Security Operations Terms
Security operations is the day-to-day work of watching for trouble: scanning for malware and vulnerabilities, keeping software patched, and keeping the logs that show what happened. These terms explain the tools and practices behind that work, including what each one can and cannot catch. Each one is backed by NIST and CISA guidance.
Start here
- SIEM: A system that collects logs from across an organization, normalizes and correlates them, and raises alerts on suspicious activity.
- EDR: Security software on laptops and servers that records program behavior, flags suspicious activity, and lets responders isolate devices remotely.
- Vulnerability scanning: Automated checking of systems, devices, and websites for known security weaknesses such as missing patches and risky settings.
- CVE: A unique public identifier assigned to one specific, publicly disclosed security vulnerability so everyone can refer to the same flaw.
- CVSS: An open standard maintained by FIRST that rates the technical severity of a software vulnerability on a scale from 0 to 10.
- Patch management: The process of identifying, prioritizing, acquiring, installing, and verifying software patches and updates across an organization.
- Security logging: The practice of recording security-relevant events such as sign-ins and changes, and storing them so they cannot be altered, for detection and investigation.
- Malware scanning: Automated inspection of files, email, devices, or websites for malicious code using signatures and behavior, which catches known malware but not all of it.
Last updated October 14, 2026.