Atlas

A bilingual technical dictionary that reads as a knowledge graph.

Look up a technical term and see where it sits: what it builds on, what it is easily confused with, and what it leads to. Every entry is written in plain language, in English and Danish.

Free forever. No ads, no paywall, no tracking. Just a passion project.

Tip: press / anywhere to search.

⚄ Random term Explorer →Study →All terms A-Z →

All terms

AI

Evaluation & metrics · 12

Accuracy - The share of all cases a model gets right; simple to read, but it can look excellent when the thing you care about is rare.
Benchmark - A shared, public set of tasks with a fixed way of scoring, so that different models can be compared on the same terms.
Confusion matrix - A small table that counts, for every true class, how often a model gave each answer, showing exactly which mistakes it makes.
Cross-validation - Checking a model fairly by splitting the examples into parts and letting each part in turn be the one held back for testing.
Data drift - The slow or sudden change in real-world data after a model goes live, so it no longer looks like what the model learned from.
F1 score - One number that blends precision and recall, so it stays low unless a model both finds the real cases and avoids wrong flags.
LLM-as-a-judge - Using one large language model to grade the answers of another against a written scoring guide, instead of paying people to read them all.
Model evaluation (evals) - The practice of checking how well an AI system does its job, with scores, public tests, human review and deliberate attacks.
Precision - Of all the cases a model flags as positive, the share that really are; in security terms, how many alerts were real.
Recall - Of all the real positive cases, the share a model manages to find; in security terms, how many real attacks were caught.
Test set - Examples locked away while a model is built and opened once at the end to give an honest final score.
Validation set - Examples held back from training and checked again and again while building a model, to choose its settings and decide when to stop.

Machine learning basics · 29

Activation function - The rule each unit in a neural network applies to its summed input, letting the network learn curved rather than straight patterns.
Artificial intelligence (AI) - Computer systems that do tasks we normally link to human thinking, such as spotting patterns, answering questions or making choices.
Bias-variance trade-off - The tension between a model too simple to catch the real pattern and one so flexible that it chases chance details in its examples.
Classification - Teaching a computer to sort each new case into one of a fixed set of groups, such as approve or reject, or real attack or false alarm.
Clustering - Letting a computer put similar items into groups by itself, with no names or right answers given in advance.
Decision tree - A model that reaches an answer by asking a chain of yes or no questions about the input, each answer leading to the next question.
Deep learning - Machine learning that uses neural networks with many stacked layers, the approach behind modern image, speech and language tools.
Dimensionality reduction - Squeezing many inputs about each example into a few new ones that keep most of what tells the examples apart.
Feature - One measurable fact about an example, such as a price or an age, that a model reads as input when it makes a guess.
Feature engineering - Turning raw records into useful inputs for a model, by picking, cleaning, combining and reshaping the facts it will read.
Generative AI - AI that creates new content (text, images, sound, code) in the style of the examples it learned from, instead of only sorting or scoring.
Gradient boosting - A method that adds small decision trees one after another, each built to fix the mistakes the trees before it still make.
Inference - Using an already trained model to produce an answer for new input, which is what happens each time you ask a chat assistant something.
k-means clustering - A method that splits data into a chosen number of groups by moving each group's centre until every point sits with its nearest centre.
Label - The right answer attached to a training example, such as "spam" or a sale price, that a model learns to give on its own.
Linear regression - A simple model that predicts a number by adding up each input times its own weight, choosing the weights that fit past examples best.
Logistic regression - A simple model that sorts cases into two groups by turning a weighted sum of the inputs into a chance between 0 and 1.
Machine learning - Building computer systems that find patterns in examples and use them to make guesses, instead of following rules a person wrote.
Model training - The costly, one-off stage where a model looks at training data again and again and tunes its internal numbers until its guesses improve.
Neural network - A model made of many small linked units that each weigh their inputs and pass a number on, loosely inspired by the brain.
Overfitting - When a model learns its training examples by heart, including their noise, and then does badly on new cases it has not seen.
Random forest - A model that builds many slightly different decision trees on random parts of the data and lets them vote on the answer.
Regression - Teaching a computer to guess a number on a scale, such as a price, a time or a size, from past examples where the real number was known.
Reinforcement learning - Machine learning by trial and error, where a system acts, gets a reward or a penalty, and slowly learns which actions pay off.
Self-supervised learning - Machine learning where the right answers come from the data itself, for instance hiding a word in a sentence and guessing it back.
Supervised learning - Machine learning from examples that come with the right answer attached, such as emails already marked spam or not spam.
Training data - The examples a model learns from; its behaviour, its blind spots and its mistakes all come from what is in them.
Transfer learning - Reusing what a model already learned on one big task as the starting point for a new, related task, instead of starting from zero.
Unsupervised learning - Machine learning from examples with no answers attached, where the model finds groups, patterns or odd cases on its own.

