# What is…? Network and security terms (FAQ)

> Network and security terms explained in plain language, from firewall and VLAN to CVE and SOC, with what each means for your company.

Source page: https://netsenx.com/en/faq/glossary

## What is a firewall?

A firewall is a device or program that decides which network connections are allowed and blocks the rest, based on rules you set. It usually sits between your office network and the internet, and sometimes between internal segments, for example between office PCs and production machines. A rule might say: computers in the office may reach the internet on web ports, but nobody outside may reach the file server. A firewall is essential, but it only judges connections against its rules; it does not notice an intruder who uses a connection it allows. Network detection watches what happens inside those allowed connections.

https://netsenx.com/en/faq/what-is-a-firewall

## What is a router?

A router is the device that connects one network to another and passes traffic between them, most often your office network to the internet. It decides where each packet of data should go next, like a sorting office for mail. In small offices the router often also acts as a firewall, a Wi-Fi access point and the device that hands out addresses to computers. Because everything leaving your network passes through it, the router matters for security: keep its software updated, change the default administrator password, switch off remote administration from the internet and check its list of connected devices now and then.

https://netsenx.com/en/faq/what-is-a-router

## What is a network switch?

A network switch is the box with many sockets that connects the computers, printers and servers in one office to each other, sending each piece of traffic only to the device it is meant for. Unmanaged switches simply work out of the box. Managed switches can be configured: they can split the network into separate segments (VLANs) and copy traffic to a monitoring port, a feature called port mirroring or SPAN. That copy is how a network sensor sees the traffic between devices without being in the way. If you plan network monitoring, check whether your main switch is managed.

https://netsenx.com/en/faq/what-is-a-network-switch

## What is a VLAN?

A VLAN (virtual local area network) is a way to split one physical network into several separate networks using switch settings, so that devices in one VLAN cannot talk directly to devices in another. A company might put office PCs, guest Wi-Fi, card terminals and cameras in different VLANs, and only allow the connections each group needs. This limits how far an infection can spread. A VLAN is only as good as the rules between VLANs, usually set on the router or firewall, and those rules drift over time. Watching the traffic between segments shows whether the separation you planned actually holds.

https://netsenx.com/en/faq/what-is-a-vlan

## What is an IP address?

An IP address (Internet Protocol address) is the number that identifies a device on a network, so that data can be delivered to it, like a postal address for computers. Inside an office, devices usually have private addresses such as 192.168.1.20, which are not reachable from the internet directly; the router has a public address that the outside world sees. Addresses can change when a device reconnects, which is why security tools also record a device's name or hardware address. When an alert names an IP address, the first step is usually to find out which device had that address at that time.

https://netsenx.com/en/faq/what-is-an-ip-address

## What is a MAC address?

A MAC address (media access control address) is a hardware identifier built into each network interface, such as the Wi-Fi or cable socket of a laptop, written as six pairs of characters like 3C:22:FB:1A:4D:90. Devices on the same local network use it to deliver data to each other. Unlike an IP address, it does not usually change when a device reconnects, so it helps identify a device over time, although modern phones and laptops often use random MAC addresses on Wi-Fi for privacy. Network inventories use MAC addresses, together with device names, to tell devices apart.

https://netsenx.com/en/faq/what-is-a-mac-address

## What is DHCP?

DHCP (Dynamic Host Configuration Protocol) is the service that automatically gives each device an IP address and basic network settings when it connects, so nobody has to type them in by hand. In small offices the router usually runs it; larger companies run it on a server. The DHCP server keeps a list of which device received which address and when, called leases. That list is useful for security: it helps you find out which device had an address named in an alert, and it reveals devices you did not know were connected. Keep those records for as long as an investigation might need them.

https://netsenx.com/en/faq/what-is-dhcp

## What is DNS?

DNS (Domain Name System) is the internet's directory: it translates names like netsenx.com into the IP addresses computers need to connect. Every time someone opens a website or an application contacts a server, a DNS lookup usually happens first. That makes DNS useful for security: the names a device looks up show where it is trying to go, including a malware server or an unapproved AI service. Attackers also abuse DNS, for example by hiding data inside lookups, which is called DNS tunnelling. Keeping DNS on your own resolvers and keeping their logs helps investigations.

https://netsenx.com/en/faq/what-is-dns

## What is NAT (network address translation)?

NAT (network address translation) is the technique a router uses to let many devices with private addresses share one public internet address. When a PC in your office connects to a website, the router replaces the PC's private address with its own public one and remembers which reply belongs to which device. NAT is why your office devices are not directly reachable from the internet by default, which helps, but it is not a firewall: port forwarding rules can deliberately open a path inward. For investigations, NAT means outside parties only see the router's address, so your own logs must show which inside device it was.

