Frequently asked questions

Backup (3-2-1)

Recoverable copies of your data, kept where ransomware can't reach.

A backup is a recoverable copy of your data, and the 3-2-1 rule is the durable standard: keep three copies, on two different media, with one off-site (or offline/immutable). The off-site, offline copy is what survives a ransomware attack that encrypts everything it can reach over the network. A backup you have never restored from is a hope, not a plan — test restores regularly.

See also: ransomware, rto-rpo

BEC

Email fraud impersonating an executive or vendor to steal money.

Business Email Compromise (BEC) is a scam where an attacker poses as a trusted executive, supplier, or partner — sometimes from a genuinely hijacked mailbox — to redirect a payment or payroll. The FBI consistently ranks it among the costliest categories of cybercrime by dollar loss because it relies on plausible requests and human trust rather than malware. Strong email authentication plus a call-back verification policy for payment changes are the core defences.

See also: phishing, spear-phishing, dmarc

BIMI

Shows your verified logo next to your name in inboxes.

BIMI (Brand Indicators for Message Identification) lets your verified brand logo appear alongside your sender name in supporting email clients (Gmail, Yahoo, Apple Mail). It requires DMARC at p=quarantine or stronger plus, for most providers, a VMC certificate from a Mark Verifying Authority. Higher trust and open rates.

See also: dmarc, vmc

CAA record

DNS record naming which CAs may issue certs for your domain.

A CAA (Certification Authority Authorization) record is a DNS entry listing exactly which certificate authorities are allowed to issue TLS certificates for your domain. With it in place, a CA that is not on your list will refuse to issue — which blocks an attacker who tricks some other CA into minting a cert for your name. Cheap, fast, and high-value.

See also: tls, dnssec

Clickjacking

Hiding your site in an invisible frame to hijack clicks.

Clickjacking loads your real site inside a transparent iframe on an attacker page, positioned so a victim who thinks they are clicking a harmless button actually clicks something on your site — approving a payment, changing a setting. The defence is telling browsers your pages may not be framed by others, via a Content-Security-Policy frame-ancestors directive (or the older X-Frame-Options header).

See also: security-headers, csp

CMMC

DoD cybersecurity standard for defense-industrial-base companies.

Cybersecurity Maturity Model Certification — the US Department of Defense's standard for any company handling controlled unclassified information. Three levels: L1 (basic safeguards, 17 controls), L2 (NIST 800-171 alignment, 110 controls), L3 (advanced, 134 controls). Required to win new DoD contracts.

See also: soc-2, csf

CORS

Browser rules for which sites may read another site's responses.

CORS (Cross-Origin Resource Sharing) is the browser mechanism that decides whether JavaScript on one origin may read the response from a request to a different origin. Misconfigured CORS — reflecting any Origin while also allowing credentials, or returning Access-Control-Allow-Origin: null — can hand attacker sites the ability to read authenticated data. Tighten it to an explicit allowlist.

See also: csp, samesite-cookie

CSP

Header that controls what a page is allowed to load and run.

A Content-Security-Policy is a response header that whitelists where a page may load scripts, styles, images, and frames from — and, critically, whether inline scripts may run at all. A well-built CSP is the single most effective defence against cross-site scripting (XSS): even if an attacker injects a <script> tag, the browser refuses to execute it. The hard part is enumerating your real sources.

See also: xss, security-headers, cors

CSRF

Tricking a logged-in user's browser into a state-changing request.

Cross-Site Request Forgery (CSRF) abuses the fact that a browser automatically attaches your cookies to any request to a site you are logged into. A malicious page can therefore make your browser POST to your bank or admin panel in the background. The standard defences are anti-CSRF tokens and SameSite cookies that stop the cookie riding along on cross-site requests.

See also: xss, samesite-cookie

CVE

A public catalog ID for one specific known vulnerability.

A CVE (Common Vulnerabilities and Exposures) identifier — like CVE-2021-44228 (Log4Shell) — is the industry-standard unique reference for a single publicly disclosed security flaw. Vendors, scanners, and threat feeds all key off CVE IDs so everyone is talking about the same bug. When a CVE is being actively exploited it usually lands on CISA's Known Exploited Vulnerabilities list, your cue to patch now.

See also: cvss, zero-day, patch-management

CVSS

A 0–10 score rating how severe a vulnerability is.

CVSS (Common Vulnerability Scoring System) expresses the severity of a vulnerability as a number from 0.0 to 10.0, derived from factors like how easily it can be exploited and how much damage it enables. It is a useful triage signal — 9.0+ is critical — but it is not the whole story: a medium-scored bug that is being actively exploited against your exact stack outranks a critical one that isn't. Pair the score with real-world exploitation data.

