Glossary

Prompt injection

An attack where text processed by a language model is interpreted as instructions, overriding the developer's intent.

Excessive agency

An AI system holding more permission, autonomy or functionality than its task requires.

High-risk AI system

An AI system placed in the EU AI Act's high-risk tier, triggering risk management, data governance, logging and human-oversight obligations.

Zero Trust

An architectural stance where no access is granted by network position; every request is authenticated, authorised and evaluated with signal.

CSPM

Continuous assessment of cloud configuration against baselines, identifying misconfiguration and exposure.

STRIDE

A threat classification mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

Shadow IT

Technology used inside an organisation without approval or visibility from IT and security.

Attack path

A chain of legitimate permissions, exposures and vulnerabilities that leads an attacker from initial access to a valuable asset.