https://netsenx.com/en/faq/what-is-nat-network-address-translation

## What is a network port?

A network port is a number that identifies which service on a device a connection is meant for, so that one computer can run a web server, an e-mail server and remote access at the same time. Common examples: port 443 for secure websites, 22 for SSH remote administration, 3389 for remote desktop and 445 for file sharing. A port is called open when a service is listening on it. Open ports exposed to the internet are a common entry point for attackers, which is why you should know which ones you have. A port scan is someone checking many ports to find open ones.

https://netsenx.com/en/faq/what-is-a-network-port

## What is a network packet?

A network packet is a small unit of data sent across a network; larger messages, files and web pages are split into many packets and reassembled at the other end. Each packet has a header, like the envelope of a letter, with the sender and recipient addresses and ports, and a body with the content itself. Encryption protects the body, but much of the header stays readable so the network can deliver it. Security tools that capture packets can read those headers and a few unencrypted protocol fields; NetSenX does this where packet capture is enabled and never decrypts the content.

https://netsenx.com/en/faq/what-is-a-network-packet

## What is a network protocol?

A network protocol is an agreed set of rules for how devices exchange data, so that equipment from different makers understands each other. Some protocols move data (TCP and UDP), some find addresses (DHCP, ARP), some translate names (DNS), some protect data (TLS) and some serve specific purposes, such as SSH for remote administration, SMB for file sharing or Modbus for industrial machines. Security tools recognise protocols to understand what a connection is doing. An unexpected protocol, such as remote-administration traffic from a printer or industrial commands from an office laptop, is often a sign worth checking.

https://netsenx.com/en/faq/what-is-a-network-protocol

## What is a subnet?

A subnet is a range of IP addresses that forms one section of a network, such as 192.168.10.0 to 192.168.10.255 for the office and another range for servers. Splitting a network into subnets, usually together with VLANs, groups devices and lets the router or firewall control traffic between groups. Administrators write subnets in a short form like 192.168.10.0/24, where the number after the slash says how big the range is. In security reports, a scan of a subnet means one device knocked on many addresses in that range, often a sign that someone is mapping the network.

https://netsenx.com/en/faq/what-is-a-subnet

## What is a LAN, and what is a WAN?

A LAN (local area network) is the network inside one building or site, connecting its computers, printers and servers. A WAN (wide area network) connects networks across distances, for example several offices of the same company or a site to the internet. Traffic inside the LAN often never passes the firewall at the internet edge, so a firewall alone does not see a compromised PC attacking the file server next to it. That internal traffic, sometimes called east-west traffic, is what network detection on a mirror port watches. Links between sites, often VPNs, deserve the same attention.

https://netsenx.com/en/faq/what-is-a-lan-and-a-wan

## What is a proxy server?

A proxy server is an intermediary that makes connections on behalf of other devices: a computer asks the proxy for a web page, and the proxy fetches it. Companies use proxies to filter websites, keep logs of web access, or cache content. Some proxies inspect encrypted traffic by decrypting and re-encrypting it, which requires installing a company certificate on every device and raises privacy questions. Attackers use proxies too, to hide where their traffic comes from. A network sensor that sees connections pile up toward one unexpected proxy or anonymising service has found something worth checking. NetSenX never decrypts traffic and does not act as a proxy.

https://netsenx.com/en/faq/what-is-a-proxy-server

## What is a network TAP?

A network TAP (test access point) is a small hardware device placed on a network cable that copies all the traffic passing through it to a monitoring port, without changing or delaying the original traffic. It does the same job as a mirror port on a managed switch, but works on any cable and does not drop packets when the switch is busy. TAPs are common where switches are unmanaged, in industrial networks, or where an auditor wants an independent copy. With NetSenX, an agent on a host connected to a TAP watches the whole segment and counts as one device.

https://netsenx.com/en/faq/what-is-a-network-tap

## What is NetFlow, or flow data?

NetFlow, and similar formats such as IPFIX and sFlow, are summaries of network connections that routers and switches can export: who talked to whom, on which ports, when, and how many bytes and packets. A flow record is like a phone bill: it lists calls, not what was said. Flow data is useful for capacity planning and for spotting unusual volumes or destinations, and it is cheaper to store than full traffic. It misses details such as DNS answers or the TLS handshake. NetSenX reads its own copy of the traffic from an agent or a mirror port rather than relying only on exported flow records.

https://netsenx.com/en/faq/what-is-netflow-and-flow-data

## What is ARP, and what is ARP spoofing?

ARP (Address Resolution Protocol) is how devices on a local network find the hardware address that belongs to an IP address, for example to deliver traffic to the router. Because ARP trusts whatever answer arrives, an attacker on the same network can send false answers and pretend to be the router or another device. This is ARP spoofing, and it lets the attacker read or alter traffic passing through, a form of man-in-the-middle attack. Managed switches have protections against it. NetSenX raises ARP spoofing alerts from the Pro plan, on segments it monitors.

