Modern cybersecurity is full of acronyms (SOC, MDR, XDR, SIEM) that are often used interchangeably but mean very different things. This guide defines each term briefly and directly, explains how they relate to one another and links to a dedicated article on each one for anyone who wants to go deeper.
What Is a SOC (Security Operations Center)?
A SOC is the team (in-house or outsourced) that continuously monitors, detects and responds to cybersecurity threats, 24/7. It is the human and process layer that interprets the alerts generated by tools such as SIEM or XDR. Read the full definition of SOC →
What Is MDR (Managed Detection and Response)?
MDR is a managed service that combines detection technology with human analysts who actively investigate every alert and carry out the response (isolating a device, blocking an IP) on the client's behalf, instead of just sending a notification. Read the full definition of MDR →
What Is XDR (Extended Detection and Response)?
XDR is a platform that unifies and correlates data from multiple layers (endpoints, network, email, identity and cloud) in a single system, making it possible to detect attacks that would go unnoticed if each layer were analyzed separately. Read the full definition of XDR →
What Is SIEM (Security Information and Event Management)?
A SIEM centralizes and correlates security logs from virtually any source in the organization to generate alerts and support regulatory compliance through historical event storage. Read the full definition of SIEM →
How do these four concepts relate?
In practice, it is not about choosing just one: SIEM and XDR are the technologies that collect and correlate the data (SIEM focused on broad visibility and compliance, XDR focused on fast detection and response), while SOC and MDR are the service models that put people in charge of interpreting those alerts and responding: the SOC as a dedicated team, MDR as a service managed by a third party. Many providers, including ZetTateK, combine all four layers in a single continuous monitoring service.
Want to know which combination best fits your organization? Learn about our managed 24/7 SOC service, or request a free security assessment at no cost.
Complete cybersecurity glossary
Beyond the four concepts above, these are the cybersecurity terms companies hear most often, grouped by topic and explained in plain language.
Managed security models and services
MSSP (Managed Security Services Provider). A company that manages cybersecurity for other organizations externally: it monitors, detects and responds to threats continuously, usually 24/7. Unlike a consulting firm, an MSSP does not just advise; it runs security day to day.
Detection and response technologies
EDR (Endpoint Detection and Response). Technology installed on devices (computers, servers, laptops) to detect, investigate and stop advanced threats in real time, going beyond traditional antivirus. Read the full definition of EDR →
SOAR (Security Orchestration, Automation and Response). Technology that automates and coordinates repetitive security tasks (enriching an alert, opening a ticket, isolating a device) to respond faster and with fewer errors. Read the full definition of SOAR →
Security operations
NOC (Network Operations Center). The team that makes sure the infrastructure keeps running: network, links, servers, capacity and backups. It is constantly confused with the SOC, but each one watches something different: the NOC makes sure the network works, and the SOC makes sure no one breaks into it. Read the full definition of NOC →
Threat Hunting. The proactive search for hidden threats in a network, based on the assumption that an attacker may already be inside without having triggered any alerts. Instead of waiting for the alarm, analysts track subtle signs of compromise. Read the full definition of threat hunting →
Incident Response. An organized process to contain, eradicate and recover from an attack, minimizing damage and restoring operations. It includes clear phases: preparation, detection, containment, eradication, recovery and lessons learned.
Digital forensics. The discipline of collecting, preserving and examining digital evidence after an incident to understand what happened, how the attacker got in and what information was affected. Its findings are used to close the breach and to support legal proceedings.
Threat Intelligence. Information collected and analyzed about attackers, their techniques and their targets, which makes it possible to anticipate rather than just react. It helps a SOC prioritize risks and recognize known threats faster.
Incident response playbook. A written procedure that defines, step by step, what to do for a specific type of incident: who acts, in what order, what the analyst can execute without asking for permission and who gets notified. It is the operational level of the response plan. It is what separates containing an incident in minutes from improvising for hours. Read the full definition of incident response playbook →
Cyber insurance (cyber risk coverage). A policy that covers part of the financial cost of a cyber incident: forensic investigation, recovery, business interruption, notification of affected parties and third-party claims. It does not prevent the attack; it splits the bill. Before issuing a policy, the insurer requires a specific list of controls. Read the full definition of cyber insurance →
MTTD and MTTR (mean time to detect and mean time to respond). The two metrics used to measure time within an incident: how long the organization takes to detect it and how long it takes to act on it. They are the most direct indicator of whether monitoring really works. They should be written into the provider's SLA. Read the full definition of MTTD and MTTR →
Threats and attacks
Ransomware. Malicious software that encrypts a victim's files or systems and demands a payment (ransom) to restore access. Many variants also steal the data to apply pressure by threatening to publish it. Read the full definition of ransomware →
Phishing. An attack in which the criminal impersonates a trusted person or company (usually by email) to trick the victim into handing over passwords or data, or clicking malicious links. It is the most common entry point for cyberattacks.