AI risk & governance · 18

Adversarial example - An input altered on purpose, often in ways people cannot see, so that a trained AI model gives a confident but wrong answer.
AI alignment - The work of making an AI system aim for what people actually intend, and refuse what they would not accept.
AI bias - When an AI system treats some people or cases unfairly because of one-sided data or design choices.
AI governance - The rules, roles and checks an organisation uses to decide which AI it uses and to keep that use safe, lawful and fair.
AI red teaming - Testers attack an AI system on purpose, before and after release, to find ways it can be tricked into harmful or unsafe behaviour.
AI supply chain attack - Attacking the ready-made parts an AI system is built from - shared models, datasets or plug-in files - instead of the system itself.
Data poisoning - Slipping false or harmful examples into the data an AI learns from so that it later behaves the way an attacker wants.
Deepfake - A fake but convincing video, image or voice recording made with AI to show someone saying or doing what they never did.
EU AI Act - The EU law that sorts AI systems by how much harm they could cause and sets stricter rules the higher the risk.
Excessive agency - Giving an AI system more tools, rights or freedom to act than its job needs, so one wrong or tricked step can do real damage.
Explainability - How well people can understand why an AI system reached a particular result.
General-purpose AI model (GPAI) - The EU AI Act's name for a broad model that can handle many different tasks and be built into many other AI products.
Guardrails - Checks placed around an AI system that block unsafe requests going in and harmful or leaking answers coming out.
Jailbreak - Talking an AI chat assistant out of its own safety rules with cleverly worded requests, such as role-play or made-up emergencies.
Model card - A short fact sheet that ships with an AI model and says what it is for, how it was tested and where it falls short.
Prompt injection - Hiding instructions in the text an AI system reads so that it ignores its own rules and follows the attacker instead.
Sensitive information disclosure - An AI system revealing private or secret details, such as personal data or business secrets, to someone who should not see them.
Shadow AI - Staff using AI tools at work without the organisation knowing about them or having approved them.

AI-assisted coding · 10

Agent instructions file - A plain text file kept with the code that tells AI tools the project's rules, commands and habits before they start work.
AI code review - Using a large language model to read proposed code changes and leave comments on bugs, risks and style before a person approves them.
AI coding assistant - A tool built into a programmer's editor that suggests, explains and rewrites code using a large language model.
AI pair programming - Writing code together with an AI tool in a running back-and-forth, where the human stays in charge and checks every change.
Code completion - Greyed-out code that appears as you type, predicting the next line or block so you can accept it with one key.
Coding agent - An AI that is given a programming task and carries it out itself - reading files, running commands and editing code until done.
Fill-in-the-middle (FIM) - A training trick that teaches a model to write the missing piece between the text before a gap and the text after it.
Slopsquatting - An attack where criminals publish harmful packages under the made-up names that AI tools keep inventing for code.
Spec-driven development - Writing down exactly what the software must do, agreed by people, before letting AI tools write the code from that plan.
Vibe coding - Building software by describing what you want to an AI and accepting the code it writes without reading it.

Agents & tools · 10

Agent memory - Notes an AI agent saves outside the model and reads back later, so it can carry facts and past work from one chat to the next.
Agent sandbox - A walled-off space where an AI agent runs code and uses tools, so a mistake or trick cannot reach the rest of your systems.
Agent2Agent protocol (A2A) - An open standard that lets AI agents built by different companies find each other, hand over tasks and share results.
Agentic workflow - A fixed chain of steps written in code, where a language model does some of the steps but does not choose the order.
Computer use - Letting an AI agent work a computer like a person does - it looks at pictures of the screen and moves the mouse and types.
Human-in-the-loop (HITL) - Designing an AI system so a person must check or approve its work at key points before it takes effect.
MCP server - A small program that offers tools or data to AI apps through the Model Context Protocol, such as reading mail or searching files.
Model Context Protocol (MCP) - An open standard for plugging tools and data into AI assistants, so each tool is hooked up once and works in many apps.
Multi-agent system - A setup where several AI agents share a job - often a lead agent splits the work and hands parts to helper agents.
Tool calling - How a language model asks outside code to do something for it - look something up, run a task - and then reads back the result.

Language models · 14

AI agent - An AI system that does not just answer but acts - it plans steps and uses tools such as email, files or web search to reach a goal.
Context window - The most text, counted in tokens, that a language model can take in and keep in view at one time, including its own answer.
Embedding - A list of numbers that stands for the meaning of a piece of text, so that texts with similar meaning end up with similar numbers.
Fine-tuning - Giving an already trained model a short extra round of training on a smaller, focused set of examples to change how it behaves.
Hallucination - When an AI model states something false or made up - a fact, a quote, a source - in the same confident tone as a true answer.
Knowledge cutoff - The date after which a language model saw no new text, so on its own it knows nothing about events that came later.
Large language model (LLM) - A very large model trained on huge amounts of text to predict the next word, which lets it write, sum up and answer in fluent language.
Next-token prediction - How a language model writes - it guesses the single most fitting next piece of text, adds it, and repeats until the answer is done.
Prompt - The text you give a language model - a question, an order, pasted files - that it treats as its starting point for an answer.
Reasoning model - A language model trained to work through a problem step by step in hidden notes before it answers, trading time and cost for better answers.
Retrieval-augmented generation (RAG) - Letting a language model first look up relevant passages in your own documents and then answer from them, instead of from memory alone.
Token - A small piece of text - a whole word, part of a word or a symbol - that a language model reads and writes in; also how use is priced.
Tokenizer - The part of a language model that cuts text into tokens and turns them into numbers on the way in, and back into text on the way out.
Transformer - The neural network design behind today's language models, which weighs how every word in a text relates to every other word.

Model architectures · 10

Attention mechanism - The step inside a model that decides, for each token, which other tokens in the input matter most right now.
Convolutional neural network (CNN) - A neural network built for pictures - it slides small pattern checks across an image to find edges, then shapes, then whole objects.
Decoder - The half of a model that writes output one token at a time, each new token based only on what came before it.
Diffusion model - The kind of generative AI behind many image makers, which starts from random static and cleans it up step by step into a picture.
Encoder - The half of a model that reads the whole input at once and turns it into embeddings that capture its meaning.
Foundation model - A large model built once on huge amounts of broad data and then reused as the starting point for many different tasks.
Mixture of experts (MoE) - A way to build a very large model where only a few of its many parts do the work for each token, so answers cost far less.
Multimodal model - A model that can take in, and sometimes produce, more than one kind of content - such as text, photos and speech - in one conversation.
Open-weight model - A model whose learned numbers are published for anyone to download and run themselves, instead of only being reachable through an API.
Small language model (SLM) - A language model small enough to run cheaply on a laptop or phone, trading some broad skill for speed, privacy and low cost.