See also: cve

DKIM

Cryptographic signature proving an email wasn't tampered with.

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outbound mail that receiving servers verify against a public key in your DNS. It proves the message came from your domain AND wasn't modified in transit. Required for any modern email-deliverability posture.

See also: dmarc, spf

DMARC

Tells mailbox providers what to do with mail that fails authentication.

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells Gmail, Outlook, and Yahoo what to do when an email claiming to be from your domain fails SPF or DKIM checks: do nothing (p=none), quarantine to spam (p=quarantine), or reject outright (p=reject). Without DMARC anyone can spoof your domain. The end goal for most orgs is p=reject.

See also: spf, dkim, bimi

DNSSEC

Signs your DNS records so they can't be forged in transit.

DNSSEC (Domain Name System Security Extensions) cryptographically signs your DNS records so a resolver can prove an answer really came from you and wasn't swapped out by an attacker (DNS spoofing / cache poisoning). You enable it at your DNS provider and add a matching DS record at your domain registrar.

See also: tls, caa

Encryption at rest / in transit

Scrambling data on disk and on the wire so theft yields gibberish.

Encryption converts data into a form unreadable without a key. "In transit" protects data moving across networks (that's TLS); "at rest" protects data sitting on disks, databases, and backups so a stolen drive or breached storage bucket yields ciphertext, not records. Most compliance frameworks expect both, and most cloud providers offer at-rest encryption by default — the work is verifying it's on and that keys are managed sensibly.

See also: tls, ssl

Finding

A specific gap or risk we detected and need to track to closure.

A finding is a single, actionable item — "DMARC is p=none on acme.com", "3 admins don't have MFA enabled", "TLS cert for portal.acme.com expires in 14 days". Findings are scored by severity (critical/high/medium/low), have an SLA, an owner, and a status (open/in-progress/resolved/won't-fix). The findings board is your operational queue.

See also: sla, vulnerability-scanning

GDPR

EU law governing how personal data is collected and used.

The GDPR (General Data Protection Regulation) is the European Union's comprehensive privacy law. It applies to any organisation handling the personal data of people in the EU — regardless of where the company is based — and grants individuals rights to access, correct, and delete their data. Penalties reach into the tens of millions of euros, so even small US firms with EU customers need a lawful basis for processing and a way to honour data-subject requests.

See also: pii, soc-2

HSTS

Header that forces browsers to use HTTPS for your site.

HSTS (HTTP Strict Transport Security) is a response header that tells browsers to only ever connect to your site over HTTPS, even if a user types http:// or clicks an old link. It closes the small window where a first plaintext request could be hijacked and downgraded. Sites can also join the browser preload list so the rule is baked in before the first visit.

See also: tls, csp

Least privilege

Give each account only the access it actually needs.

Least privilege is the principle that every user, service, and token should hold the minimum permissions required to do its job — and nothing more. It limits the blast radius when any single account is compromised: a marketing login that can't touch billing can't be used to drain it. In practice it means scoping integration tokens read-only, avoiding standing admin rights, and reviewing access regularly.

See also: sso, finding

MFA

Second factor (code, key, or biometric) on top of a password.

Multi-Factor Authentication requires something beyond a password — a TOTP code from an authenticator app, a hardware key (YubiKey), or a passkey (Touch ID / Windows Hello). Reduces account-takeover risk by ~99%. Every Resolute account should have MFA enrolled; admins enforce it across the org from Settings.

See also: totp, passkey, phishing-resistant-mfa

MTA-STS

Forces TLS encryption for incoming mail to your domain.

MTA-STS (Mail Transfer Agent Strict Transport Security) is a policy published via DNS + HTTPS that tells sending servers they MUST use TLS when delivering mail to your domain. Without it, mail can be silently delivered in cleartext. Pairs naturally with DMARC + DKIM.

See also: tls-rpt, tls

NIST CSF

Cybersecurity framework: Govern · Identify · Protect · Detect · Respond · Recover.

NIST Cybersecurity Framework 2.0 is a US-government framework that organizes security controls into six functions: Govern, Identify, Protect, Detect, Respond, Recover. Less prescriptive than CMMC or SOC 2 — used as an org-wide maturity roadmap rather than a pass/fail audit. Free to adopt.

See also: cmmc, soc-2

Passkey

Phishing-resistant credential bound to your device (Touch ID, etc.).

Passkeys (built on WebAuthn) replace passwords with a credential stored on your device and unlocked with biometrics or a PIN. Phishing-resistant because the credential is bound to the site's origin — a fake site can't trigger the prompt. Synced via iCloud Keychain, Google Password Manager, or 1Password.

See also: mfa, totp, phishing-resistant-mfa

Patch management

Keeping software current so known holes get closed.

