Security Glossary

IoT & OT Security Glossary

Authoritative definitions for IoT, OT, IoMT, and connected asset security, the terminology every security team needs to know. 103 terms, A–Z.

A

ACL (Access Control List)

Rule sets defining permitted or denied traffic between network devices and segments. ORDR generates ACLs automatically based on observed device behavior and enforced segmentation policy.

Access Control

Restricting access to systems, networks, or devices to authorized users only. ORDR enforces access control using device identity and real-time behavior rather than network topology alone.

Finding devices by sending probes and analyzing responses—comprehensive but potentially disruptive to sensitive or legacy devices. ORDR supplements active discovery with passive analysis for clinical and OT environments.

Agent-Based Security

Software installed on endpoints to collect telemetry and enforce policy. Effective for managed IT endpoints but unsuitable for IoT, OT, and IoMT environments where agent installation is not possible.

Agentic Security

A model where autonomous AI agents coordinate actions across asset queries, risk correlation, policy generation, and enforcement with minimal human involvement. ORDR IQ embodies agentic security for connected asset environments.

Agentless Discovery

Identifying devices without software installation by using network traffic analysis, API integrations, and protocol inspection. The standard approach for IoT, OT, and IoMT environments.

Air-Gapped Network

A network physically isolated from the public internet. Once the primary OT protection strategy, air gaps are now eroded by IT/OT convergence, remote access requirements, and USB-based threats.

Anomaly Detection

Identifying device behavior that deviates from established baselines. Critical for IoT and OT environments where signature-based detection tools have no coverage of proprietary protocols and devices.

Asset

Any physical or virtual entity on an organization's network: IT endpoints, IoT sensors, OT controllers, IoMT medical devices, cloud workloads, and applications. Complete asset visibility is foundational to security.

Asset Classification

Categorizing devices by type, function, manufacturer, OS, and risk profile. ORDR uses AI/ML trained on 100+ million device profiles to automatically classify assets across IT, IoT, OT, and IoMT.

Asset Intelligence

Deep, contextual knowledge about every asset in an environment, including what it is, how it behaves, what vulnerabilities it carries, and what risk it poses. The foundation of effective IoT and OT security.

Asset Intelligence Graph

ORDR's structured data layer that stores pre-computed relationships and correlated context across millions of assets and device types, enabling instant query responses and AI-powered analysis.

Asset Inventory

A complete, current record of every device on a network: make, model, OS version, firmware version, location, and connectivity status. The starting point for every security program.

Asset Lifecycle Management

Tracking devices from procurement through decommission. End-of-life devices running unsupported firmware are a persistent vulnerability source in healthcare and manufacturing environments.

Asset Risk Score

A single number reflecting the overall security risk of a device, weighing criticality, CVSS severity, KEV status, EPSS probability, network exposure, and asset classification to prioritize remediation.

Attack Surface Management

The continuous process of discovering, inventorying, and reducing exploitable entry points across an environment. Effective attack surface management requires complete, real-time asset visibility.

B

BMS (Building Management System)

Systems controlling HVAC, lighting, elevators, and physical access. Increasingly IP-connected with minimal security monitoring, BMS devices represent a growing attack surface in enterprise environments.

Behavioral Baseline

Normal, expected communication patterns for a specific device class or individual device, built from real observed traffic rather than generic profiles. Deviations trigger anomaly alerts.

C

CAASM (Cyber Asset Attack Surface Management)

A security discipline focused on maintaining complete visibility into all cyber assets and their exposures by consolidating data from across the security tool stack into a unified asset inventory.

CMDB (Configuration Management Database)

A repository tracking IT assets, configurations, and relationships. CMDBs typically have poor coverage of IoT, OT, and IoMT devices, creating blind spots that ORDR is designed to fill.

CVE (Common Vulnerabilities and Exposures)

Publicly disclosed security flaws with unique identifiers. ORDR maps CVEs to specific assets in the environment for context-aware, prioritized remediation rather than generic patching lists.

CVSS (Common Vulnerability Scoring System)

A standardized 0–10 severity scale for vulnerabilities. ORDR combines CVSS scores with KEV status, EPSS probability, and asset context to provide meaningful, actionable prioritization.

Compliance

Meeting the regulatory and contractual requirements that govern how systems and data must be protected. In healthcare, compliance includes HIPAA and FDA requirements for connected medical devices.

Connected Medical Device

Networked medical devices such as infusion pumps, ventilators, and imaging systems. These devices are FDA-regulated, often run legacy software, and cannot support endpoint security agents.