https://netsenx.com/en/faq/what-is-arp-and-arp-spoofing

## What are TCP and UDP?

TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are the two main ways data travels across networks. TCP sets up a connection, numbers the packets and resends lost ones, so everything arrives complete and in order; websites, e-mail and file transfers use it. UDP just sends packets without checking, which is faster and suits voice calls, video, DNS lookups and some newer web traffic. For security tools, the difference matters: a TCP connection shows a clear start and end, while UDP traffic must be grouped by the tool. Scans and floods can use either.

https://netsenx.com/en/faq/what-is-tcp-and-udp

## What are ICMP and ping?

ICMP (Internet Control Message Protocol) carries control and error messages between devices, such as host unreachable. Ping is the simplest tool that uses it: it sends a short message to an address and waits for a reply, to check whether a device is reachable and how fast. Administrators use ping every day. Attackers use it too, to discover which addresses are alive before scanning them, and floods of ICMP messages can overload a link or a device. Many firewalls limit ICMP from the internet. NetSenX raises an alert on ICMP floods on every plan.

https://netsenx.com/en/faq/what-is-icmp-and-ping

## What is SMB, the file-sharing protocol?

SMB (Server Message Block) is the protocol most office networks use to share files and printers, for example when you open a document on a shared drive. Because it gives access to company data and is also used for remote administration, attackers rely on it heavily once inside: to copy data, to spread to other machines and, in ransomware attacks, to encrypt files on shared drives. SMB should never be reachable from the internet. Inside the network, a workstation suddenly opening SMB sessions to many servers is a classic sign of lateral movement, which NetSenX flags on every plan.

https://netsenx.com/en/faq/what-is-the-smb-file-sharing-protocol

## What is a domain controller?

A domain controller is the server that checks sign-ins and holds the central list of users, computers and permissions in many company networks, typically running Microsoft's Active Directory. When someone logs in to a company computer, the domain controller confirms who they are and what they may access. That makes it the most valuable target for an attacker: whoever controls it controls the company's accounts. Protect it with separate administrator accounts, multi-factor authentication where possible and tight network access. A workstation that suddenly talks to the domain controller in unusual ways is worth checking.

https://netsenx.com/en/faq/what-is-a-domain-controller

## What is NTP, and why does correct time matter for security?

NTP (Network Time Protocol) keeps the clocks of computers and network devices synchronised with an accurate time source. It sounds minor, but every log, alert and incident timeline depends on it. If the firewall is five minutes off, the server two hours off and a camera recorder set to the wrong year, nobody can reconstruct what happened in which order, and evidence for insurers, auditors or authorities becomes weak. Point all devices to the same reliable time source, check now and then that they agree, and record the time zone your logs use. It is one of the cheapest security measures there is.

https://netsenx.com/en/faq/what-is-ntp-and-why-does-time-matter-for-security

## What is syslog?

Syslog is a long-established standard for sending log messages from devices such as firewalls, switches, routers and servers to a central place. Instead of each device keeping its own small log that is overwritten after a few days, they all send their messages to a log server or a SIEM (security information and event management system). Central logs are harder for an attacker to delete and easier to search when you need to know what happened. Check that your important devices send syslog somewhere, that the clocks are correct, and that the storage keeps enough history for an investigation.

https://netsenx.com/en/faq/what-is-syslog

## What is SNMP?

SNMP (Simple Network Management Protocol) lets administrators monitor and sometimes configure network devices such as switches, printers and routers: their status, traffic counters and settings. It is very common and very old. Older versions protect access only with a shared word, called a community string, often left as the default public or private, which lets anyone on the network read, or even change, device settings. Use SNMP version 3 with proper credentials where possible, change defaults and restrict which hosts may query devices. SNMP traffic from an unexpected host can be a sign of someone mapping the network.

https://netsenx.com/en/faq/what-is-snmp

## What is an endpoint?

An endpoint is a device at the end of a network connection that people or programs use directly: laptops, desktop PCs, servers, phones and tablets, and sometimes printers or terminals. Endpoint security is protection installed on those devices, from antivirus to EDR (endpoint detection and response). The term matters because many security products cover endpoints only. Devices that cannot run such software, such as cameras, building controllers or industrial machines, are not covered by them, and neither is an endpoint whose protection has been switched off. Network detection watches all of them through their traffic.