CEO fraud. A scam in which someone impersonates an executive to obtain a wire transfer, a bank account change or confidential information. Unlike mass phishing, it targets a specific person and uses real names and transactions. The FBI counts it as part of BEC (business email compromise). Read the full definition of CEO fraud →
APT (Advanced Persistent Threat). A targeted, prolonged attack in which a well-resourced adversary infiltrates a network and stays hidden for weeks or months to steal information or spy. It is defined by stealth and persistence, not by a quick strike.
IoC (Indicator of Compromise). A technical clue that a system may have been compromised, such as a malicious IP, a suspicious file or anomalous behavior. Security teams use them to detect and track attacks.
Third-party risk (supply chain). The exposure a company inherits from its suppliers, cloud services, integrators and contractors: if one of them is compromised, the attacker gets in with legitimate access that no one questions. Almost half of the breaches in 2026 involved a third party. Read the full definition of third-party risk →
Offensive security
Pentesting (penetration testing). An assessment in which specialists simulate a real, controlled attack against a company's systems to uncover vulnerabilities before an attacker does. It ends with a report of findings and how to fix them. Read the full definition of pentesting →
Red Team. A comprehensive, stealthy attack simulation that mimics a real adversary to test not only the technology but also the organization's detection and response capabilities. It goes beyond a pentest.
Vulnerability Management. A continuous process of identifying, prioritizing and fixing security weaknesses before they are exploited. It is not a one-time scan, but a constant cycle of detection and remediation. Read the full definition of vulnerability management →
CVE / CVSS. A CVE is the unique, public identifier of a known vulnerability, so that everyone refers to it the same way. CVSS is the 0 to 10 score that indicates its severity and helps prioritize remediation.
MITRE ATT&CK. A free, public knowledge base that catalogs real attacker tactics and techniques, organized by phase. Security teams use it as a common dictionary to understand, detect and classify attacks.
Architecture and access control
Zero Trust. A security model based on “never trust, always verify”: no user or device is considered trusted just because it is inside the network. Every access must be authenticated and authorized. Read the full definition of Zero Trust →
ZTNA (Zero Trust Network Access). Applies the Zero Trust model to remote access: instead of granting access to the entire network like a traditional VPN, it grants access only to the applications each user needs, verifying their identity and context.
IAM / PAM (identity and privileged access management). IAM controls who can access which resources in the organization. PAM is its reinforced version for the most sensitive accounts (administrators and critical systems), with additional controls and monitoring.
IAM (identity and access management). A set of processes and tools that defines who each person in the company is, what they can access and for how long. It covers onboarding, permissions, periodic review and offboarding. It is the foundation on which MFA and Zero Trust rest. Read the full definition of IAM →
MFA (multi-factor authentication). A method that requires two or more proofs of identity to sign in (for example, a password plus a code on your phone), so that a stolen password is not enough to get in. It is one of the most effective and simplest defenses, although on its own it is no longer enough. Read the full definition of MFA →
Password vault. A tool that stores all of the company's passwords encrypted in a single secure place, generates strong passwords and controls who can access each account. It reduces password reuse, makes it easy to revoke access when someone leaves the team and logs every use. Read the full definition of password vault →
Firewall / NGFW (next-generation firewall). A firewall controls and filters the traffic entering and leaving a network according to security rules. An NGFW adds modern capabilities such as deep traffic inspection, intrusion prevention and application control.
Cloud, data and email security
CASB (Cloud Access Security Broker). A solution that sits between users and cloud services (such as Microsoft 365 or Google Workspace) to provide visibility and enforce security policies on how those applications are used.
CSPM (Cloud Security Posture Management). Technology that continuously reviews the configuration of cloud environments (AWS, Azure, Google Cloud) to detect and fix misconfigurations that could expose data. Misconfiguration is a frequent cause of breaches.
DLP (Data Loss Prevention). A set of tools and policies that prevents sensitive information from leaving the company without authorization, whether by mistake or intentionally. It monitors and controls data in email, on devices and in the cloud. Read the full definition of DLP →
DMARC. An email security standard that stops criminals from sending messages that spoof your company's domain. Together with SPF and DKIM, it verifies that an email claiming to come from your domain actually comes from it, protecting your brand against phishing.
Honeypot (decoy). A decoy system, designed to look like an attractive and vulnerable target, that is deployed to lure attackers and detect them or study their techniques without putting real systems at risk. It works as an early warning of malicious activity.