Continuous Monitoring

Ongoing, automated assessment of an organization's security posture across asset inventory, vulnerability status, behavioral baselines, and configuration drift—rather than point-in-time assessments.

Cyber-Physical System (CPS)

A system where computing and physical processes are tightly coupled. Compromising a cyber-physical system can mean equipment failure, patient harm, production shutdown, or infrastructure damage.

D

DCS (Distributed Control System)

An industrial control system with distributed controllers, common in oil, gas, and power generation. DCS environments often run decades-old proprietary protocols with no native security visibility.

Deep Packet Inspection (DPI)

Network analysis that examines full packet content beyond headers. Essential for understanding proprietary OT and IoT protocols such as Modbus, DNP3, BACnet, and DICOM.

Discovery Engine

ORDR's technology for automatically identifying and profiling devices using passive traffic analysis, selective active probing, and API integrations with existing infrastructure tools.

Drift

Deviation from an asset's known-good configuration or behavioral baseline. Drift can indicate a compromise, unauthorized change, misconfiguration, or firmware update that alters device behavior.

E

EDR (Endpoint Detection and Response)

Monitoring and response software for managed IT endpoints. EDR has no coverage of IoT, OT, or IoMT devices that cannot run agents, making it insufficient as the sole detection strategy.

EPSS (Exploit Prediction Scoring System)

A probability model estimating the likelihood of a CVE being exploited within 30 days. ORDR incorporates EPSS alongside CVSS and KEV to help teams focus on the vulnerabilities most likely to be weaponized.

East-West Traffic

Lateral traffic between devices inside the network, as opposed to north-south traffic entering or leaving. Attackers rely on east-west movement to spread after initial access and reach high-value targets.

Exploit

Code or a technique that takes advantage of a vulnerability to gain unauthorized access or execute actions. Especially dangerous when combined with unpatched, unmanaged IoT or OT devices.

Exposure Management

Continuously identifying and reducing exploitable exposures across all assets and environments by combining asset context, network reachability analysis, and vulnerability intelligence.

F

Firewall

A system that monitors and controls network traffic based on defined rules. ORDR integrates with firewalls to automatically push and validate segmentation policies based on device behavior.

Firmware

Permanent embedded software that controls device hardware operation. Outdated firmware is a persistent vulnerability source in IoT, OT, and IoMT environments where patching is often impractical.

Flow Analysis

Examining communication patterns—source, destination, protocol, frequency, and volume—to understand expected device behavior and surface anomalies that may indicate compromise or misconfiguration.

H

HDO (Healthcare Delivery Organization)

Hospitals, health systems, and clinics that operate complex, diverse device environments. HDOs must comply with HIPAA and FDA requirements while managing thousands of connected medical devices.

HIPAA (Health Insurance Portability and Accountability Act)

U.S. law establishing requirements for protecting patient health information. HIPAA compliance requires securing connected devices and systems that create, receive, store, or transmit PHI.

HITECH (Health Information Technology for Economic and Clinical Health Act)

Legislation that strengthened HIPAA security requirements and introduced mandatory breach notification rules, increasing accountability for healthcare organizations managing connected devices.

HMI (Human Machine Interface)

The operator-facing interface for monitoring and controlling industrial equipment. HMIs are high-value attack targets because they provide direct access to physical process control.

HTM (Healthcare Technology Management)

The discipline responsible for managing medical devices across their full lifecycle, from procurement to decommission. HTM professionals are key partners in IoMT security programs.

I

ICS (Industrial Control System)

Systems that monitor or control physical processes, including SCADA systems, DCS platforms, and PLCs. ICS environments form the backbone of critical infrastructure and require specialized security approaches.

IIoT (Industrial Internet of Things)

IoT technology applied to industrial settings, extending OT networks with connected sensors, actuators, and machinery. IIoT expands visibility but also significantly increases the attack surface.

ISA/IEC 62443

An international standards series for securing Industrial Automation and Control Systems. Widely adopted in manufacturing and critical infrastructure as the framework for OT security program design.

IT (Information Technology)

Systems and infrastructure for storing, processing, and transmitting information. Traditional security tools were designed for IT environments and lack coverage of IoT, OT, and IoMT devices.

IT/OT Convergence

The integration of IT and OT networks that creates operational efficiency but also unpredictably expands the attack surface by connecting previously isolated industrial systems to enterprise networks.

ITSM (IT Service Management)

Practices for managing IT service delivery. ORDR integrates with ITSM platforms like ServiceNow to automatically synchronize asset inventory and vulnerability data for streamlined remediation workflows.

Incident Response

The process of detecting, containing, investigating, and recovering from a security incident. Speed and effectiveness depend heavily on having accurate, real-time asset context when incidents occur.