Training & optimisation · 17

Backpropagation - The bookkeeping method that works out, layer by layer from the output back, how much each weight in a network added to its mistake.
Batch size - How many examples a model looks at together before it updates itself once during model training.
Data labeling - Having people (or tools) attach the right answer to each example, such as “cat”, “complaint” or “angry”, so a model can learn from it.
Epoch - One complete pass of model training through every example in the training data; training often runs for several.
Gradient descent - The step-by-step method most models learn by, which nudges every setting a little in whichever direction makes the error shrink.
Hyperparameter - A setting a person chooses before model training starts, such as step size or number of rounds, and that the model does not learn itself.
Instruction tuning - Extra training on many written requests paired with good answers, which turns a text-continuing base model into one that follows orders.
Learning rate - The setting that decides how big a step a model takes each time it adjusts itself to make fewer mistakes during learning.
Loss function - The scoring rule that turns how wrong a model's answer is into a single number, which model training then tries to push down.
Low-rank adaptation (LoRA) - A cheap way to fine-tune a big model - freeze the original weights and train only a small add-on that nudges its behaviour.
Model parameter - One of the numbers inside a model that is set by learning from data; their count is how model size is usually stated.
Model weights - The learned numbers that set how strongly each part of a neural network influences the next; in practice, the file that is the model.
Pretraining - The first, huge and costly stage of teaching a model, reading vast amounts of text to pick up general patterns before any special task.
Regularization - Any rule added during learning that holds a model back from fitting its examples too closely, so it does better on new cases.
Reinforcement learning from human feedback (RLHF) - Improving a model by having people rank its answers, teaching a scorer from those rankings, then training the model to earn high scores.
Synthetic data - Made-up examples produced by a program or another AI model to look like real records, used where real examples are scarce or private.
Underfitting - When a model is too simple or trained too little to catch the pattern, so it scores badly even on the examples it learned from.

Prompting & generation · 10

Chain-of-thought (CoT) - Getting a language model to write out its steps before the final answer, which tends to help on sums, logic and planning.
Context engineering - Choosing all a language model gets to see for a task - instructions, fetched documents, tool results, notes - not just the wording.
Few-shot prompting - Showing a language model a handful of worked examples inside the request, so it copies the pattern for the new case.
Prompt engineering - The craft of wording, ordering and testing the text you send a language model so that it gives useful answers more often.
Sampling - How a language model picks each next piece of text from its list of likely options, by a set rule or with some chance involved.
Structured output - Making a language model answer in a fixed, machine-readable shape - set fields in JSON - so other software can use the reply directly.
System prompt - Standing orders the maker of an AI service places ahead of every chat, setting the assistant's role, rules and tone before the user types.
Temperature - A per-request dial - low keeps a language model's wording steady and repeatable, high makes it more varied and less predictable.
Top-p sampling - A rule letting a language model pick only among its most likely next options, until their chances add up to a set share like 90%.
Zero-shot prompting - Asking a language model to do a task from an instruction alone, with no worked examples to copy.

Retrieval & search · 10

Chunking - Cutting long documents into smaller passages before storing them, so a search can return just the part that answers a question.
Cosine similarity - A score from -1 to 1 for how closely two lists of numbers point the same way, used to tell how alike two embeddings are in meaning.
Embedding model - A model that reads a piece of text and gives back an embedding instead of writing an answer.
Grounding - Tying a model's answer to sources supplied with the question, so each claim can be traced back to a given document.
Hybrid search - Running a word-matching search and a meaning-based search side by side and merging their results into one list.
Keyword search - Finding texts that contain the same words as the question, ranked by how often those words appear and how rare they are overall.
Nearest-neighbour search - Finding the few stored items that sit closest to a given one, usually trading a little exactness for a lot of speed.
Reranking - A second, more careful pass that reorders a first rough list of search results so the most useful ones end up on top.
Semantic search - Finding text by what it means rather than by the exact words it uses, so a question can match a passage phrased differently.
Vector database - A store built to keep huge numbers of embeddings and quickly return the ones closest in meaning to a question.

AI hardware & serving · 10

Graphics processing unit (GPU) - A chip first built to draw screen images that does thousands of small sums at once, which is why it now runs most AI work.
Knowledge distillation - Training a small “student” model to copy the answers of a large “teacher” model, so it keeps much of the skill at a fraction of the size.
KV cache - Memory where a language model keeps work it already did on earlier tokens, so each new word does not mean rereading everything.
Latency - How long one request has to wait from being sent until its answer arrives - for an AI chat, the pause before and while it replies.
Model serving - Keeping a trained model running on machines so other programs can send it questions over an API and get answers back.
Prompt caching - A service feature that saves the work done on the start of a prompt, so later requests starting the same way are faster and cheaper.
Quantization - Storing a model's numbers with fewer digits so it takes less memory and runs faster, at the cost of a little quality.
Tensor processing unit (TPU) - Google's own chip made only for the number work inside neural networks, mostly rented out through Google Cloud rather than sold.
Throughput - How much work a system gets through per second in total - for AI services, often counted as tokens or requests handled each second.
Time to first token (TTFT) - How long a user waits after sending a prompt before the first piece of the answer appears on screen.