https://netsenx.com/en/faq/what-is-an-endpoint

## What is a host in networking?

In networking, a host is any device with an address on the network that sends or receives traffic: a PC, a server, a printer, a phone, a camera or a virtual machine. Security tools talk about hosts rather than computers because attacks often involve devices nobody thinks of as computers. When an alert says a host is beaconing or scanning, the first job is to identify which physical or virtual device it is and who owns it. In NetSenX pricing, a device means a host running the NetSenX agent; one agent on a mirror port watches every host on that segment.

https://netsenx.com/en/faq/what-is-a-host-in-networking

## What is a DMZ in networking?

A DMZ (demilitarised zone) is a separate network segment for servers that must be reachable from the internet, such as a public web server, mail gateway or remote-access gateway, kept apart from the internal network. If one of those exposed servers is compromised, the firewall rules between the DMZ and the internal network limit what the attacker can reach next. The idea is simple: what faces the internet should not sit next to your file server. Watch traffic from the DMZ toward internal systems closely; a DMZ server starting new sessions inward is a strong sign of trouble.

https://netsenx.com/en/faq/what-is-a-dmz-in-networking

## What are egress and ingress traffic?

Ingress traffic is data coming into your network from outside; egress traffic is data leaving it. Most security effort traditionally goes into ingress, blocking attackers at the door. Egress deserves as much attention, because almost every attack must send something out: malware calling its control server, stolen data being uploaded, or staff sending company files to unapproved services. Simple egress rules, such as allowing outbound DNS only from your own resolvers, already help. NetSenX watches egress closely: beaconing to outside servers and unusual outbound data volumes raise alerts on every plan.

https://netsenx.com/en/faq/what-is-egress-and-ingress-traffic

## What are east-west and north-south traffic?

North-south traffic flows between your network and the outside world, for example from an office PC to the internet; east-west traffic flows between devices inside your network, for example from a PC to the file server. The firewall at the edge sees north-south traffic but usually not east-west. Once an attacker is inside, most of their work is east-west: scanning, logging in to other machines, copying data to a staging server. That is why internal traffic, seen from a mirror port inside the network, is where lateral movement shows up. NetSenX watches both directions on the segments it monitors.

https://netsenx.com/en/faq/what-is-east-west-and-north-south-traffic

## What are bandwidth and latency?

Bandwidth is how much data a connection can carry per second, like the width of a road; latency is how long data takes to travel, like the travel time. A video call needs moderate bandwidth and low latency; a nightly backup needs bandwidth but tolerates latency. Both matter for security in two ways. A sudden jump in outbound bandwidth from one device can mean data theft or a malware infection. And security tools placed inline in the traffic can add latency, while passive sensors on a mirror port do not, because they only receive a copy.

https://netsenx.com/en/faq/what-is-bandwidth-and-latency

## What are WPA2 and WPA3?

WPA2 and WPA3 (Wi-Fi Protected Access, versions 2 and 3) are the security standards that encrypt Wi-Fi traffic and control who may join a wireless network. WPA3 is newer and better protects against password guessing. For an office, use WPA2 or WPA3 with a strong password, or better, the enterprise mode where each person signs in with their own account, so a leaver's access can be removed without changing the password for everyone. Keep guests on a separate network that cannot reach internal devices. Old standards such as WEP and WPA should no longer be used.

https://netsenx.com/en/faq/what-is-wpa2-and-wpa3

## What is an API?

An API (application programming interface) is a defined way for one program to talk to another, for example for your accounting software to fetch bank transactions or for a ticketing system to receive security alerts. APIs are usually protected by keys or tokens that act like passwords for programs. Those keys are valuable to attackers, so store them safely, give each one only the permissions it needs, rotate them, and remove them when an integration is no longer used. NetSenX offers API access from the Pro plan, so alerts and data can flow into your own tools.

https://netsenx.com/en/faq/what-is-an-api

## What is single sign-on (SSO)?

Single sign-on (SSO) lets people log in once with one company account and then use many applications without separate passwords for each. A central identity provider checks the login, ideally with multi-factor authentication, and tells each application who the person is, often using a standard called SAML or OpenID Connect. SSO is good for security because there are fewer passwords to steal and leavers lose access everywhere at once when their account is disabled. The flip side is that the central account becomes very valuable, so protect it well. In NetSenX, SSO with SAML is available on the Enterprise plan.

https://netsenx.com/en/faq/what-is-single-sign-on-sso

## What is NAC (network access control)?

NAC (network access control) checks devices before they are allowed onto the network, for example requiring a company certificate, an up-to-date operating system or a known hardware address before a switch port or Wi-Fi network lets them in. Unknown devices can be refused or sent to a guest network. NAC reduces the risk of someone simply plugging into a wall socket, but it does not watch what admitted devices do afterwards: a compromised company laptop passes the check. Network detection complements it by watching behaviour once devices are on the network.

