Glossary

Business email compromise: a fraud in which someone poses as a trusted person by email to redirect a payment.

A signature added to each email that proves it was sent by your domain and not changed on the way.

A published rule telling mail servers what to do with email that fails your domain’s checks.

A list, published in your domain’s records, of the servers allowed to send email for your domain.

A work address and a password used with it appear in a breach database someone else can read.

The industry term for watching criminal marketplaces, forums and paste sites for a person’s or firm’s details.

A company that collects and resells personal details such as home addresses, phone numbers and relatives.

Audio, images or video generated by software to imitate a real person.

External attack surface management: finding and re-checking everything a firm exposes to the internet, from outside.

An outside adviser, such as an accountant, lawyer or broker, whose email and systems handle a client’s information or payments.

A domain one character off yours, registered by someone else.

A public sign that someone is preparing a payment fraud against a firm, seen before any money moves.

Tracing a hostile website, account or campaign back to the person or group running it.

A documented record of who collected a piece of digital evidence, when and how, and everyone who handled it after.

A firm’s accountant, lawyer or broker sends mail from a domain with no DMARC policy, so email in that adviser’s name can be forged to ask the firm for a payment.

Employee or contractor GitHub accounts host public repositories containing plaintext API keys, cloud credentials, or database connection strings for the corporate tenant.

A CMS or application admin login page (WordPress, Django, phpMyAdmin, GitLab, custom SaaS) is reachable from any IP without authentication gating, IP allowlisting, or VPN.

Employee credentials appearing in monitored breach databases are still active on the corporate SSO or VPN, giving attackers a direct password-spray path.

A former employee's corporate SSO, individual SaaS accounts, or personal-device-linked corporate app access remains active after their departure date.

A domain's outbound mail is not cryptographically signed, so receivers cannot verify integrity or authenticity beyond IP-based SPF.

Public paste-site archives contain executive email addresses paired with breached passwords, providing an off-the-shelf target list for BEC.

A production web server exposes its `.git/` directory over HTTP, allowing anyone to reconstruct the full source tree, including secrets committed to history.

A recently-registered domain uses a visual or typographical variation of the corporate name (typo-squat, IDN homograph, tenant-suffix squat) and is likely being staged for wire-fraud pretext.

A production-facing TLS certificate is within the browser warning window and shows no evidence of ACME/auto-renewal, risking a hard outage and browser trust warnings.

A production or backup S3 bucket is configured to allow anonymous LIST operations, exposing the object inventory (and often the object contents) to any unauthenticated caller.

A domain publishes an SPF record but no DMARC policy, leaving receivers with no instruction on how to handle unauthenticated mail.

A DNS CNAME record points to a third-party service (Heroku, S3, GitHub Pages, Zendesk, etc.) that no longer claims the subdomain, allowing anyone to register it and impersonate the parent domain.

A marketing, analytics, or engagement vendor that once had customer or employee data access remains contracted (paying) or connected (integration live), despite no active use, extending the exposure surface.