- Converged Threat Surface
- The combined attack surface of AI infrastructure, in which enterprise IT, operational technology, physical access, and the supply chain form a single continuous surface an adversary can move across, rather than four separate domains.
- Detection Engineering
- The discipline of building, testing, versioning, and tuning detections as code, where every detection carries a hypothesis, a mapped adversary technique, and a test, so the alert pipeline stays an instrument rather than decaying into an unmanaged, fatigue-inducing landfill.
- Incident-Response Lifecycle
- The ordered set of phases through which an incident is managed: prepare, detect, contain, eradicate, recover, and learn. The lifecycle is circular, with lessons from the learn phase feeding back into preparation for the next incident.
- Recovery Point Objective
- The maximum amount of data or state an organization can afford to lose in an incident, expressed as the acceptable age of the last good restore point. A tight objective demands continuous replication rather than periodic backups.
- Recovery Time Objective
- The maximum acceptable duration a critical service may remain down before the harm becomes unacceptable. It is a business decision that drives architecture, since a tight objective demands hot standby and automated failover.
- Tabletop Exercise
- A facilitated, discussion-based rehearsal of an incident in which the real responders walk through their decisions against a scenario driven by escalating injects, exposing gaps in plans, authorities, and coordination before an adversary does.
- Threat Hunting
- A proactive, hypothesis-driven search for adversary activity that existing detections did not anticipate. A hunt succeeds when it finds an intrusion, exposes a visibility gap, or yields a repeatable query that can be promoted into a standing detection.
- Unified Command
- A command structure, borrowed from emergency-management doctrine, in which a single incident commander runs the response over domain deputies for IT and operational technology, giving a converged incident one owner, one timeline, and one common operating picture.