Reference
AI & Cybersecurity Glossary
Plain-English definitions of the AI and cybersecurity terms boards, CIOs, CISOs, and event coordinators ask about most. Curated by Mark Lynd from 150+ executive tabletop exercises and 100+ keynotes.
AI Terms
- Agentic AI
- AI systems that autonomously plan and take multi-step actions across tools and systems. Where generative AI produces content on request, agentic AI executes , booking, buying, sending, deploying. Security implications scale with the agent's reach.
- AI Governance
- The framework of policies, controls, and oversight a board and C-suite use to manage AI adoption, risk, and ethics across the enterprise. Includes data handling, model selection, vendor risk, audit logging, and human-in-the-loop requirements.
- AI Red Teaming
- Adversarial testing of AI systems to surface failure modes , jailbreaks, prompt injection, data leakage, hallucination patterns, bias, and unsafe tool use. Now a board-recommended practice for any production AI deployment.
- Copilot Security
- Controls and governance for AI assistants embedded in productivity suites (Microsoft 365 Copilot, Google Gemini for Workspace, Salesforce Einstein, etc.). Focus areas: data permissions, sensitivity labels, prompt logging, and oversharing through summarization.
- Deepfake
- Synthetic audio, video, or image content generated by AI to impersonate a real person. Now a routine vector in business email compromise (BEC) and CEO fraud; tabletop exercises increasingly include a voice-deepfake inject.
- Generative AI
- AI systems that produce new text, images, audio, video, or code based on patterns learned from training data. Built on large language models (LLMs) and diffusion models.
- LLM (Large Language Model)
- A neural network trained on large text corpora that predicts and generates language. Examples: Claude, GPT-4 and successors, Gemini, Llama, Mistral.
- Prompt Injection
- An attack in which malicious instructions are embedded in content the AI reads (web pages, documents, emails) to override the system's intended behavior. Distinct from jailbreaking, which targets the user's own prompt.
- Shadow AI
- Unsanctioned employee use of AI tools , consumer LLMs and AI features embedded in SaaS , outside formal IT and security review. A board-level issue because it bypasses AI governance and can leak regulated data.
- RAG (Retrieval-Augmented Generation)
- An architecture in which an LLM retrieves relevant documents at query time and grounds its response in that retrieved context. Reduces hallucination and lets enterprises ground AI on internal knowledge.
Cybersecurity Terms
- CISO (Chief Information Security Officer)
- The executive accountable for an organization's information security strategy, program, and incident response. Increasingly reports to the CEO or board rather than the CIO.
- Cyber Insurance
- Insurance covering financial losses from cyber events (ransomware, data breach, business email compromise). Underwriting now drives security control requirements; many policies exclude losses tied to known vulnerabilities or unenforced controls.
- Incident Commander
- The named individual with authority to make operational decisions during a cyber incident, including taking production systems offline. In 89% of Mark Lynd's 150+ tabletops, three or more participants could not name the incident commander.
- Incident Response (IR)
- The structured process of detecting, containing, eradicating, and recovering from a cyber incident. Modeled after frameworks from NIST, SANS, and ISO.
- Post-Quantum Cryptography (PQC)
- Cryptographic algorithms designed to resist attacks from sufficiently powerful quantum computers. NIST has standardized the first PQC algorithms; "harvest now, decrypt later" attacks make PQC migration planning a current-day board topic.
- Ransomware
- Malware that encrypts an organization's systems and data, with attackers demanding payment for decryption keys and increasingly threatening data leak ("double extortion") or downstream attacks ("triple extortion").
- Ransomware Preparedness
- The set of plans, controls, exercises, and authorities in place before a ransomware event , tested backups, named incident commander, payment-decision threshold, insurance notification timeline, communications plan.
- SOC (Security Operations Center)
- The team and toolset that monitors, detects, investigates, and responds to security events 24/7, in-house or via managed detection and response (MDR) provider.
- Tabletop Exercise
- A discussion-based simulation in which executives and key responders work through a hypothetical incident to surface gaps in plans, authority, and decision-making before a real event. Mark Lynd has facilitated 150+.
- Zero Trust
- A security model that assumes no implicit trust based on network location and verifies every access request explicitly , user, device, posture, context. Standardized in NIST SP 800-207.
- Third-Party Risk Management (TPRM)
- The discipline of identifying, assessing, and monitoring security risk from vendors, suppliers, and partners. Now a leading source of breach. The supply chain is the perimeter.
- OWASP LLM Top 10
- The Open Worldwide Application Security Project's list of the top 10 security risks for large language model applications. The 2025 edition lists prompt injection as LLM01 (the highest-priority risk), followed by sensitive information disclosure, supply chain risks, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption.