Computer science

Identity & access · 21

Access control - The rules and mechanisms that decide who may use which systems, data or rooms, and in what way.
Authentication - Checking that someone who logs in really is who they claim to be, usually by asking for a credential such as a password.
Authorization - Deciding what an already identified user is allowed to do, such as which files they may open or change.
Conditional access - Rules that decide at each login whether to let someone in, ask for more proof or block them, based on who, where and what device.
Credential - Something a user presents to prove who they are, such as a password, a key card or a fingerprint.
Digital identity - The set of facts that lets a computer system tell one person, device or program apart from all others.
Identity federation - An agreement between organisations to trust each other's logins, so a person proven at home is let in elsewhere.
Identity provider - A trusted service that stores users' identities, checks their logins and vouches for them to other applications.
OAuth - A way to let one app act on your behalf in another service, with a limited pass instead of your password.
OpenID Connect (OIDC) - A login standard built on top of OAuth that tells an app who the user is, not just what it may do.
Passkey - A login without a password, where your device proves who you are with a secret key that never leaves it.
Password - A secret string of characters, known only to the user, typed in to prove they are who they claim to be.
Principle of least privilege - Giving every user, program and service only the permissions its task needs, and nothing more.
Privileged access management (PAM) - Tools and rules that lock away admin rights, hand them out only when needed and record what is done with them.
Privileged account - An account with power beyond normal use, such as installing software, changing settings or managing other users.
Role-based access control (RBAC) - Giving permissions to job roles rather than to individual people, and then giving people the roles that fit their job.
SAML - An older, widely used standard for passing a signed “this user has logged in” message from an identity provider to an app.
Service account - An account used by a program rather than a person, so that software can log in to other systems on its own.
Session - The period in which a system remembers that a user has logged in, so they need not prove who they are at every step.
Single sign-on (SSO) - Logging in once to reach many separate applications, with a trusted identity provider vouching for the user to each.
User account - A record in a system that lets a particular person or program log in, and holds the permissions it has been given.

Web & data · 10

API - A fixed set of requests one program offers so other programs can use its data or features without seeing its insides.
Cookie - A small piece of text a website asks the browser to keep and send back on every visit, so the site can recognise it.
Database - An organised store of data that many programs and users can search, add to and change at the same time without mixing it up.
HTTP - The request-and-answer rules a web browser and a server follow to fetch pages, pictures and data across the internet.
JSON - A simple text format for writing down data as named values and lists, easy for both people and programs to read.
REST API - A common style of web API where each thing has its own URL and programs use plain HTTP methods to read, add, change or delete it.
Same-origin policy - A browser rule that stops a page from one site reading data that belongs to another site open in the same browser.
URL - A written address that says where something lives on the internet and how to reach it, such as a web page or a file.
Web application - A program you use through a web browser, with its logic and data kept on a server instead of installed on your own machine.
Web browser - The program people use to visit websites - it fetches pages from servers and turns them into something you can read and click.

Operating systems · 10

Audit logging - A system's record of who did what, and when, for the actions that matter to security.
File system - The way an operating system organises stored data into files and folders and keeps track of who may use each one.
Kernel - The core of the operating system, which has full control of the machine and decides what every program may do.
Log - A time-stamped record of events that a system or program writes down as they happen.
Operating system - The base software that runs a computer, shares it between programs and keeps them from interfering with each other.
Patch - A small piece of software from a vendor that fixes a flaw - often a vulnerability - in a program already installed.
Permission - A specific right given to an account, such as to read, change or delete a file, or to run a program.
Process - A program while it is running, with its own space in memory and the rights of the account that started it.
Secure boot - A start-up check that lets a computer run only boot software and a kernel carrying a trusted digital signature.
Service - A program that runs in the background without a user, often starting with the computer and waiting to handle requests.

Cryptography · 10

Certificate authority (CA) - A trusted body that checks who someone is and then signs digital certificates vouching that a public key belongs to them.
Cryptographic key - The secret value that decides how data is scrambled and restored - whoever holds it can read the protected data.
Digital certificate - A signed digital document that ties a public key to a name, such as a website address, so others can trust whose key it is.
Digital signature - A mark made with a private key that proves who sent a message and that nobody has changed it since.
End-to-end encryption - Scrambling a message on the sender's device so that only the receiver's device can read it, not even the service carrying it.
Hashing - Turning any amount of data into a short, fixed-length value that changes completely if even one character changes.
Key management - Looking after cryptographic keys over their whole life - making, storing, handing out, changing and finally destroying them.
Public key infrastructure (PKI) - The system of trusted issuers, rules and records that hands out digital certificates and says which ones to believe.
Public-key cryptography - Encryption that uses a pair of keys - one shared openly, one kept private - so strangers can protect data for you without a shared secret.
Symmetric encryption - Encryption where the same secret key both locks and unlocks the data, so sender and receiver must share it in advance.

Networking · 17

Client - The program or device that starts a network exchange by sending a request, such as a web browser asking for a page.
DNS - The lookup system that turns names people can read, like example.com, into IP addresses.
Encryption - Scrambling data with a secret key so only someone holding the matching key can read it.
Firewall - A gatekeeper that checks network traffic against rules and lets through only what is allowed.
HTTPS - The way web browsers and websites exchange pages with TLS protecting every message, so no one on the way can read or change them.
Internet - The worldwide network of networks that lets almost any connected device reach almost any other.
IP address - A number that identifies a device on a network so that data can be delivered to it.
Network - A set of connected devices that can send data to each other over cables or radio signals.
Network segmentation - Splitting one network into separate zones, so a problem in one zone cannot easily spread to the others.
Packet - A small, labelled chunk of data that travels across a network on its own and is put back together at the end.
Port - A number that picks out which program on a device should receive incoming network data.
Protocol - An agreed set of rules for how devices on a network format, send and answer messages.
Router - A device that joins networks together and passes each packet on toward its destination.
Server - A computer or program that waits for requests over a network and answers them, such as sending a web page or storing email.
TCP/IP - The family of protocols that the internet and most other networks use to address, send and deliver data.
TLS - The protocol that wraps data sent over TCP/IP in an encrypted channel after checking the other side's certificate.
VPN - An encrypted tunnel across a public network that makes a distant device act as if it were inside a private one.