Patch management is the routine of tracking, testing, and applying software and firmware updates so that publicly known vulnerabilities don't sit open on your systems. The overwhelming majority of breaches exploit bugs that had a fix available — sometimes for years. For an SMB the win is mostly process: enable automatic updates where safe, and have a defined window to apply the rest, prioritising internet-facing systems.

See also: cve, zero-day, vulnerability-scanning

PCI DSS

Card-industry security standard for anyone handling card data.

PCI DSS (Payment Card Industry Data Security Standard) is the security standard every business that stores, processes, or transmits payment-card data must meet, enforced by the card brands through your acquiring bank. The strongest move for most SMBs is to shrink scope — use a hosted/tokenised payment provider so raw card numbers never touch your systems — which collapses the assessment from hundreds of requirements to a short self-questionnaire.

See also: soc-2, encryption

Phishing

Fraudulent messages that trick people into handing over access.

Phishing is the use of deceptive email, text, or chat messages to trick a person into revealing credentials, approving an MFA prompt, or wiring money. It remains the most common entry point for breaches at small and mid-sized businesses because it targets people, not software. Defences layer technical controls (DMARC, link filtering, phishing-resistant MFA) with regular awareness training.

See also: spear-phishing, bec, phishing-resistant-mfa

Phishing-resistant MFA

MFA that can't be relayed by a fake login page.

Phishing-resistant MFA means second factors that an attacker cannot capture and replay through a lookalike site — principally passkeys/FIDO2 security keys, where the credential is cryptographically bound to the real site's origin. It is the bar that CISA and cyber-insurers increasingly ask for, because push-prompt and one-time-code MFA can still be defeated by real-time phishing proxies and MFA-fatigue spam.

See also: passkey, mfa, phishing

PII

Data that identifies a specific person.

PII (Personally Identifiable Information) is any data that can identify an individual — name, email, address, government ID, and so on. It is the category most privacy laws (GDPR, CCPA, and the growing list of US state laws) regulate, and the category whose breach triggers notification duties and fines. Knowing where your PII lives is the prerequisite for protecting it and for honouring data-subject requests.

See also: gdpr, encryption

Ransomware

Malware that encrypts your data and demands payment to release it.

Ransomware is malware that encrypts an organisation's files — and increasingly steals a copy first — then demands payment for the decryption key and a promise not to leak the data. For an SMB it is often an extinction-level event. The controls that matter most are tested offline backups, phishing-resistant MFA on remote access, prompt patching of internet-facing systems, and network segmentation to slow lateral movement.

See also: phishing, backup, patch-management

RTO / RPO

How fast you must recover, and how much data you can lose.

RTO (Recovery Time Objective) is the maximum acceptable time to get a system back online after an incident; RPO (Recovery Point Objective) is the maximum acceptable amount of data, measured in time, you can afford to lose. Together they turn "we have backups" into a testable target — an RPO of one hour means hourly backups, an RTO of four hours shapes how you architect recovery. Continuity and DR plans are written against these numbers.

See also: backup

SameSite cookie

Cookie flag limiting when cookies ride cross-site requests.

SameSite is a cookie attribute (Strict, Lax, or None) that controls whether a cookie is sent on requests originating from other sites. Setting it to Lax or Strict is a strong, low-effort defence against CSRF because the session cookie simply isn't attached when the request comes from an attacker's page. SameSite=None requires the Secure flag and is only for genuine cross-site use.

See also: csrf, cors

Security headers

HTTP response headers that tell browsers how to defend your site.

Security headers are a handful of HTTP response headers — Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy — that instruct the browser to enforce protections against XSS, clickjacking, MIME-sniffing, and information leakage. They cost nothing to add and an assessor checks them first because they are a quick read on how seriously a team takes web hygiene.

See also: csp, hsts, clickjacking

SLA

Time you've committed to fix a finding based on its severity.

Service-Level Agreement — in Resolute, the maximum time we expect you to take to remediate a finding before flagging it as overdue. Defaults: critical 7 days, high 30 days, medium 90 days, low 180 days. Customizable per org. Findings approaching SLA breach get highlighted on the dashboard so they don't get missed.

See also: finding

SOC 2

Audit report customers ask for to prove you handle their data safely.

SOC 2 (Service Organization Control 2) is an AICPA framework with five Trust Service Criteria — Security (mandatory), Availability, Confidentiality, Processing Integrity, Privacy. Type I is a point-in-time snapshot; Type II covers a 6-12 month period. Required by most B2B prospects above ~50 employees.

See also: cmmc, csf, trust-page

Spear phishing

A phishing attack tailored to one specific person.

