Cybersecurity Terms Glossary: EDR vs XDR vs MDR, SIEM, SOC and More

CVE (Common Vulnerabilities and Exposures) is an international programme that assigns a unique identifier to publicly disclosed security vulnerabilities. An ID such as CVE-2024-12345 lets the same flaw be tracked under one name across vendor advisories, scan reports and patch notes. The programme is run through cve.org.

What it means for a business: A CVE number in a vulnerability report makes it quick to find the matching patch and risk assessment. Prioritisation should consider not only the severity score but also whether the flaw is being actively exploited.

Related: vulnerability scanning · patch management

Data breach notification is the duty of a data controller to inform Turkey’s Personal Data Protection Board and the affected people when personal data is obtained by others through unlawful means. Under Board Decision 2019/10, the Board must be notified without delay and no later than 72 hours after the controller learns of the breach.

What it means for a business: The 72-hour window requires logs and an incident response plan to be ready so the scope can be understood quickly. The content and timing of a notification is a legal call; the technical team supplies the findings it needs.

Related: incident response · log management · KVKK security consulting

Data loss prevention (DLP) is the set of tools and policies that detects and blocks sensitive data leaving the organisation without authorisation through email, web uploads, USB drives or cloud sharing. It recognises content such as national ID numbers, card data or labelled documents through rules.

What it means for a business: For DLP to work, a company first needs to know which data sits where and how sensitive it is. Rules are started in monitor mode and tightened so they do not break everyday workflows.

Related: KVKK · encryption · KVKK security consulting

A DDoS (distributed denial of service) attack sends traffic from many compromised devices at once to make a website, application or internet link unavailable. It can aim to fill bandwidth, exhaust network devices or keep the application itself busy.

What it means for a business: For businesses that sell or serve customers online, an outage is lost revenue. High-volume attacks are usually scrubbed at carrier or data center level, while WAF and rate limiting handle application-layer attacks.

Related: WAF · bandwidth · firewall solutions

EDR is an endpoint security solution that continuously records process, file, network connection and registry activity on computers and servers, detects suspicious behaviour and provides response options. Unlike signature-based antivirus, it can catch unknown threats from behaviour and lets an incident be traced back afterwards.

What it means for a business: Unusual behaviour that appears before ransomware starts encrypting can be caught by EDR and the device isolated from the network. EDR alerts still need a team or an MDR service to watch them.

Related: endpoint security · XDR · MDR

Encryption transforms data with an algorithm and a key so that only those holding the right key can read it. Encryption at rest protects data on disks and in backups, and encryption in transit protects data moving across a network. Security depends on protecting the key as much as on the algorithm.

What it means for a business: A lost laptop or a stolen backup cannot be read if it is encrypted. For companies processing personal data, encryption is one of the most prominent technical measures.

Related: key management · TLS · KVKK technical measures checklist

A firewall is hardware or software that allows or blocks traffic between networks based on predefined rules. Rules rely on details such as source and destination address, port and protocol. It can sit between the internet and the internal network, between branches or between server zones.

What it means for a business: A firewall is only as good as its rule set. Unused open ports and allow-all rules should be cleaned up in regular reviews, and every change should be logged.

Related: firewall solutions · NGFW · WAF

An IDS (intrusion detection system) watches network or host traffic for known attack signatures and unusual behaviour and raises alerts. An IPS (intrusion prevention system) does the same detection and also blocks suspicious traffic automatically. Today it is mostly delivered as a feature of next-generation firewalls.

What it means for a business: Because IPS false positives can block legitimate traffic, rules are usually trialled in monitor mode first. Sending its alerts to a SIEM lets events be assessed together with other logs.

Related: NGFW · SIEM · firewall solutions

Incident response is the structured process followed from the detection of a security incident to its closure. Typical phases are preparation, detection and analysis, containment, eradication, recovery and post-incident review. Who makes decisions at each phase is agreed in advance.

What it means for a business: Teams without roles and a communication plan lose valuable hours during an incident. A written plan makes clear when management, legal and, if needed, the KVKK notification process come in, and it should be rehearsed at least once a year.

Related: SOC service · breach notification · disaster recovery

ISO/IEC 27001 is the international standard that sets requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). It is risk-based and includes controls for areas such as access control, cryptography, supplier relationships and incident management. Certification is granted after an audit by an independent body.

What it means for a business: When choosing a supplier, ISO/IEC 27001 certification signals that the company manages information security systematically. It is still worth checking which services and locations the certificate covers.

Related: ISO/IEC 27701 · certifications · ISO 22301

ISO/IEC 27701 is the international standard that provides requirements and guidance for managing the privacy of personal data. It defines a privacy information management system (PIMS) built on ISO/IEC 27001 and treats organisations separately in their roles as data controllers and data processors.