https://netsenx.com/en/faq/what-is-nac-network-access-control

## What is malware?

Malware is any software written to do harm on a computer or network: steal data, encrypt files for ransom, spy on users, or give an attacker remote control. Viruses, worms, trojans, ransomware and spyware are all kinds of malware. Most malware arrives through an email attachment, a malicious link, a fake download or an unpatched service exposed to the internet. Antivirus and EDR tools look for it on each computer. Once malware is running, it usually has to talk over the network, to its operator or to other machines, and that traffic is what a network sensor such as NetSenX watches for.

https://netsenx.com/en/faq/what-is-malware

## What is the difference between a virus, a worm and a trojan?

All three are malware, but they spread differently. A virus attaches itself to a file or program and spreads when someone opens or shares that file. A worm spreads by itself across the network, usually through a vulnerability, with no user action, which is why worms can infect hundreds of machines within an hour. A trojan pretends to be something useful, such as an invoice or a free tool, so the user installs it willingly; it does not copy itself, but it often opens a back door. For defenders, the worm is the loudest on the network, because it scans and connects to many machines quickly.

https://netsenx.com/en/faq/what-is-the-difference-between-a-virus-a-worm-and-a-trojan

## What is a DDoS attack?

A DDoS (Distributed Denial of Service) attack floods a website, server or internet connection with so much traffic from so many sources that real users can no longer get through. The traffic usually comes from a botnet of hijacked machines, so blocking one address does not help. Attacks are often used for extortion or to distract a security team while something else happens. Protection comes from your internet provider, your hosting provider or a dedicated DDoS mitigation service, which absorb the flood before it reaches you. A network detection tool inside your network does not stop a DDoS; it can help you see whether your own machines take part in one.

https://netsenx.com/en/faq/what-is-a-ddos-attack

## What is a brute-force attack?

A brute-force attack tries passwords one after another until one works, against an email login, a VPN, a remote desktop or an SSH server. Modern versions use lists of leaked passwords, or try one common password against many accounts (password spraying) to avoid lockouts. The defences are well known: long unique passwords, two-factor authentication, account lockout and not exposing login services to the whole internet. The login logs of the service are the definitive record. On the network, many failed connections to a login service in a short time form a visible pattern, and NetSenX looks for it on every plan, on traffic it can see.

https://netsenx.com/en/faq/what-is-a-brute-force-attack

## What is a port scan?

A port scan is a check of which network ports are open on a machine or a range of machines, to find out which services are running, such as web, file sharing or remote desktop. Administrators scan their own networks for inventory. Attackers scan to find a way in, and after they get in they scan again from the inside to find the next target. Scans from the internet hit every public address all day and are mostly noise. A scan that starts from a computer inside your network is different, and is often one of the first visible signs of an intruder. NetSenX detects scanning on every plan.

https://netsenx.com/en/faq/what-is-a-port-scan

## What is a man-in-the-middle attack?

In a man-in-the-middle attack, the attacker secretly places themselves between two parties who think they are talking directly, for example between a laptop and the router, or a user and a website. From there they can read the traffic, steal passwords or change what is sent. Common methods are fake Wi-Fi hotspots, ARP spoofing on a local network and tricks that make a device trust the wrong server. Encryption with properly checked certificates, such as HTTPS, defeats most attempts. NetSenX raises ARP spoofing alerts from the Pro plan, which covers the most common local-network form of this attack.

https://netsenx.com/en/faq/what-is-a-man-in-the-middle-attack

## What is a vulnerability in IT security?

A vulnerability is a weakness that an attacker can use to do something they should not be able to do: run their own code, read data, or get past a login. It can be a bug in software, a default password nobody changed, a misconfigured service or an old protocol left switched on. Vulnerabilities in popular products get public identifiers and severity scores, so you can check whether you are affected. Not every vulnerability matters equally: one in an internet-facing VPN gateway is far more urgent than one in a program nobody can reach. Knowing what you run, and what is exposed, is the first step.

https://netsenx.com/en/faq/what-is-a-vulnerability

## What is an exploit?

An exploit is a piece of code or a technique that takes advantage of a specific vulnerability to make a system do what the attacker wants. The vulnerability is the open window; the exploit is the person climbing through it. Once an exploit for a popular product is published, attackers often scan the whole internet for vulnerable systems within days, sometimes hours. That is why patching internet-facing systems quickly matters so much. After a successful exploit, the attacker usually starts new connections, downloads tools or moves to other machines, and that activity can be visible on the network even when the exploit itself was not.

https://netsenx.com/en/faq/what-is-an-exploit

## What is a security patch?

A security patch is an update from a software or hardware vendor that fixes a vulnerability. Patches arrive for operating systems, browsers, office software, firewalls, VPN gateways, printers and industrial devices. Installing them promptly is one of the most effective security measures there is, because most attacks use known vulnerabilities, not new ones. Patch internet-facing systems first, then everything else on a regular schedule. Some systems cannot be patched, such as old machines that control production; those need other protection, like a separate network segment and monitoring of what they talk to.