Spear phishing is targeted phishing: instead of a generic blast, the attacker researches a specific individual — their role, their vendors, their boss's name — and crafts a message that fits perfectly into their workday. Because it is personalised, it slips past both filters and gut instinct far more often than bulk spam, which is why it features in most high-value account-takeover and wire-fraud cases.

See also: phishing, bec

SPF

Lists which servers are allowed to send mail from your domain.

SPF (Sender Policy Framework) is a DNS TXT record naming the mail servers and providers (Google, Microsoft, Mailchimp, etc.) authorized to send mail using your domain. Receiving servers check it before delivery. A misconfigured SPF causes legitimate mail to land in spam.

See also: dmarc, dkim

SSL

The deprecated predecessor to TLS — the term still sticks around.

SSL (Secure Sockets Layer) is the original web-encryption protocol. Every version of SSL is now broken and disabled in modern browsers; what people still call an "SSL certificate" is really a TLS certificate. We keep the word because hosting panels and certificate authorities never updated their menus. If someone says SSL today, they mean TLS.

See also: tls

SSO

One login that grants access to many connected apps.

Single Sign-On (SSO) lets staff authenticate once with a central identity provider (Microsoft Entra, Google, Okta) and then reach every connected app without separate passwords. It shrinks the password sprawl attackers love, centralises MFA enforcement, and — crucially for offboarding — means disabling one account cuts access everywhere at once.

See also: mfa, least-privilege

TLS

Encryption that protects data in transit between browsers and servers.

TLS (Transport Layer Security) is the encryption behind the padlock in your browser — it scrambles traffic between a visitor and your site so it can't be read or tampered with on the way. Older versions (TLS 1.0/1.1) have known weaknesses; modern sites should require TLS 1.2 or 1.3. The successor to SSL.

See also: dnssec, hsts, ssl

TLS-RPT

Asks sending servers to report TLS-delivery failures to you.

TLS-RPT (SMTP TLS Reporting) is a small DNS record asking sending mail servers to email you (usually a dedicated address like [email protected]) when they fail to deliver via TLS. Useful diagnostic signal that pairs with MTA-STS.

See also: mta-sts

TOTP

Time-based one-time password from an authenticator app.

TOTP (Time-based One-Time Password) is the 6-digit code that rotates every 30 seconds in Authy, Google Authenticator, 1Password, etc. Open standard (RFC 6238). Stronger than SMS codes; not as phishing-resistant as a passkey.

See also: mfa, passkey

Trust page

Public page where prospects self-serve your security artifacts.

A trust page (popularized by Vanta and Drata) is a public URL like /trust/yourcompany where prospects, customers, and auditors can see your security posture, request your SOC 2 report, download policies, and read your sub-processor list. Replaces the email-back-and-forth most pre-sale security reviews currently are.

See also: soc-2

Verified domain

A domain you've proven you own by adding a DNS TXT record.

Resolute won't let you phishing-simulate or monitor a domain unless you've proven you own it. Verification is a one-time DNS TXT record (or auto-add via GoDaddy/Cloudflare if you've connected the integration). Subdomains inherit verification — verifying acme.com covers mail.acme.com automatically.

See also: dmarc

VMC

Certificate that lets your trademarked logo appear via BIMI.

A VMC (Verified Mark Certificate) is a certificate issued by an approved BIMI Mark Verifying Authority — currently CAs such as DigiCert, GlobalSign, and SSL.com — attesting that you own the trademark on the logo you want to display via BIMI. Most major mailbox providers require a valid VMC before they will render your BIMI logo. It is the email equivalent of an extended-validation badge for your brand mark.

See also: bimi, dmarc

Vulnerability scanning

Automated checks that surface known weaknesses in your systems.

Vulnerability scanning runs automated tooling against your systems, networks, and applications to find known weaknesses — missing patches, weak configurations, exposed services — and reports them ranked by severity. It is the routine health check behind a good remediation queue and a near-universal requirement in compliance frameworks. Scanning finds the issues; your patch and remediation process closes them.

See also: cve, cvss, patch-management, finding

XSS

Injecting attacker script into a page other users will load.

Cross-Site Scripting (XSS) is a flaw where an application reflects untrusted input back into a page without escaping it, so an attacker's JavaScript runs in your visitors' browsers — stealing sessions, rewriting the page, or keylogging. The fixes are output-encoding everything you render and deploying a strict Content-Security-Policy as a backstop.

See also: csp, csrf

Zero-day

A vulnerability exploited before a patch exists.

A zero-day is a software flaw that attackers are exploiting before the vendor has released a fix — defenders have had "zero days" to patch. They are prized by attackers and unavoidable by definition, which is why a layered defence (least privilege, segmentation, monitoring, rapid patching once a fix lands) matters more than chasing any single bug. Once a fix ships, the unpatched window is on you.

See also: cve, patch-management