Glossary

This glossary collects the vocabulary of AI Red Team. Terms from the earlier volumes keep their meaning there.

A

Adversarial testing — Deliberate attempts to make a model or AI system fail, leak or misbehave; required by Article 55 of the AI Act of providers of general-purpose AI models with systemic risk. Chapter 13.

Adversary emulation — Reproducing the tactics, techniques and procedures of a specific adversary against the organisation's own systems, under rules of engagement. Chapter 12.

AI red teaming — Structured adversarial testing of AI systems, models and agents to find failures before an adversary does. Distinct from AI-enabled defence. Chapter 13.

AI-enabled defence — The use of AI in defensive security operations; one of the three focus areas of the Cyber AI Profile.

Attack path — A sequence of exploitable relationships leading an adversary from an entry point to an objective. Chapter 10.

Attacker-controlled input — Content that security AI reads and an adversary can influence, such as log fields and email bodies; a channel for prompt injection. Chapters 1, 13 and 18.

Autonomy level — The independence granted to a security AI capability in context: Level 0 Advisory to Level 4 Autonomous. A property of a capability, not of a model. Chapter 6.

B

Blast radius — The maximum scope an experiment or failure may affect. Chapter 25.

Blue team — The defenders who prevent, detect and respond to attacks. Parts V to VII.

Breach and attack simulation — Automated, repeatable execution of attack scenarios against the organisation's own controls. Chapter 12.

C

Canary — A planted object whose use has no legitimate purpose and therefore indicates compromise. See also honeytoken. Chapter 19.

Category (CSF) — A group of related outcomes within a CSF Function, such as ID.RA Risk Assessment; CSF 2.0 has 22. CSF_COVERAGE.md maps each to a chapter.

Chaos experiment — A catalogued test that injects a defined condition, with a steady-state hypothesis, rollback and blast-radius limits. Chapter 25.

Compensating control — A control that reduces risk to an acceptable level when the primary remedy, such as a patch, cannot be applied in time. Chapter 11.

Containment profile — Codified boundaries for an agent, such as credentials, egress and stop path, that hold whatever the agent intends. AI Platform and Security, Chapter 19; Chapters 4 and 13.

CSF profile — An organisation's current or target posture in CSF outcomes, kept as a versioned artefact. Chapters 3 and 26.

Cyber AI Profile — NIST's profile applying CSF 2.0 to AI (NIST IR 8596, initial preliminary draft, December 2025), with three focus areas: securing AI system components, conducting AI-enabled cyber defence and thwarting AI-enabled attacks. Chapter 3.

D

Deception — Decoys, canaries and honeytokens placed in the organisation's own environment to detect adversaries. Chapter 19.

Detection engineering — Designing, testing and maintaining detection logic as versioned code. Chapter 19.

DORA — Regulation (EU) 2022/2554; Articles 24 to 27 require resilience testing and, for identified entities, threat-led penetration testing. Chapter 7.

E

EPSS — FIRST's Exploit Prediction Scoring System, estimating the probability that a vulnerability will be exploited. Chapter 11.

EUVD — The European Vulnerability Database operated by ENISA under NIS 2. Chapter 11.

Evidence manifest — A machine-generated record tying a release or capability to the evidence that its controls work. AI Governance, Chapter 11; Chapter 26.

Experiment ledger — The tamper-evident record of every chaos experiment, sealed from the SOC during the detection window. Chapter 25.

Exposure management — Continuous prioritisation and reduction of exploitable weaknesses. Chapter 11.

F

Finding record — A versioned record of a weakness, carried through remediation to re-test evidence. Chapter 26.

Function (CSF) — One of the six top-level groupings of CSF 2.0: Govern, Identify, Protect, Detect, Respond and Recover. Parts II to VII follow them.

H

Honeytoken — A credential, key or data item planted solely so that its use reveals unauthorised access. Chapter 19.

K

KEV — The Known Exploited Vulnerabilities catalogue of the United States Cybersecurity and Infrastructure Security Agency. Chapter 11.

M

Machine identity — An identity under which an AI system acts in its own name, characteristic of Mode 5; it must be task-scoped and short-lived. Chapters 6 and 14.

MITRE ATLAS — A knowledge base of adversary techniques against AI systems. Chapters 10 and 13.

MITRE ATT&CK — A knowledge base of adversary tactics and techniques based on real-world observation. Chapters 2, 12 and 19.

MITRE D3FEND — A knowledge graph of defensive techniques. Chapter 4.

N

NIS 2 — Directive (EU) 2022/2555; Article 21 requires cybersecurity risk-management measures, including policies to assess their effectiveness. Chapters 3 and 7.

NIST Cybersecurity Framework (CSF) 2.0 — The NIST framework (NIST CSWP 29, February 2024) of six Functions and 22 Categories. Chapter 3.

P

Purple loop — The cycle in which a finding becomes a control and a detection, is re-tested and is recorded as evidence. Chapter 26.

Purple teaming — Red and blue teams working jointly so that findings become controls. Chapter 26.

R

Recoverability — The verified ability to restore a service or AI system within its recovery objectives, tested continuously. Chapter 24.

Red team — A team that emulates adversaries under authorisation and rules of engagement. Chapter 12.

Rules of engagement — The signed scope, constraints and stop conditions of an offensive exercise, kept as a versioned artefact. Chapter 7.

S

Security chaos engineering — Experimentation that injects the conditions security controls exist for and checks steady-state hypotheses. Chapter 25.

Security operations centre (SOC) — The in-house or outsourced function that monitors, triages and responds to security events. Chapter 18.

Sigma — An open, vendor-neutral format for detection rules. Chapter 19.

Steady-state hypothesis — A falsifiable, time-bound statement of what should happen when a control is challenged. Chapter 25.

Stop path — The means by which a person can halt an AI capability, placed outside the system it stops. Chapters 6 and 13.

T

Threat-led penetration testing (TLPT) — Testing under DORA Article 26 that mimics real threat actors against live systems supporting critical or important functions. Chapters 7 and 12.

TIBER-EU — The European Central Bank's framework for threat intelligence-based ethical red teaming, with preparation, testing and closure phases. Chapters 7 and 12.

U

Usage modes — The six modes defined in AI Governance and AI Platform and Security, Chapter 2: Mode 0 Ambient AI, Mode 1 Conversational assistants, Mode 2 Embedded workplace assistants, Mode 3 Agentic work tools, Mode 4 Built AI applications and Mode 5 Autonomous production agents. Chapters 1 and 6.

W

White team — The group that plans and controls an exercise and holds the rules of engagement and the stop decision. Chapters 6, 7 and 12.