https://netsenx.com/en/faq/what-is-a-security-patch

## What is a CVE?

A CVE (Common Vulnerabilities and Exposures) is a public identifier for a known security vulnerability, written like CVE-2024-3400: the year, then a number. The list is run by the MITRE Corporation with partner organisations, and the CVE number lets vendors, security teams and tools refer to exactly the same problem. When a vendor publishes a security advisory, it lists the CVEs it fixes. When you read that a CVE is being actively exploited, check whether you run the affected product and version, and patch or apply the vendor's workaround. The European Union runs its own vulnerability database as well, operated by ENISA.

https://netsenx.com/en/faq/what-is-a-cve

## What is a CVSS score?

CVSS (Common Vulnerability Scoring System) gives a vulnerability a severity score from 0 to 10, based on things like whether it can be attacked over the network, whether a login is needed and what an attacker can do with it. Scores of 9.0 and above are labelled critical. The score is useful for sorting, but it describes the vulnerability in general, not your situation. A critical score in a system nobody can reach may matter less than a medium score on your internet-facing VPN. Combine the score with two questions: is this exposed in our network, and is it known to be exploited right now?

https://netsenx.com/en/faq/what-is-a-cvss-score

## What is a zero-day vulnerability?

A zero-day is a vulnerability that attackers know about and use before the vendor has released a fix, so defenders have had zero days to patch it. Zero-days are valuable and are mostly used in targeted attacks, though some later spread widely. Because there is no patch and often no signature yet, tools that only look for known bad things cannot see the exploit itself. What helps is what happens next: the compromised machine starts behaving differently, connecting to new places, scanning or moving data. Behaviour-based detection on the network aims at that stage, and good backups and segmentation limit the damage.

https://netsenx.com/en/faq/what-is-a-zero-day

## What are TTPs?

TTPs stands for Tactics, Techniques and Procedures: how an attacker works, rather than which file or address they use. A tactic is the goal, such as getting in, staying hidden or stealing data. A technique is a way to reach it, such as stealing passwords or moving between machines with remote tools. Procedures are the specific steps a group uses. The MITRE ATT&CK framework is the common catalogue of these techniques. TTPs matter because attackers change addresses and files easily but change their habits slowly, so detecting behaviour lasts longer than blocking a list of known bad indicators.

https://netsenx.com/en/faq/what-are-ttps

## What is threat intelligence?

Threat intelligence is information about attackers and their methods that helps you defend yourself: known malicious addresses and domains, file fingerprints, descriptions of active campaigns and which industries they target. It comes from security vendors, national CSIRTs, industry groups and public feeds. It is most useful when it is current and relevant to you; a list of a million old addresses mostly produces noise. For a small company, the practical form is usually built into the tools you already have, plus alerts from your national CSIRT about vulnerabilities being exploited. It complements, but does not replace, watching your own network.

https://netsenx.com/en/faq/what-is-threat-intelligence

## What is an attack surface?

The attack surface is everything an attacker could try to use to get in: internet-facing servers, VPN gateways, email accounts, remote access tools, cloud services, staff phones and laptops, suppliers with access, and even unused open ports. The bigger it is, the more there is to defend. Reducing it is often cheaper than defending it: switch off services nobody uses, close remote access that is open to the whole internet, remove old accounts and limit supplier access. A good first exercise is listing what you expose to the internet; the list is usually longer than people expect.

https://netsenx.com/en/faq/what-is-an-attack-surface

## What is a threat actor?

A threat actor is whoever is behind an attack: a criminal group, a state-backed team, a hacktivist, a lone individual or an insider such as an unhappy employee. The term is used because a person or group, not a piece of software, is making the decisions. Most attacks on small and mid-sized companies come from criminal groups motivated by money, usually through ransomware, extortion or invoice fraud, and they choose victims by opportunity rather than by name. Knowing which actors target your industry helps decide where to spend first, but the basic defences are the same for almost all of them.

https://netsenx.com/en/faq/what-is-a-threat-actor

## What is an APT (advanced persistent threat)?

An APT (advanced persistent threat) is a skilled, well-resourced attacker, often state-backed, who targets specific organisations and tries to stay inside for a long time without being noticed, usually for espionage or sabotage. Advanced means they use custom tools and careful methods; persistent means they keep coming back. Their targets include governments, defence, energy and their suppliers, which is how mid-sized companies end up in scope. Such attackers avoid noisy malware and use normal admin tools instead, so the signs are mostly behavioural: unusual connections between internal machines and quiet, regular contact with outside servers.

