Glossary

Understand the identities, access and behaviours that shape security. Explore clear guides to the concepts, risks and everyday practices behind identity security.

Foundational knowledge. Practical context. No product walkthroughs.

Sharelock vs. the Competition

Search for a term or browse alphabetically. Select a term to read its definition.

34 terms

Access control

The rules that decide who or what can reach a resource, and what they can do with it. It is where identity becomes risk: a stolen credential is only as dangerous as its access.

Active Directory

Microsoft’s directory service for managing users, devices and permissions in Windows environments. It sits at the centre of identity in many organisations, which makes it a frequent target for privilege escalation and lateral movement.

Agentic AI

AI that pursues a goal across several steps and takes actions on its own, instead of answering one prompt at a time. In security it lets investigation and response run autonomously, within guardrails set by the team.

API key

A secret string that identifies an application when it calls an API. If it is exposed or has too many permissions, it gives access without any login, so keys need limited scope, rotation and monitoring.

Authentication and authorisation

Authentication confirms who someone is, for example with a password and MFA. Authorisation decides what they are allowed to do once authenticated. Attacks with stolen credentials pass the first and then abuse the second.

Conditional access

Policies that grant, restrict or block access based on context such as user, device, location and risk. They add a decision layer on top of authentication, but only at the moment of sign-in.

Credential stuffing

An automated attack that tries username and password pairs leaked in one breach against other services, relying on password reuse. MFA and monitoring for unusual login patterns reduce the risk.

DORA

The EU regulation on digital operational resilience for the financial sector, applied since 17 January 2025. It covers ICT risk, incident reporting, testing and third-party risk.

Entra ID (formerly Azure AD)

Microsoft’s cloud identity and access management service, formerly known as Azure Active Directory. It handles sign-in and access to cloud applications, so a compromised account there can open many doors at once.

GDPR

The EU regulation on the protection of personal data, in force since 2018. In identity security it shapes how access and activity can be monitored: proportionately and with data protection by design.

IAM

Identity and Access Management is the set of processes and tools that create, manage and govern digital identities and their access rights. It decides who can reach what, but on its own it does not watch how that access is used afterwards.

Identity-based attack

An attack in which the adversary uses legitimate identities and credentials to reach systems and data. Every step uses valid access, so there is no malware to find and the activity is hard to tell from normal work.

Identity security

Identity security is the practice of protecting digital identities, human and non-human, and the access they hold. It spans prevention, detection and response, and treats identity as the main attack surface because attackers increasingly log in rather than break in.

Insider threat

A risk from someone with legitimate access, whether malicious, negligent or compromised. Because access is already granted, behaviour is what reveals misuse.

ISPM

Identity Security Posture Management continuously finds and fixes identity weaknesses before attackers can use them, such as excessive privileges, dormant accounts and gaps in MFA. Its goal is to shrink the attack surface.

ITDR

Identity Threat Detection and Response monitors identity activity in real time to detect, investigate and respond to the compromise and misuse of identities and credentials. It focuses on behaviour, so it can spot an attacker who is using a valid account.

Just in time Access

Granting elevated access only when it is needed and for a limited time, instead of leaving privileges in place permanently. It shrinks the window an attacker can use a privileged account.

Kerberoasting

An attack on Kerberos authentication in which an attacker requests service tickets for service accounts and tries to crack them offline to recover passwords. Weak service account passwords make it much easier.

Lateral movement

Techniques an attacker uses to move from one system to another after gaining initial access, in order to reach more valuable targets. With valid accounts and legitimate tools it often looks like normal activity, so behaviour is the signal.

LDAP

The Lightweight Directory Access Protocol is a standard way to read and manage information in directory services such as Active Directory. It is widely used for authentication and lookups, and attackers can also use it to explore users and groups.

Least privilege

The principle that an identity should have only the access it needs to do its job, and no more. It is a key way to shrink the damage a stolen login can cause.

MFA

Multi-factor authentication requires two or more proofs of identity, such as a password and a code or device. It makes stolen passwords less useful, but it verifies only the moment of login, not what happens next.

NIS2

The EU Directive 2022/2555 on cybersecurity across critical sectors. It sets baseline measures, including access control and MFA, and incident reporting duties for essential and important entities.

Non-Human Identity

An identity that belongs to a machine or software rather than a person, such as a service account, API key, bot or AI agent. Often broadly privileged and rarely reviewed.

PAM

Privileged Access Management: controlling, securing and auditing accounts with elevated rights, such as administrators. It limits who can use powerful access and when.

Pass-the-Hash

A technique in which an attacker authenticates with a stolen password hash, without ever knowing the actual password. It lets them move between systems with logins that look legitimate.

Privilege Escalation

Gaining a higher level of access than an account was meant to have, for example by exploiting a misconfiguration. It is a common step in identity-based attacks.

PsExec

A legitimate Microsoft tool for running commands on remote systems. Attackers often use it for lateral movement because it is trusted and looks like routine admin work.

RBAC

Role-based access control: permissions are assigned to roles, and people receive the roles that match their job. It simplifies access management but can drift into over-broad roles.

Service Account

A non-personal account used by applications and services to access resources. Often long-lived, highly privileged and rarely watched, so it is an attractive target.

SSO

Single sign-on lets a person authenticate once and access multiple applications. It simplifies access and concentrates risk on that one login.

UEBA

User and Entity Behaviour Analytics learns what is normal for users and entities and flags deviations that may signal compromise or misuse. It is one of the techniques behind behavioural detection.

Zero Trust

A security model that never grants trust by default and verifies every access request using identity, context and risk. It relies on strong identities and continuous monitoring, not on the network perimeter.

Sharelock investigates identity alerts in 31 seconds. Autonomously

See the Autopilot in action, no slides, no pitch.

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

The leading Agentic AI Autopilot for autonomous identity threat detection and response (ITDR) and cloud entitlement protection.

© 2026 Sharelock. All rights reserved.