IoC (Indicator of Compromise)

Evidence of a security breach, such as malicious network connections, unexpected processes, or unusual communication patterns. IoCs from ORDR asset telemetry enrich SIEM and SOAR investigations.

IoMT (Internet of Medical Things)

The category of connected devices used in clinical care, including patient monitors, infusion pumps, imaging systems, ventilators, and wearables. IoMT devices require specialized security approaches.

IoT (Internet of Things)

Physical devices with embedded sensors, software, and network connectivity that exchange data over a network. IoT encompasses billions of devices from industrial sensors to building systems to consumer gadgets.

K

KEV (Known Exploited Vulnerability)

A CVE listed in CISA's Known Exploited Vulnerabilities catalog with confirmed active exploitation in the wild. KEV status makes a vulnerability a highest-urgency remediation target.

L

Lateral Movement

How attackers spread through a network after gaining initial access, moving from device to device toward higher-value targets. Network segmentation and behavioral monitoring limit lateral movement.

Least Privilege

The principle that every user, device, and process should have only the access required to perform its specific function—nothing more. Foundational to zero trust and effective network segmentation.

Legacy Device

A device running unsupported hardware, firmware, or software that cannot be patched or updated. Extremely common in healthcare and manufacturing, where segmentation compensates when remediation is impossible.

M

MDM (Mobile Device Management)

Software for managing and securing mobile and endpoint devices. MDM has no reach into unmanaged IoT, OT, or IoMT devices, leaving most of the connected device landscape unprotected.

Microsegmentation

Dividing a network into granular, isolated zones at the device or workload level and enforcing identity-based traffic policies between them. More precise and effective than traditional VLAN-based segmentation.

Multi-Agent Orchestration

An AI architecture where specialized agents work in parallel to complete complex tasks in coordinated workflows. ORDR IQ uses multi-agent orchestration to answer complex security queries across asset data.

N

NAC (Network Access Control)

A solution that controls which devices can access the network and enforces connectivity conditions. ORDR integrates with NAC systems to automatically enforce segmentation policies based on device identity.

NIST (National Institute of Standards and Technology)

A U.S. federal agency that develops widely adopted cybersecurity standards and frameworks, including the Cybersecurity Framework (CSF) and guidelines for IoT and industrial control system security.

NIST CSF (Cybersecurity Framework)

NIST's framework organizing security activities into five functions: Identify, Protect, Detect, Respond, and Recover. A common reference for building and measuring IoT and OT security programs.

Network Segmentation

Dividing a network into separate zones to contain threats and limit the blast radius of a breach. A foundational security control in healthcare and manufacturing where devices cannot be patched.

O

ORDR Cloud

ORDR's cloud platform providing agentless asset discovery, behavioral analysis, risk scoring, and policy orchestration across IT, IoT, OT, and IoMT environments.

ORDR Code

ORDR's capability for automatically generating network access policies—ACLs and VLAN configurations—based on actual observed device communication patterns and defined security objectives.

ORDR IQ

ORDR's AI-powered orchestration engine that enables security teams to ask natural language questions and receive actionable results drawn from verified, real-time asset intelligence.

OT (Operational Technology)

Hardware and software that monitors or controls physical processes, including industrial control systems, SCADA systems, PLCs, and RTUs. OT security requires different approaches than traditional IT security.

OT Security

The practice of protecting operational technology environments while respecting their constraints: legacy devices, proprietary protocols, strict uptime requirements, and the potential for physical consequences from cyber events.

P

PHI (Protected Health Information)

Individually identifiable health information created, received, stored, or transmitted by a healthcare organization. Securing PHI is a core HIPAA requirement that extends to all connected medical devices.

PLC (Programmable Logic Controller)

An industrial computer that automates physical processes in manufacturing and critical infrastructure. PLCs are high-value attack targets that typically run decades-old firmware without any endpoint security.

Passive Discovery

Identifying and profiling assets by analyzing existing network traffic without sending probes. Zero-disruption approach that is the default for clinical environments and active OT networks.

Patching

Applying software updates to fix known vulnerabilities. Standard practice in IT environments but frequently impractical in IoT, OT, and IoMT due to vendor restrictions, uptime requirements, and unsupported devices.

Policy Automation

Automatically generating, deploying, and maintaining security policies based on asset intelligence and defined security objectives, rather than manually authoring and updating rules for thousands of devices.

Posture Management

Continuously measuring and improving an organization's security configuration across all assets, including asset inventory completeness, vulnerability status, policy enforcement, and compliance alignment.