https://netsenx.com/en/faq/what-is-an-apt

## What are false positives and false negatives?

A false positive is an alert about something harmless: the tool says attack, but it was a backup job or a new piece of software. A false negative is an attack the tool missed. Every detection tool makes both kinds of mistake, and the two pull against each other: make the tool more sensitive and you get more false alarms, make it quieter and you miss more. Too many false positives are dangerous in their own way, because people stop reading alerts. When you compare tools, ask how they handle false alarms and how you mark one, rather than trusting a single accuracy number.

https://netsenx.com/en/faq/what-are-false-positives-and-false-negatives

## What is a SOC (security operations centre)?

A SOC (security operations centre) is a team, and the tools it uses, that watches an organisation's security alerts, investigates them and responds to incidents, often around the clock. Large companies run their own. Most small and mid-sized companies cannot staff one, so they either buy the service from a managed security provider or rely on one or two IT people who look at alerts during working hours. Whichever model you have, the tools should produce few alerts that a person can act on. NetSenX does not provide a SOC service; it gives your team or your provider the network alerts and their context.

https://netsenx.com/en/faq/what-is-a-soc-security-operations-centre

## What is a CSIRT or CERT?

A CSIRT (Computer Security Incident Response Team), also called a CERT, is a team that handles security incidents. Every EU country has a national CSIRT, and under the NIS2 Directive companies in scope report significant incidents to their CSIRT or competent authority: an early warning within 24 hours, a fuller notification within 72 hours and a final report within a month. National CSIRTs also publish warnings about vulnerabilities being exploited, which are worth subscribing to. Large companies sometimes have their own internal CSIRT. NetSenX tracks NIS2 reporting deadlines on every plan.

https://netsenx.com/en/faq/what-is-a-csirt-or-cert

## What is a penetration test?

A penetration test, or pentest, is an authorised attack on your systems by security specialists, to find weaknesses before real attackers do. The testers try to get in from the internet, or start from inside the network as if they were an intruder or a malicious employee, and then report what they reached and how to fix it. A pentest is a snapshot of one moment and one scope, usually a few days of work. It is worth doing once a year or after big changes. It is also a good test of your detection: ask afterwards whether your tools noticed the testers, and when.

https://netsenx.com/en/faq/what-is-a-penetration-test

## What are red teams and blue teams?

In security exercises, the red team plays the attacker and the blue team defends. A red team exercise is broader than a penetration test: it tries to reach a goal, such as reading the finance share, by any realistic means, while staying hidden, so it tests people and processes as well as technology. The blue team is whoever detects and responds, often the IT or security team. When both sides work together openly and share what worked, it is called purple teaming. NetSenX's breach and attack simulation, on the Business plan, runs safe simulated attack steps so you can check what your detection notices.

https://netsenx.com/en/faq/what-are-red-teams-and-blue-teams

## What is a vulnerability scan?

A vulnerability scan is an automated check of your systems against a database of known vulnerabilities and weak settings, such as missing patches, default passwords or outdated encryption. A scanner looks at what each machine reveals and produces a list of findings with severity scores. It is cheaper and more frequent than a penetration test, but it only finds known problems and cannot judge how they combine. Run an external scan of everything you expose to the internet regularly, and an internal one at least every few months. Expect many findings; start with those on internet-facing systems that are known to be exploited.

https://netsenx.com/en/faq/what-is-a-vulnerability-scan

## What is a honeypot in cybersecurity?

A honeypot is a decoy: a fake server, device or account set up so that no legitimate user ever needs to touch it. Because nobody should connect to it, any connection is suspicious by definition, which gives you an alert with almost no false alarms. Honeypots on the internet attract constant scanning and are mostly used for research into attacker behaviour. Inside a company network, a simple decoy file share or fake login page can catch an intruder who is exploring. Honeypots must be isolated carefully so they cannot become a way into the real network.

https://netsenx.com/en/faq/what-is-a-honeypot

## What is a sandbox in security?

A sandbox is an isolated environment where a suspicious file or link can be opened safely to see what it does, without risking real systems. Email security services often send attachments to a sandbox before delivering them: if the file tries to download more code, change system settings or contact strange servers, it is blocked. Sandboxes catch a lot, but malware authors know about them, and some malware waits, checks whether it is being watched or only activates on a real user's machine. That is why sandboxing is one layer among several, alongside endpoint protection and watching the network.

https://netsenx.com/en/faq/what-is-a-sandbox-in-security

## What are allowlists and denylists?

An allowlist lists what is permitted, and everything else is blocked. A denylist lists what is blocked, and everything else is permitted. Firewalls, email filters and application controls use both. Allowlists are stricter and safer, for example letting a production machine talk only to the three systems it needs, but they take work to maintain. Denylists are easier but only stop what is already known to be bad. These terms replace the older whitelist and blacklist. In detection, an allowlist also means marking known harmless activity, such as a backup server, so it stops causing alerts.

