Admission controller
A Kubernetes component that inspects requests to the cluster API before an object such as a pod is created, and can reject them. Security tools use one to stop images that fail a policy from being deployed. Upwind lists a container admission controller among its modules.
Related: CWPP
Reference: Kubernetes: admission controllers
Agent
Software installed inside a machine, container host or cluster that reports what happens there and, depending on the product, can block activity. Agents see running processes that outside scanning cannot, at the cost of deployment and upkeep.
Related: CWPP
Agentless scanning
Finding vulnerabilities, secrets, malware and misconfigurations without installing software on the workload, usually by reading cloud APIs and copies of workload disks. It covers a whole estate quickly but sees a moment in time rather than live activity.
Related: CWPP
AI-BOM
An AI bill of materials: an inventory of the models, datasets, AI services and libraries an organization uses. Wiz and Upwind both list AI-BOM on their AI security pages.
Related: CNAPP
AI-SPM
AI security posture management: inventory and configuration checks for AI services, models, pipelines and agents in your cloud accounts, such as an exposed model endpoint or training data with weak access controls.
Related: CNAPP
API security
Discovering the APIs an application exposes and testing or monitoring them for weaknesses such as missing authentication. Orca and Upwind list API security among their modules.
Related: CNAPP
ASPM
Application security posture management: one view of findings from code scanners, tied to the applications and owners they belong to, so teams can decide which application risks to fix first. Wiz Code and CrowdStrike Falcon Cloud Security list ASPM.
Related: CNAPP
Attack path
A chain of conditions an attacker could follow from an entry point to something valuable, for example an internet-facing machine with a vulnerable package whose role can read a sensitive database. Platforms compute attack paths to rank which findings matter.
Related: CNAPP
Attack surface management (ASM)
Continuously finding the assets an organization exposes to the internet, including ones nobody registered, and checking them for weaknesses. Cloud platforms add it to show which cloud resources are reachable from outside.
Related: CSPM
B
Blast radius
Everything an attacker could reach after compromising one identity, workload or credential. Reducing blast radius usually means narrower permissions and fewer network paths.
Related: CIEM
C
CIEM
Cloud infrastructure entitlement management: computing what each human and machine identity can do in your cloud accounts and flagging permissions larger than the job needs.
Related: CIEM
CIS Benchmarks
Configuration guidelines published by the Center for Internet Security for operating systems, cloud accounts and services. Posture tools commonly ship rule sets based on them.
Related: CSPM
Cloud detection and response (CDR)
Detecting attacks in cloud activity logs and workloads and helping teams investigate and respond, for example by isolating a workload or revoking a credential.
Related: CWPP
CNAPP
Cloud-native application protection platform: one product that combines posture, workload, identity, data and usually code checks over a single inventory, so related findings on the same asset are read together.
Related: CNAPP
Code-to-cloud tracing
Linking a problem found in a running cloud resource back to the code, template or pipeline that created it, so the fix lands in the source rather than in the live resource. Orca says its tracing can open pull requests.
Related: CNAPP
Compliance framework
A published set of controls an organization must show it meets, such as an industry standard or a government authorization program. Posture tools map their findings to frameworks to produce audit views.
Related: CSPM
Container image
The packaged file system and settings from which containers start. Because many containers start from one image, a vulnerability in the image repeats wherever it runs, which is why images are scanned before deployment.
Related: Vulnerability management
Control plane
The management layer of a cloud or cluster: the APIs that create, change and delete resources and permissions. Activity on the control plane, such as a policy change, is a common detection source.
Related: CSPM
CSPM
Cloud security posture management: reading cloud account configuration through provider APIs and flagging settings that break policy, such as public storage or disabled logging.
Related: CSPM
CVE
Common Vulnerabilities and Exposures: the public program that gives each disclosed vulnerability an identifier in the form CVE, year, number. Almost every vulnerability finding refers to one.
Related: Vulnerability management
Reference: CVE Program
D
E
eBPF
A Linux kernel feature that runs small, verified programs to observe system activity such as process starts and network connections. Several runtime sensors, including those from Orca, Wiz and Upwind, are described as eBPF-based.
Related: CWPP
EDR
Endpoint detection and response: an agent that records activity on laptops and servers and detects and stops attacks. CrowdStrike's Falcon sensor and Microsoft Defender for Endpoint extend EDR to cloud servers.
Related: CWPP
Effective permissions
What an identity can actually do once every attached policy, group membership, role assumption and boundary is combined. It often differs from what any single policy suggests.
Related: CIEM
EPSS
The Exploit Prediction Scoring System, run by FIRST, which estimates the probability that a published vulnerability will be exploited in the next 30 days. Aqua says it uses EPSS scores when ranking vulnerabilities.
Related: Vulnerability management
Reference: FIRST: Exploit Prediction Scoring System
F
Falco
An open-source runtime detection project for hosts, containers and Kubernetes, created by Sysdig and a CNCF graduated project. Sysdig Secure's runtime detection is built on it.
Related: CWPP
Source: Falco, read .
FedRAMP
The US federal government's authorization program for cloud services sold to federal agencies. Wiz says Wiz for Government is FedRAMP High authorized, Aqua states FedRAMP High Authorization, Orca states FedRAMP Moderate, and Upwind's newsroom said in November 2025 that it was pursuing FedRAMP.