What it means for a business: A service provider’s ISO/IEC 27701 certificate shows that its privacy processes have been audited. It does not on its own prove KVKK compliance, but it is a useful basis when assessing technical and organisational measures.

Related: ISO/IEC 27001 · KVKK · certifications

Key management covers generating, securely storing, distributing, rotating and destroying encryption keys. Keys are usually kept in a hardware security module (HSM) or a key management service, separate from the data they protect.

What it means for a business: A key stored next to the encrypted data cancels out the protection encryption provides. Losing a key, on the other hand, makes the data permanently unreadable, so key backups and access rights need planning.

Related: encryption · TLS · PAM

KVKK is Turkey’s Personal Data Protection Law No. 6698, which sets the basic rules for processing personal data in Turkey. Article 12 requires data controllers to take appropriate technical and organisational measures to prevent unlawful processing of and access to personal data and to keep it safe.

What it means for a business: Technical measures typically include access authorisation, logging, encryption, backup and penetration testing. The explanations in this glossary are not legal advice; specific obligations should be confirmed with a legal adviser.

Related: KVKK security consulting · KVKK and data backup · breach notification

The principle of least privilege gives every user, application and service account only the minimum access needed to do its job. The NIST glossary defines it as a system restricting the access privileges of users and processes to what their assigned tasks require. Rights are granted by role and reviewed regularly.

What it means for a business: When an over-privileged account is compromised, the damage grows with it. Disabling leavers’ accounts and separating admin rights from everyday accounts are the quickest wins.

Related: privileged access management · zero trust

Log management is the process of collecting the records produced by systems and applications, storing them so they cannot be altered, making them searchable and disposing of them at the end of a set period. Access logs showing who reached which system and when are at its core.

What it means for a business: Understanding what happened after an incident depends on logs that exist and have kept their integrity. Retention periods vary by sector and regulation, so they should be set with legal input.

Related: SIEM and log management · SIEM · KVKK

MDR (Managed Detection and Response) is a service model in which a provider continuously handles threat detection, analysis and response. It usually builds on endpoint (EDR) or XDR data and includes response actions such as isolating a device when a threat is confirmed.

What it means for a business: EDR and XDR are technologies; MDR is the team that runs them. For companies with a small security team, it means alerts are also reviewed at night and over weekends.

Related: EDR · XDR · SOC service

Multi-factor authentication (MFA) requires at least two distinct factors to sign in. In the NIST definition, these are something you know (a password or PIN), something you have (a phone or hardware key) and something you are (a biometric). Even if a password is stolen, the account cannot be opened without the second factor.

What it means for a business: Email, VPN, remote desktop and admin consoles are where MFA should come first. App-based approval or hardware keys instead of SMS codes give stronger resistance to phishing.

Related: zero trust · PAM · zero trust network security

A next-generation firewall (NGFW) adds application awareness, user-based rules, intrusion prevention and encrypted traffic inspection to port and address filtering in a single device. It judges traffic by the application it belongs to, not only by port number.

What it means for a business: It lets branch, data center and remote access traffic be managed from one place. Keeping licensed features such as intrusion signatures and URL filtering up to date decides how much protection the device actually gives.

Related: firewall solutions · IDS / IPS · firewall

Patch management is the process of inventorying, testing, rolling out on schedule and verifying updates to operating systems, applications and firmware. Shorter windows are set for critical security patches and regular maintenance windows for the rest.

What it means for a business: Unpatched systems are among attackers’ most frequent ways in. Without an up-to-date inventory of which version runs where, patching stays incomplete, and end-of-support software needs a separate plan.

Related: CVE · vulnerability scanning · vulnerability scanning service

Penetration testing is a security assessment in which authorised specialists use real attackers’ techniques to break into systems with permission. It goes beyond automated scanning and shows how far an attacker could get by chaining weaknesses together. Scope, timing and rules of engagement are agreed in writing beforehand.

What it means for a business: The report lets findings be prioritised by business impact and fixes be confirmed through a retest. Testing after major infrastructure changes and at regular intervals is common practice.

Related: penetration testing · vulnerability scanning · WAF

Phishing is an attack that uses emails, text messages or web pages posing as a trusted organisation or person to collect usernames, passwords or payment details. Fake invoices, delivery notices and login pages are the most common forms. When a specific person is targeted, it is called spear phishing.

What it means for a business: A stolen password is often the first step of a ransomware attack. Email filtering, multi-factor authentication and staff awareness training, used together, sharply reduce the chance of a successful break-in.

Related: social engineering · MFA · cybersecurity services

Privileged access management (PAM) is the set of processes and tools that keeps high-privilege accounts such as system administrators, database administrators and service accounts under control. Passwords are stored in a vault, access is opened on request and approval, and sessions are recorded. Just-in-time access is a common practice.