https://netsenx.com/en/faq/what-are-allowlists-and-denylists

## What are IDS and IPS?

An IDS (Intrusion Detection System) watches network traffic and raises an alert when it sees something that matches a known attack pattern. An IPS (Intrusion Prevention System) sits in the traffic path and can also block it. Many firewalls now include an IPS. Both mainly rely on signatures of known attacks, so they are strong against known threats and weaker against new methods or attackers using normal tools. An IPS that blocks wrongly also stops business traffic. NDR (Network Detection and Response) adds behaviour-based analysis. NetSenX is an NDR: it watches and alerts, and does not sit inline or block traffic itself.

https://netsenx.com/en/faq/what-are-ids-and-ips

## What is SOAR?

SOAR (Security Orchestration, Automation and Response) is software that connects security tools and automates the routine steps of handling an alert: collecting context, opening a ticket, isolating a laptop, blocking an address, informing the right person. It is built around playbooks, written sequences of steps for each kind of incident. SOAR is valuable for teams that handle many alerts a day, and needs work to set up and maintain. Small teams often get most of the benefit from simpler connections. NetSenX sends alerts to Slack or a webhook from the Pro plan, and exports to a SIEM from the Business plan.

https://netsenx.com/en/faq/what-is-soar

## What is DLP (data loss prevention)?

DLP (Data Loss Prevention) tools try to stop sensitive data, such as customer lists, card numbers or designs, from leaving the company in the wrong way: emailed out, uploaded to a personal cloud or copied to a USB stick. They work by recognising content and applying rules, and they need careful setup to avoid blocking normal work. NetSenX is not a DLP tool and does not read the content of your traffic. What it does, on every plan, is flag unusual outbound transfers, such as a machine suddenly sending far more data to an outside address than it normally does, which is often the visible sign of theft.

https://netsenx.com/en/faq/what-is-dlp-data-loss-prevention

## What is an audit log?

An audit log is a record of who did what and when: who logged in, who changed a setting, who exported a report, who closed an alert. A good audit log cannot be edited quietly afterwards, and it keeps entries long enough to be useful in an investigation. Auditors and regulators ask for audit logs because they show that controls are actually followed, not just written down. After an incident, the audit log is how you reconstruct events. NetSenX keeps an audit log of actions in your account on every plan, and adds a tamper-evident proof trail for alerts from the Starter plan.

https://netsenx.com/en/faq/what-is-an-audit-log

## What is dwell time in cybersecurity?

Dwell time is how long an attacker stays inside a network before being discovered. Mandiant's M-Trends 2026 report puts the global median at 14 days, for incidents it investigated in 2025, and many intrusions last far longer. The longer the dwell time, the more the attacker can learn, steal and prepare, which is why ransomware groups often spend days mapping a network before encrypting it. Dwell time drops when someone watches the inside of the network, not only the edge. Detecting the early steps, such as internal scanning, regular check-ins to an outside server or unusual connections between machines, is what shortens it.

https://netsenx.com/en/faq/what-is-dwell-time

## What are MTTD and MTTR?

MTTD (Mean Time to Detect) is the average time between an attack starting and someone noticing it. MTTR (Mean Time to Respond, sometimes to Recover) is the average time from noticing to containing or fixing it. Both are used to measure how well a security programme works, and both should go down over time. For a small company, honest rough numbers are more useful than precise ones: when did we last find something, how did we find it, and how long did it take to act? If the answer is that someone outside the company told you, detection is the gap to fix first.

https://netsenx.com/en/faq/what-are-mttd-and-mttr

## What is shadow IT?

Shadow IT is any software, cloud service or device that staff use for work without IT knowing or approving it: a personal file-sharing account, a free project tool, a private router in the warehouse, a browser extension. It usually starts with good intentions, because people want to get work done. The risk is that company data ends up in places nobody secures, backs up or can delete when someone leaves. Banning everything rarely works. A better approach is to find out what is used, offer approved alternatives and set a simple rule. NetSenX shows the devices it sees on your network and flags AI service use from the Pro plan.

https://netsenx.com/en/faq/what-is-shadow-it

## What is a data breach?

A data breach is any security incident in which data is lost, stolen, destroyed, changed or seen by someone who should not see it. It does not need a hacker: an email with customer data sent to the wrong address is a breach too. Under GDPR, a breach involving personal data must be reported to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to cause risk to people, and affected people must be told when the risk is high. IBM's Cost of a Data Breach 2025 report puts the average global cost at USD 4.44 million.

https://netsenx.com/en/faq/what-is-a-data-breach

FAQ: https://netsenx.com/en/faq