Platform

Observability · 10

Alerting - Rules that tell the right person, at once, when a system needs human attention, and stay quiet when it does not.
Distributed tracing - Following one user request as it passes through many services, timing each step, to see where it slowed down or failed.
Health check - A small automatic test, repeated every few seconds, that asks a running service whether it is alive and able to answer.
Metrics - Numbers a system records at regular times, such as requests per second or memory used, so trends can be charted and compared.
Monitoring - Watching a set of chosen measurements on systems over time and warning people when one moves outside its normal range.
Observability - How well you can work out what is going on inside a running system just from the signals it sends out.
Runbook - Written step-by-step instructions for handling one known situation, such as a certain alarm, so anyone on call can act fast.
Service level agreement (SLA) - A written promise in a contract about how well a service will work, with a price to pay, such as money back, if it is broken.
Service level objective (SLO) - An internal target for how well a service should work, such as 99.9% of requests answered within a second over 30 days.
Telemetry - The data a running system sends out about itself, mainly logs, metrics and traces, so people can see how it is doing.

Software delivery · 10

CI/CD - Merging, testing and releasing small software changes automatically and often, instead of in rare, large batches.
Code signing - Adding a digital signature to software so users and systems can check who made it and that nobody changed it afterwards.
DevSecOps - Building security checks into the everyday work of the teams that write and run software, rather than adding them at the end.
GitOps - Running systems so that files under version control hold the only true description, and software keeps the live setup matching them.
Infrastructure as code (IaC) - Describing servers, networks and cloud settings in text files that a tool reads to build them, instead of setting them up by hand.
Pipeline - A fixed, automatic chain of steps that takes a code change from saved file to running software, stopping if any step fails.
Software bill of materials (SBOM) - A list of every component and outside library a piece of software contains, so its owners know exactly what is inside it.
Software composition analysis (SCA) - Automatic checking of the outside libraries a program is built from, looking for known flaws and licence problems.
Software supply chain - Everything and everyone that goes into making software you run, from outside code parts to the tools that build and ship it.
Version control - A system that keeps every saved version of a set of files, with who changed what and when, so work can be compared or rolled back.

Cloud · 10

Cloud computing - Renting computing power, storage and software over the internet from a provider, paying for what you use instead of owning it.
Cloud IAM - The cloud provider's built-in system of policies that decides which users, roles and service accounts may do what to each resource.
Cloud misconfiguration - A wrong or careless setting in a cloud service - like storage left open to everyone - that exposes data or systems.
Hypervisor - The layer of software that splits one physical computer into several virtual machines and keeps them apart.
Infrastructure as a service (IaaS) - The cloud model where you rent bare building blocks - machines, storage and network - and run everything on top yourself.
Platform as a service (PaaS) - The cloud model where the provider runs the machines and operating system, and you only bring your own program and its data.
Secrets management - Keeping passwords, keys and tokens that programs use in one guarded store, instead of scattered in code and files.
Shared responsibility model - The split of security duties between a cloud provider and its customer, which shifts with the kind of service bought.
Software as a service (SaaS) - The cloud model where you simply use a finished program over the internet, and the provider runs everything behind it.
Virtual machine - A whole computer made in software, with its own operating system, running side by side with others on one physical machine.

Containers & orchestration · 10

Container - A sealed-off box for one program and everything it needs, sharing the host computer's kernel instead of carrying its own.
Container escape - An attack where code running inside a container breaks out of it and gains control of the host machine beneath it.
Container image - The frozen, read-only package of a program and its files from which identical containers are started.
Container orchestration - Letting software run many containers across a group of machines automatically, so nobody has to start and place them by hand.
Container registry - A shared online store where container images are uploaded, given names and versions, and fetched by the machines that run them.
Container runtime - The software on each host that actually starts, stops and walls off containers - containerd is a well-known example.
Docker - The widely used tool that made containers easy to use - it builds container images, shares them and runs them with a few commands.
Kubernetes - The most widely used open-source system for container orchestration, first built at Google and released in 2014.
Microservices - A way of building an application as many small, separate services that each do one job and talk to each other over an API.
Pod - The smallest unit Kubernetes runs - one or a few tightly linked containers that share a network address and storage.