What it means for a business: Once inside a network, attackers usually go after admin accounts. PAM makes it traceable who used these accounts, when and why, and produces evidence for audits.

Related: least privilege · MFA · zero trust

Ransomware is malicious software that blocks access to systems by encrypting or copying files and demands payment to restore the data or to keep it from being published. Modern attacks usually exfiltrate data before encryption and go after backups as well. Typical entry points are phishing, unpatched systems and compromised remote access accounts.

What it means for a business: A backup the attacker cannot delete, with restores tested on a schedule, is the core control that limits downtime. CISA’s #StopRansomware Guide also recommends keeping offline, encrypted backups of critical data.

Related: ransomware protection · resilience check · immutable backup

SIEM (Security Information and Event Management) is a system that collects logs from servers, network devices, firewalls and applications in one place, correlates them and raises alerts for suspicious patterns. It also keeps logs for long periods to support investigations and audit reporting.

What it means for a business: A SIEM is a tool, and it adds little value unless someone is assigned to review its alerts within a set time. That is why most companies pair it with a SOC service. The topic is covered in depth in What is SIEM.

Related: SIEM and log management · SOC · log management

A SOC (Security Operations Center) is the team and set of processes that monitors security events around the clock, triages alerts and runs incident response. A SOC works with data from SIEM, EDR and network security tools. It can be built in-house or bought as a service.

What it means for a business: Continuous monitoring needs specialists on shifts, which makes an in-house SOC costly for most mid-sized companies. With an outsourced SOC, the key point is that response times and the limits of its authority are written clearly into the contract.

Related: SOC service · SIEM · MDR

Social engineering is the practice of gaining information or access by exploiting people’s trust, haste or helpfulness instead of a technical flaw. Posing as IT support on the phone, sending an urgent payment request that appears to come from an executive and announcing a fake supplier bank account are typical examples. Phishing is its most common digital form.

What it means for a business: However strong the technical controls are, process rules are still needed, such as confirming payment and access changes through a second channel. When those rules are written down, staff can take the right step even under pressure.

Related: phishing · incident response

Threat intelligence is collected and analysed information about attackers’ methods, infrastructure and indicators such as malicious IP addresses, domains and file hashes. Technical indicators are fed into security tools, while strategic intelligence helps explain trends affecting a sector.

What it means for a business: Raw indicator feeds add little on their own; they become useful when tied to the company’s own systems and industry. They are one of the main inputs for keeping SOC and SIEM rules current.

Related: SOC · SIEM · SOC service

TLS (Transport Layer Security) is the protocol that encrypts traffic between a client and a server and verifies the server’s identity with a certificate. HTTPS in the browser, email transport and many APIs rely on TLS. Old SSL and TLS 1.0/1.1 are considered insecure; current practice is TLS 1.2 and 1.3.

What it means for a business: An expired certificate causes both an outage and a loss of user trust. A certificate inventory and automated renewal should be handled together with switching off old protocol versions.

Related: encryption · key management

Vulnerability scanning uses automated tools to scan servers, network devices and applications and report known security flaws, missing patches and misconfigurations. Findings are usually listed with CVE numbers and severity ratings. Scans can be external (from the internet) or internal (from inside the network).

What it means for a business: New vulnerabilities are published constantly, so a one-off scan dates quickly; regular repeats and tracking of findings are needed. Scanning gives a wide but shallow view, while penetration testing gives a narrow but deep one.

Related: vulnerability scanning service · CVE · penetration testing

A WAF (Web Application Firewall) inspects HTTP/HTTPS requests to web applications and blocks application-layer attacks such as SQL injection and cross-site scripting (XSS). Unlike a network firewall, it looks at the content of the request. It can run in front of the application as a reverse proxy or as a cloud service.

What it means for a business: For companies running an online store, customer portal or public API, it buys time until code is fixed. A WAF does not replace secure development and should be reviewed alongside penetration testing.

Related: firewall solutions · penetration testing · DDoS

XDR (Extended Detection and Response) extends detection and response beyond the endpoint and correlates data from email, identity, network and cloud workloads on one platform. It can show the steps of an attack, from a phishing email to a compromised server, as a single incident.

What it means for a business: It cuts the effort of stitching together alerts from separate consoles. In most cases XDR does not fully replace a SIEM; long-term log retention and regulatory reporting needs are assessed separately.

Related: EDR / XDR solutions · EDR · SIEM

Zero trust is a security model that assumes being inside the corporate network does not by itself earn trust. Each access request is verified separately against user identity, device health and context, and only the required resource is opened. The model is described in detail in NIST SP 800-207.

What it means for a business: Remote work, cloud applications and branch connections blur the old network perimeter. Zero trust makes it harder for an attacker with one compromised account to move across the whole network, and the shift is usually made step by step with MFA and network segmentation.

Related: zero trust network security · least privilege · network segmentation