Related: CSPM
Source: Wiz for Government, read .
File integrity monitoring (FIM)
Watching important files on a workload for unexpected changes. Defender for Servers Plan 2 and Wiz Defend both list it.
Related: CWPP
G
GovRAMP
An authorization program for cloud services sold to US state and local government. On 10 September 2026 Wiz said Wiz for Gov had achieved GovRAMP High authorization.
Related: CSPM
Source: Wiz blog: Wiz for Gov achieves GovRAMP High, read .
I
IaC scanning
Checking infrastructure-as-code templates for misconfigurations before they are applied, so a problem is fixed once in code rather than repeatedly in live resources.
Related: CSPM
Infrastructure as code (IaC)
Defining cloud resources in template files, such as Terraform or CloudFormation, that are applied by a pipeline instead of being created by hand.
Related: CSPM
J
Just-in-time access
Granting access to a machine or permission only when requested and only for a limited time, instead of leaving it open. Defender for Servers Plan 2 lists JIT access.
Related: CIEM
K
Kubernetes
An open-source system for running containers across a cluster of machines. Its own permissions, network rules and admission controls add a layer that cloud posture tools only partly see.
Related: CWPP
L
Least privilege
Giving each identity only the permissions it needs for its job and nothing more. CIEM tools measure the gap between granted and used permissions to move toward it.
Related: CIEM
M
Machine identity
An identity used by software rather than a person: a role assumed by a function, a service account used by a pipeline, a key used by a workload. In most cloud estates they outnumber human users.
Related: CIEM
MCP server
A service that exposes data or tools to AI applications through the Model Context Protocol. Because an MCP server can act on behalf of an AI agent, it is a new item to inventory; Orca and Upwind mention MCP servers in their AI security pages.
Related: CNAPP
Reference: Model Context Protocol
Misconfiguration
A setting that leaves a resource less safe than intended, such as storage open to the internet or logging switched off. Misconfigurations are the main thing posture tools find.
Related: CSPM
Multi-cloud
Running workloads on more than one cloud provider. Each provider has its own APIs, permission model and services, which multiplies what a security team must check.
Related: CSPM
N
NIST SP 800-53
The catalog of security and privacy controls published by the US National Institute of Standards and Technology. Government authorization programs assess cloud services against it.
Related: CSPM
Reference: NIST SP 800-53 Rev. 5
O
P
R
Runtime protection
Detecting and stopping attacks inside workloads while they run, by watching processes, files and network activity. It needs a sensor or agent on the workload.
Related: CWPP
S
SAST
Static application security testing: analysing source code for security flaws without running it. Orca lists SAST among its application security scanners; SAST is not among Upwind's listed modules.
Related: CNAPP
SBOM
Software bill of materials: a list of the components and versions inside a piece of software, used to answer whether a newly disclosed vulnerability affects you.
Related: Vulnerability management
Reference: CISA: Software Bill of Materials
SCA
Software composition analysis: identifying the open-source and third-party packages an application uses and flagging those with known vulnerabilities or license issues.
Related: Vulnerability management
Secrets scanning
Searching code, images and disks for credentials such as API keys and passwords that should not be stored there. SentinelOne says its scanning validates 850+ secret types.
Related: CNAPP
Security graph
A data model that stores cloud resources, identities, data stores and findings as connected nodes, so a platform can follow relationships between them. Wiz calls its version the Security Graph.
Related: CNAPP
Security posture
The overall state of an environment's security settings at a point in time: what is configured well, what is not, and what is exposed.
Related: CSPM
Serverless function
Code that runs on demand on infrastructure the provider manages, billed per execution. There is no machine to install an agent on, so protection relies on APIs, package scanning and the function's permissions.
Related: CWPP
Shadow AI
AI services, models or apps used inside an organization without the security team's knowledge. Orca lists shadow AI discovery; Aqua lists detection of unsanctioned AI usage.
Related: CNAPP
Shared responsibility model
The split of security duties between a cloud provider and its customer: the provider secures the underlying infrastructure, and the customer secures its own configuration, identities, data and workloads.
Related: CSPM
Shift left
Moving security checks earlier in the delivery process, into code review and build pipelines, so problems are fixed before deployment.
Related: CNAPP
SideScanning
Orca Security's name for its agentless method: it reads a workload's block storage out of band and reconstructs the file system in a read-only view to find vulnerabilities and other risks. Orca describes it as patented.
Related: CWPP
Source: Orca agentless SideScanning, read .
Snapshot scanning
A form of agentless scanning that analyses a copy of a workload's disk rather than the running machine. It finds what is installed, not what is currently running.
Related: Vulnerability management
T
Toxic combination
Two or more findings that are minor alone but serious together, such as a public endpoint, a vulnerable package and an over-permissioned role on the same workload.
Related: CNAPP
Trivy
An open-source scanner for container images, file systems, code repositories and infrastructure-as-code, maintained by Aqua Security under the Apache-2.0 license.
Related: Vulnerability management
Source: Trivy, read .
V
Vulnerability management
The ongoing work of finding known vulnerable software, ranking it by risk and getting it fixed.
Related: Vulnerability management