Security

Controls & technical basics · 25

Access management - The rules and routines that decide who may use which data and systems, and that keep those rights correct over time.
Asset inventory - One complete, up-to-date list of the organisation's computers, devices, systems and software.
Authentication factor - One kind of proof used to log in - something you know, something you have, or something you are.
Backup - A separate copy of data kept so it can be restored after a breakdown, a mistake or an attack.
Change management - A controlled process to plan, approve, record and check every change made to IT systems.
CIS Controls - A ranked, public list of security measures from the Center for Internet Security that tells an organisation what to do first.
Endpoint - Any device that connects to the network at its edge and is used directly - a PC, phone, printer or similar.
Endpoint detection and response (EDR) - Software on each computer and phone that watches for signs of an attack and can stop it on the spot.
Hardening - Making a system harder to attack by turning off what is not needed and changing unsafe default settings.
Intrusion detection system (IDS) - A watcher that inspects network traffic or a machine's activity and warns when it spots signs of an attack - without stopping it.
Intrusion prevention system (IPS) - A guard placed in the path of network traffic that recognises signs of an attack and blocks them as they happen.
Multi-factor authentication - A way to log in that asks for two or more separate kinds of proof, such as a password plus a code or an approval in a phone app.
One-time password (OTP) - A short code that works for a single login and then expires, sent by text message or shown in an app.
Organisational control - A safeguard made of rules, roles and routines - who decides, who does what, and how work must be done.
Patch management - The routine of keeping all software up to date so that known weaknesses are closed before attackers use them.
Penetration test - An agreed, simulated attack in which skilled testers try to break in, to show how well systems really hold up.
People control - A safeguard aimed at staff themselves - screening, training, clear duties and what happens when someone joins or leaves.
Security monitoring - Keeping a steady watch on systems and networks so that signs of attack or misuse are spotted while there is still time to act.
Security operations centre (SOC) - A team that watches an organisation's systems around the clock and acts when an alarm points to a real attack.
SIEM - A system that gathers logs from across the organisation in one place and raises an alarm when something looks wrong.
Technical control - A safeguard built into hardware or software, which works automatically once it is set up.
Two-factor authentication - The most common form of MFA, where logging in needs exactly two separate proofs, usually a password and a one-time code.
Vulnerability assessment - A review of systems to find their weaknesses and rank which ones matter most to fix first.
Vulnerability scanning - An automatic, repeated check of systems against a list of known weaknesses, producing a report of what was found.
Zero Trust - A security principle of never trusting anyone automatically - every request is checked, even from inside the network.

Detection & response · 10

Alert triage - Sorting incoming alarms quickly into real threats, harmless noise and cases that need a closer look, so the worst get handled first.
Anomaly detection - Learning what normal activity looks like and raising an alarm when something departs from it, even if no rule describes the attack.
Detection rule - A written condition that a monitoring tool checks against incoming logs, raising an alarm whenever the events match it.
False positive - An alarm about an attack or problem that turns out not to exist, because harmless activity was taken for harmful.
Indicator of compromise (IoC) - A trace left behind by an attack, such as a known bad web address or file, that shows a system has probably been broken into.
Log management - Collecting logs from every system into one place, in one format, kept safe from change and for as long as they are needed.
Log retention - Deciding how long each kind of log is kept before it is deleted - long enough to look into incidents, but no longer than needed.
MITRE ATT&CK - A free, public catalogue of the goals and methods real attackers use, giving defenders a shared language for how attacks unfold.
SOAR - A platform that ties a security team's tools together and runs the routine steps of handling an alarm by itself.
Threat hunting - Searching on purpose for attackers who may already be inside the network, without waiting for an alarm to go off.

Compliance & regulation · 43

Audit - An independent check of whether an organisation actually follows its own policies and the requirements it has signed up to.
Centre for Cyber Security (CFCS) - Denmark's national cyber security body from 2012, which in January 2025 became part of the Danish Resilience Agency (SAMSIK).
CER Directive - The EU law that makes the operators of vital services like power and water able to withstand floods, sabotage and other physical threats.
Certification - Formal proof from an approved outside body that an organisation's security meets a published standard such as ISO 27001.
Compliance and risk coordinator - A role, often a first job in the field, that tracks which rules apply, where the organisation falls short, and how its risks are handled.
Compliance roadmap - A time plan that turns a list of gaps into ordered steps, owners and dates for meeting a set of requirements.
Continuous improvement (PDCA) - A repeating four-step loop - Plan, Do, Check, Act - for getting a little better each round.
Cyber Resilience Act (CRA) - The EU law that makes makers of connected products and software build them secure and keep fixing their flaws.
D-mærket - A Danish label showing that a company takes care of IT security and data, starting with a free self-check.
Danish NIS2 Act (NIS2-loven) - The Danish law that writes the EU's NIS2 rules into national law and names who checks that firms follow them.
Data controller - The organisation that decides why and how personal data is used, and so carries the main legal duty under GDPR.
Data ethics - Asking not only whether a use of data is legal, but whether it is fair, open and in line with what people would expect.
Data processing agreement (DPA) - A written contract that sets how a supplier may handle personal data on your behalf.
Data processor - An outside party that handles personal data on behalf of another organisation and only as that organisation instructs.
Data protection impact assessment (DPIA) - A written check, done before starting, of how a planned use of personal data could harm people and how to reduce that harm.
DORA - The EU law that makes banks, insurers and other financial firms able to keep running through IT failures and cyber attacks.
Essential and important entities (NIS2) - The two groups of organisations NIS2 covers, sorted by sector and size, with stricter oversight for the essential group.
EU directive - A type of EU law that sets goals every member state must reach, but lets each country write its own national law to do it.
EU regulation - A type of EU law that applies directly and identically in every member state, with no national law needed to bring it in.
Gap analysis - A comparison of what an organisation does today with the requirements it wants to meet.
GDPR - The EU law that protects personal data and gives people rights over how it is used.
Governance, risk and compliance (GRC) - The joined-up work of steering security from the top, deciding which dangers to handle, and proving that rules are met.
Grey roles - Security jobs that sit between technology, management and people - coordinating and translating rather than hands-on engineering.
Information security coordinator - The person who keeps an organisation's day-to-day security work organised, tracked and reported to management.
Information security management system (ISMS) - The set of policies, roles, processes and records an organisation uses to run its information security in a planned, repeatable way.
ISO 27000 series - The family of international standards for information security, with ISO 27001 at its centre and guides built around it.
ISO 27001 - The international standard for running an information security management system that can be certified.
ISO 27001 Annex A - The list of 93 reference controls at the back of ISO 27001 that every organisation using the standard must hold its own controls up against.
ISO 27002 - A guidance standard describing each security control in detail - what it is for and how to put it in place.
Management responsibility - The duty of top leaders to own, approve and be able to show the organisation's security work.
NIS1 Directive - The first EU-wide cybersecurity law, from 2016, which set security and reporting duties for key service providers until NIS2 replaced it.
NIS2 Directive - The EU cybersecurity law that sets shared security duties for organisations in important and critical sectors.
NIS2 minimum requirements - The baseline list of security measures every organisation under NIS2 must have in place.
NIST Cybersecurity Framework (CSF) - A free US framework that sorts security work into six broad goals, from steering it to recovering after an attack.
Personal data - Any information about a living person who can be named or traced, directly or by putting pieces together.
Privacy by design - The GDPR principle that protection of personal data must be built into systems from the start.
Security framework - A ready-made, shared structure of goals and controls that an organisation follows to build and check its security work.
Security maturity - How far an organisation's security has grown - from random and tied to single people to planned, measured and steadily improving.
Security metrics (KPIs) - Numbers chosen in advance to show whether security work is having the effect it should.
Self-assessment - An organisation checking its own security against a set list of questions or criteria, without an outside inspector.
Statement of Applicability (SoA) - A document listing every control in the ISO 27001 annex, saying whether each is used, and giving the reason.
Supervisory authority - The public body in each EU country that oversees GDPR, handles complaints and can seek fines; in Denmark, Datatilsynet.
Supplier management - Making sure outside partners who handle your data or systems meet your security demands.