- SEC Cybersecurity Disclosure Rules
- US SEC rules requiring public companies to disclose material cybersecurity incidents within four business days on Form 8-K Item 1.05, and to provide annual cybersecurity risk management and governance disclosures in Form 10-K. The rules have moved cybersecurity into board fiduciary territory with regulator-set timelines.
- CMMC 2.0
- The US Department of Defense's Cybersecurity Maturity Model Certification framework for the defense industrial base. Level 2 requires NIST SP 800-171 compliance for organizations handling Controlled Unclassified Information. Certification is becoming a contracting prerequisite for defense and federal contractors.
- NERC CIP
- North American Electric Reliability Corporation Critical Infrastructure Protection standards. Mandatory cybersecurity standards for organizations that own, operate, or use the bulk electric system. NERC CIP enforcement carries significant financial penalties and is the operational floor for electric utility cybersecurity.
- IEC 62443
- The international standard for cybersecurity of industrial automation and control systems (IACS). Provides the framework for securing operational technology environments in manufacturing, energy, transportation, and other industrial sectors.
- Harvest-Now-Decrypt-Later
- The threat model where adversaries collect encrypted data today with the expectation that quantum computing will eventually decrypt it. For any data with a confidentiality lifetime longer than the CRQC arrival horizon (trade secrets, contracts, government records, healthcare records, financial data), the protection in place today is already insufficient.
- CRQC (Cryptographically Relevant Quantum Computer)
- A hypothetical quantum computer capable of breaking the cryptographic algorithms that protect today's digital communications and data. The arrival timeline is debated; the threat is operational today through harvest-now-decrypt-later.
- ML-KEM (FIPS 203)
- Module-Lattice-Based Key-Encapsulation Mechanism, standardized by NIST as FIPS 203 in 2024 (derived from CRYSTALS-Kyber). The post-quantum cryptography standard most enterprise migrations will deploy first for TLS key exchange.
- ML-DSA (FIPS 204)
- Module-Lattice-Based Digital Signature Algorithm, standardized by NIST as FIPS 204 in 2024 (derived from CRYSTALS-Dilithium). The post-quantum cryptography standard for digital signatures including document signing and code signing.
- EU AI Act
- The European Union's comprehensive AI regulation that creates tiered requirements for AI systems based on risk category. High-risk AI systems carry specific obligations for transparency, human oversight, data quality, technical documentation, and conformity assessments. The Act applies extraterritorially.
- NIST AI RMF 1.0
- NIST AI Risk Management Framework, organized around four functions: Govern, Map, Measure, and Manage. The de facto AI governance standard referenced by auditors and regulators even in jurisdictions without a formal AI law. Enterprise AI governance programs typically align documentation to RMF functions for regulator-readiness.
Mark Lynd's Named Frameworks
- The 72-Hour IR Executive Playbook
- Ransomware and breach response framework built from 150-plus executive tabletop exercises. Maps every hour of the first three days to the specific executive decision that has to land in that hour, who owns it, and what the cost looks like when the decision drifts.
- The Cyber Insurance Readiness Score
- Four-dimension cyber insurance posture framework scoring Submission Readiness, Underwriting Controls, Claim Discipline, and Incident Response Coordination. Aligns the CISO, CFO, General Counsel, and broker on a single shared view of what to improve before the next renewal. Free self-assessment available.
- The Enterprise AI Trust Score
- Five-dimension AI governance scoring framework covering Data Lineage, Model Provenance, Output Governance, Identity and Access for AI Agents, and Adversarial Resilience. Designed as the self-assessment tool organizations use before regulators or auditors score them. Free self-assessment available.
- The AI Board Briefing Triangle
- Three-corner board AI communication structure covering Strategic Bets (what AI is supposed to deliver), Risk Surface (the Enterprise AI Trust Score reading), and Adoption Velocity (how fast AI is moving across the organization). One page, one decision per quarter.
- The Agentic AI Security Framework
- Five-layer security governance model for organizations deploying autonomous AI: Agent Identity and Least Privilege, Tool and API Authorization, Data Boundary Controls, Adversarial Input Defense, and Human Override and Incident Response.
Discovery & Optimization Terms
- SEO (Search Engine Optimization)
- Optimizing content and structure for ranking on classical search engines (Google, Bing). Key signals: backlinks, content quality, on-page structure, technical performance.
- AEO (Answer Engine Optimization)
- Optimizing for citation in AI-generated answers from ChatGPT Search, Perplexity, Google AI Overviews, and Bing/Copilot. Key signals: structured data (FAQ, Person, Organization), llms.txt, citation-friendly Q&A formatting, primary-source statistics.
- GEO (Generative Engine Optimization)
- Closely related to AEO; emphasizes content that generative AI engines retrieve and ground on. Both AEO and GEO favor explicit, attributable, time-stamped content.
Bring this language to your stage
Mark turns these definitions into board-ready keynotes , tailored to your industry, audience, and current threat landscape.
Request Speaker Details →