Purdue Model

A hierarchical reference architecture for ICS and OT environments that organizes systems into levels from field devices to enterprise IT. Widely used for defining segmentation zones between OT and IT networks.

R

RBAC (Role-Based Access Control)

Restricting platform and system access based on a user's organizational role. ORDR implements RBAC to ensure security analysts, clinicians, and administrators work within their appropriate function scope.

RTU (Remote Terminal Unit)

A device that monitors and controls remote field equipment in utilities and energy infrastructure. RTUs are often decades old with limited security capabilities and no vendor-supported patching path.

Ransomware

Malware that encrypts systems and demands payment for decryption keys. Healthcare, manufacturing, and critical infrastructure organizations are the highest-impact targets due to operational disruption consequences.

Remote Access

Connecting to networks, devices, or systems from external locations. Remote access introduces significant risk in OT and IoMT environments not originally designed for external connectivity.

Risk-Based Prioritization

Focusing remediation effort on the exposures that pose the greatest actual risk rather than working through a vulnerability list sorted by CVSS severity score alone. Requires combining asset context with vulnerability data.

S

SBOM (Software Bill of Materials)

A complete inventory of software components, libraries, and dependencies in a device or application. Critical for vulnerability response, regulatory compliance, and supply chain risk management.

SCADA (Supervisory Control and Data Acquisition)

A control system architecture using networked computers to monitor and manage industrial processes. SCADA systems are common targets for nation-state attacks against critical infrastructure.

SIEM (Security Information and Event Management)

A platform that collects, correlates, and analyzes security event data from across the environment. ORDR integrates with SIEM platforms to enrich alerts with real-time device context.

SOAR (Security Orchestration, Automation, and Response)

A platform that automates security investigation and response workflows. ORDR IQ provides built-in asset-centered orchestration, while also integrating with third-party SOAR platforms.

SOC (Security Operations Center)

The team and infrastructure responsible for continuous threat monitoring, detection, and response. SOC analysts rely on complete asset context to triage alerts and investigate incidents effectively.

Security Hygiene

Foundational practices that keep an environment secure over time: maintaining an accurate asset inventory, patching known vulnerabilities where possible, and enforcing consistent access controls.

Segmentation Policy

A rule set defining allowed traffic between network segments based on device identity and observed behavior, rather than just IP address ranges. Effective segmentation policies require accurate asset classification.

Software Inventory Collector

An ORDR lightweight script that identifies installed software on devices and maps associated vulnerabilities, enabling vulnerability management for legacy devices that cannot be scanned by traditional tools.

T

Third-Party Risk

Security risk introduced by vendors, contractors, or partners who have access to systems or data. Third-party remote access is frequently exploited in healthcare and industrial environments.

Threat Detection

Identifying active or emerging threats in real time. Requires behavioral analysis for IoT, OT, and IoMT devices that are invisible to signature-based detection tools and traditional EDR platforms.

Threat Intelligence

Evidence-based information about attacker tactics, exploits, and known threats. ORDR incorporates CISA KEV data and EPSS probability scores to contextualize threats within the actual asset environment.

U

UDI (Unique Device Identifier)

An FDA-required standardized identifier for medical devices that enables reliable tracking across the device lifecycle. UDI provides a trusted anchor for medical device inventory in healthcare organizations.

Unmanaged Device

A device not enrolled in MDM, EDR, or other management systems. Most IoT, OT, and IoMT assets are unmanaged and therefore invisible to conventional security tools without purpose-built discovery.

V

VLAN (Virtual Local Area Network)

A logical grouping of devices into separate broadcast domains using network infrastructure. VLANs provide coarse segmentation; ORDR complements them with microsegmentation for finer-grained device-level control.

Vulnerability

A weakness in software, firmware, hardware, or configuration that could be exploited by an attacker. Vulnerabilities are especially persistent in IoT, OT, and IoMT devices where patching is impractical.

Vulnerability Management

The full process of identifying, assessing, prioritizing, and remediating vulnerabilities across an asset inventory. Effective vulnerability management in IoT/OT requires asset context beyond what scanners provide.

X

XDR (Extended Detection and Response)

A platform unifying detection and response capabilities across endpoints, networks, and cloud environments. ORDR integrates with XDR platforms to provide device context for IoT and OT environments.

XIoT (Extended Internet of Things)

An umbrella term covering IT, IoT, IIoT, OT, and IoMT devices, reflecting the convergence of previously separate device categories into a single unified—and expanding—attack surface.

See these concepts in action.

ORDR gives security teams complete visibility into every connected asset, and the intelligence to act on what matters most.

REQUEST A DEMO