Application security · 12

API security - Protecting the APIs that programs use to talk to each other, so each caller can reach and change only what it is allowed to.
Attack surface - The sum of all the places where an outsider could try to get into a system, send data into it or pull data out.
Cross-site request forgery (CSRF) - An attack where a harmful page makes a user's browser send a request to a site they are logged in to, which acts as if they asked.
Cross-site scripting (XSS) - An attack that smuggles a harmful script into a web page, so it runs in the browser of everyone who visits the page.
CSRF token - A secret, hard-to-guess value a site puts in its own forms and checks on every change, so requests started by other sites fail.
Input validation - Checking every piece of data a program receives against strict rules before using it, and turning away anything that does not fit.
OWASP Top 10 - A widely used, regularly updated list of the ten most serious kinds of security flaw found in web applications.
Secure development lifecycle (SDL) - A fixed set of security steps built into every stage of making software, from planning and design through testing to release.
SQL injection - An attack where text typed into a form is read by the database as a command, letting an outsider read or change its data.
STRIDE - A memory aid that sorts threats into six kinds, so a team checks every part of a design for each kind in turn.
Threat modelling - Sitting down with a drawing of a system to work out what could go wrong, who might cause it and what to do about it.
Web application firewall (WAF) - A filter in front of a website that reads each web request and blocks those that look like known attacks.

Fundamentals · 38

Asset - Anything of value to the organisation that needs protecting - data, systems, devices, people or know-how.
Availability - Making sure information and systems can be used by the right people when they are needed.
CIA triad - The three pillars of information security - confidentiality, integrity and availability.
Compliance - Living up to the laws, rules and standards that apply - for example NIS2, GDPR or ISO 27001.
Confidentiality - Making sure only the right people can see a piece of information.
Credential stuffing - Trying stolen user names and passwords from one leak on many other sites, hoping people used the same password there.
Cyber and information security - Protecting an organisation's data, systems and ways of working against loss, misuse and interruption.
Data classification - Sorting data by how sensitive it is - for example public, internal or confidential.
Defence in depth - Stacking several independent layers of protection so that when one fails, the next one still stops the attacker.
Denial of service (DoS/DDoS) - An attack that floods a website or service with so much traffic that real users can no longer reach it.
Exploit - A piece of code or a set of steps that turns a known weakness in a system into actual access or control for an attacker.
Governance - How leadership steers security - setting direction, handing out responsibility and checking that it works.
Human error - An honest mistake by a person - a wrong click, a lost laptop, a file sent to the wrong address - that harms security.
Human factor - How people's habits, stress, trust and attention shape security - a common way in for attackers, but also a line of defence.
Impact - How much harm an event would do to the business if it actually happened - in money, time, trust or safety.
Insider threat - Harm that comes from someone already trusted inside the organisation, whether they mean to do damage or simply make a mistake.
Integrity - Making sure information stays correct and complete, and is not changed by accident or without permission.
IT operations - The team and daily work that keep an organisation's computers, systems and networks running.
Lateral movement - What an attacker does after getting a first foothold - spreading from machine to machine inside the network.
Legacy system - An old system the business still depends on but that can no longer be updated, replaced or protected in the normal way.
Likelihood - How probable it is that a given threat will actually use a weakness and cause harm within a certain period.
Malware - Harmful software that sneaks onto a computer or phone to steal, spy, damage or take control.
Man-in-the-middle attack - An attacker secretly placed between two parties who reads or changes their messages while each believes they talk directly.
Non-repudiation - Proof of who did something that is strong enough that they cannot later deny having done it.
Perimeter security - Guarding the edge between an organisation's own network and the outside world, and trusting what is already inside.
Physical security - Protecting buildings, rooms and equipment so that nobody can simply walk in, take, break or plug into them.
Privilege escalation - An attacker who has a small foothold gaining more rights than they were given, up to full control of the system.
Risk - How likely it is that a threat uses a vulnerability, combined with how bad the damage would be.
Security by design - Thinking security into systems and processes from the very start, instead of adding it at the end.
Security control - A measure that lowers risk - technical, like a lock on a system, or organisational, like a rule or training.
Security incident - An event that has harmed, or may soon harm, the confidentiality, integrity or availability of information or systems.
Security policy - A document that sets out an organisation's goals, responsibilities and principles for information security.
Session hijacking - Taking over someone's session after they have logged in, so the attacker is treated as that user without knowing the password.
Supply chain attack - Breaking into many targets at once by first taking over a supplier, product or update they all trust.
Threat - Anything that could harm the organisation - an attacker, a careless mistake, a fire or a power cut.
Threat actor - The person or group behind an attack, such as a criminal gang, a foreign state, an activist or a careless insider.
Vulnerability - A weakness that a threat can use to cause harm.
Zero-day vulnerability - A flaw that attackers know about before the maker does, so on the day it is used there is no fix to install.

