- Advanced Persistent Threat (APT)
- A funded, goal-directed adversary, typically state-directed, that pursues a specific objective over long periods, uses capabilities beyond ordinary crime, and returns to a target after being evicted. The term names an organization's patience and intent, not a single tool or intrusion.
- Build Pipeline
- The automated machinery that turns source code into a deployable artifact by fetching dependencies, compiling, testing, and packaging. Because it sits between trusted source and shipped product, compromising it injects malicious code into the artifact while the source stays clean.
- Cyber-Physical System
- A system in which computing and physical processes are tightly coupled, so a digital action produces a physical effect and vice versa. An AI facility qualifies because its compute depends on continuously managed power and cooling, making an attack on the plant an attack on the model.
- Firmware
- Low-level software embedded in hardware that runs before and beneath the operating system, such as boot code and device controllers. It executes at deep privilege, evades tools that watch the OS, and can survive a reinstall, making it a resilient foothold for attackers.
- Operational Technology (OT)
- The systems that run a facility's physical plant, including building management, power distribution, backup generators, and cooling controllers. Once isolated from data networks, OT is now converged with IT, exposing weakly secured, rarely patched controllers to network-borne attack.
- Pre-Positioning
- An intrusion whose goal is durable, hidden access to systems that a future crisis will make valuable, established now and activated later. It steals and breaks nothing, so it generates no alert, which makes it the hardest state-actor motive to detect.
- Software Bill of Materials (SBOM)
- A formal, machine-readable inventory of the components, versions, and suppliers that make up a piece of software, analogous to an ingredient label. Its value is speed: it lets defenders quickly determine whether a newly disclosed flaw or compromised package is present.
- Supply-Chain Attack
- An attack that compromises a target indirectly by subverting an upstream component, vendor, or build process it trusts. One well-placed compromise propagates to many downstream victims through trusted channels, which is why it is force multiplication for a state actor.