- A
- Application Security Posture Management (ASPM)
- Application security testing (AST)
- Artifact Poisoning
- Artifact Repository
- Attack surface
- Attack vector
- Automated Software Analysis
- B
- Binary Analysis
- Build Pipeline Security
- Build System Hardening
- Build System Telemetry
- C
- CBOM
- CI/CD Tampering
- CISA Guidelines for Software Supply Chains
- Code obfuscation
- Code Scanning
- Code Signing
- Code Signing Validation
- Code Trustworthiness
- Common Vulnerabilities and Exposures (CVE)
- Common Vulnerability Scoring System (CVSS)
- Container Security
- Continuous Monitoring
- Cyber Risk Assessment
- Cyber-risk mitigation
- Cybersecurity Supply Chain Risk Management (C-SCRM)
- D
- Dependency Management
- DevSecOps
- Digital forensics and incident response (DFIR)
- DLL sideloading
- Dynamic application security testing (DAST)
- F
- FedRAMP Software Supply Chain Rules
- I
- Incident Response Plan
- Indicator of compromise (IoC)
- Insider threat
- Interactive application security testing (IAST)
- K
- Keylogger
- M
- Malware
- Malware analysis
- Malware Detection in CI/CD
- N
- npm
- O
- Open Software Supply Chain Attack Reference (OSC&R)
- P
- Patch Management
- Payload
- Phishing
- Post-Compilation Scanning
- Provenance Validation
- R
- Ransomware
- Recursive Unpacking
- Remote access Trojan (RAT)
- Reverse engineering
- Rootkit
- Runtime Software Verification
- S
- SaaSBOM
- Secrets
- Secure Build Environments
- Secure Software Development Framework (SSDF)
- Security Automation
- Security operations center (SOC)
- Smishing attack
- Software Artifact Behavioral Analysis
- Software assurance
- Software Assurance Foundational Evaluation (SAFE)
- Software Bill of Materials (SBOM)
- Software Build Artifacts
- Software component verification standard (SCVS)
- Software composition analysis (SCA)
- Software Deployment Security
- Software development lifecycle (SDLC)
- Software Security Hygiene
- Software supply chain security
- Software tampering
- Software vulnerabilities
- Spyware
- SQL injection
- Static analysis
- Static application security testing (SAST)
- Supply chain integrity attacks
- Supply-chain Levels for Software Artifacts (SLSA)
- T
- Third party cyber risk management (TPCRM)
- Third-Party Software Validation
- Threat actor
- Threat hunting
- Threat intelligence
- Threat modeling
- Trojan
- Typosquatting
- X
- xBOM
- Y
- YARA Rule
- Z
- Zero-day attack