People, culture & awareness · 17

Awareness maturity - A measure of how far an organisation has come in making security part of how its people think and act.
Awareness officer - The person responsible for teaching staff to spot and avoid attacks, and for measuring whether their habits actually change.
Awareness programme - A planned, ongoing effort to change how staff behave around security - with target groups, messages, methods and measurable goals.
Business email compromise (CEO fraud) - A scam where criminals pose as a boss or supplier by email to trick staff into paying money or sending data.
Human firewall - A workforce that acts as the first line of defence by spotting and stopping attacks aimed at people.
Nudging - Small, gentle prompts that make the safe choice the easy one, without forbidding anything.
Phishing - Fake emails or messages sent in bulk to trick people into handing over information or clicking something harmful.
Phishing simulation - Sending staff harmless fake phishing mails to see who clicks and to teach them to spot the real thing.
Pretexting - Inventing a believable cover story and role, such as a new colleague or an auditor, to get someone to share information.
Ransomware - Harmful software that locks an organisation's data and demands payment to unlock it.
Security awareness - What staff know about security and how they act on it in daily work.
Security culture - The shared habits and attitudes toward security that shape how people act when nobody is checking.
Shadow IT - Apps and tools staff use for work without the IT department knowing about or approving them.
Smishing - Phishing sent as a text message, usually a short, urgent note with a link or a number to call.
Social engineering - Manipulating people into giving away information or access, instead of breaking into systems directly.
Spear phishing - A phishing message tailored to one person or team, made to look like it comes from someone they know.
Vishing - Tricking people over the phone or a voice call into giving away information, codes or money.

Incidents & continuity · 12

Business continuity plan (BCP) - A plan for keeping the most important work going during and after a crisis, even while the systems are down.
Communication plan - A plan for who tells what to whom during a crisis - staff, customers, authorities and the press.
Contingency plan - A written, approved plan for how the organisation reacts when something goes wrong - who does what, and in which order.
Crisis management - How top management leads the whole organisation through a serious event - decisions, priorities, staff, customers and press.
Data breach - An event where private information is seen, taken, changed or lost by people who should not have it.
Disaster recovery plan (DRP) - A technical plan for bringing data and systems back after a breakdown or attack, in a set order and time.
Escalation procedure - Agreed rules for when a problem must be passed up to someone more senior or more expert, and to whom.
Incident reporting - Telling the right people and authorities about a serious security event, quickly and within set deadlines.
Incident response - The organised way a company spots, stops and cleans up after a security attack or accident, then gets back to normal.
Lessons learned - Looking back after an incident or exercise to see what worked, what failed and what to change next time.
Recovery objectives (RTO/RPO) - Two agreed limits for a failure - how long a system may be down (RTO) and how much recent data may be lost (RPO).
Table-top exercise - A practice session around a table where a team talks through a made-up crisis step by step to test its plans.

Risk management · 20

Business impact analysis (BIA) - A study of what an outage or incident would do to the business, and how long each activity can be down.
Critical assets - The systems, processes or data the business cannot run without, and so must protect first.
CVE and CVSS - A public ID number for each known weakness in software (CVE), plus a 0-10 score for how serious it is (CVSS).
Qualitative risk analysis - Rating risks with words or simple scales, such as low, medium and high, based on judgement rather than exact figures.
Quantitative risk analysis - Putting numbers on risks - how often a loss may happen and how much it would cost - to compare them in money.
Residual risk - The risk still left after controls are in place, because no protection removes danger completely.
Risk acceptance - A deliberate, recorded decision to live with a risk instead of spending more to reduce it.
Risk appetite - How much risk leadership is willing to live with to reach the company's goals.
Risk assessment - Working out what could go wrong, how likely it is and how much harm it would do, so the biggest risks get handled first.
Risk avoidance - Removing a risk entirely by not doing, or no longer doing, the activity that creates it.
Risk heat map - A colour-coded grid that places each risk by how likely and how harmful it is, so the worst stand out in red.
Risk identification - The first step of a risk assessment - finding and writing down what could go wrong, to what, and why.
Risk management - The ongoing work of finding, weighing and handling risks so that time and money go where they protect the most.
Risk mitigation - Lowering a risk by adding controls that make it less likely to happen or less harmful if it does.
Risk monitoring - Keeping an eye on known risks over time, so changes are caught and decisions are revisited before they go stale.
Risk profile - The overall picture of which dangers an organisation faces and how serious they are, given its size, sector, data and systems.
Risk transfer - Moving the financial cost of a risk to another party, usually through insurance or a contract with a supplier.
Risk treatment - Choosing what to do about each risk - accept it, reduce it, share it with someone else, or avoid it altogether.
Threat intelligence - Up-to-date knowledge about current attackers and their methods, gathered so attacks can be stopped before they land.
Threat landscape - A picture of the kinds of threats a company could face right now, and who or what is behind them.