Every security advisory, scanner report and patch note leans on the same small set of public systems. CVE gives a vulnerability its name. CVSS says how bad it could be. EPSS estimates how likely it is to be attacked soon. CISA’s Known Exploited Vulnerabilities catalog (KEV) says it already has been. They are run by different organizations, answer different questions, and get confused with each other constantly. Anyone who has to decide what to patch first, or who reads that a flaw is “a 9.

A working reference for the language of modern cybersecurity — organized by threat surface and defensive domain. Definitions are written for security professionals, technical managers, and informed practitioners who need precision without padding. Threat Actors and Motivation Advanced Persistent Threat (APT) A sophisticated, long-duration cyberattack campaign — typically state-sponsored — characterized by stealth, patience, and a specific high-value target. APT actors infiltrate networks and maintain persistent access for months or years before executing their objective.

In October 2017, security researcher Mathy Vanhoef published a paper describing Key Reinstallation Attacks — KRACK — against the WPA2 four-way handshake. The disclosure triggered emergency patches across every major operating system, router firmware, and WiFi chipset vendor simultaneously. It was the most significant WiFi security event between WEP’s collapse in the early 2000s and WPA3’s introduction in 2018. Understanding what KRACK was, and what it actually threatened, clarifies both the state of WPA2 security today and how the WiFi security ecosystem responds to structural vulnerabilities.