Glossary
Common terms explained
IT security has many difficult words and abbreviations. Here we explain the most common ones in plain language.
XoT
Terms we use
The Lock, XoT Lock
The part of XoT that protects the equipment. The Lock is installed next to the equipment. It only lets through traffic from someone with a valid Key.
The Key, XoT Key
The user's digital identity. The Key can be an application on a computer, a login in a web browser or a physical key.
XoT Bridge
The part of XoT that relays traffic between the user and the Lock. With XoT Bridge, no inbound ports need to be opened in the firewall.
XMS
The server where you create rules for who may connect to what, from where and when. XMS stands for XoT Management Server.
Environments and equipment
What you find in a plant
OT
OT stands for operational technology. It is the technology that controls and monitors physical processes, such as machines, valves and pumps. A fault in OT can stop production or affect people's safety.
Industrial control system
An umbrella term for the systems that control industrial processes. It is often shortened to ICS. The IEC 62443 standard uses the abbreviation IACS.
PLC
A computer that controls part of a process, such as a machine. PLC stands for programmable logic controller.
HMI
The screen where the operator controls and monitors the process. HMI stands for human-machine interface. It is often an ordinary computer running special software. That computer may have an old operating system.
SCADA
Systems for monitoring and controlling facilities spread over many locations, such as a power grid or a water supply. SCADA stands for supervisory control and data acquisition.
DCS
A control system for a single connected process, for example in a chemical plant. DCS stands for distributed control system.
Security
Security terms
Vulnerability
A flaw in software or hardware that an attacker can exploit.
Security update
A change to software that fixes a vulnerability. It is also called a patch.
Segmentation
Dividing a network into separate parts. If one part is attacked, the attacker cannot reach the other parts. It sounds simple, but it is hard in practice. That is because you need to know which systems have to communicate with each other.
Zone and conduit
Two concepts in IEC 62443. A zone is a group of equipment with the same security requirements. A conduit is the controlled connection between two zones.
Lateral movement
An attacker gets in at one point and then moves on to other systems in the network. A network without segments makes this easy.
Air gap
A site has an air gap when it has no connection to other networks. It works in theory. In practice there is often a modem, a USB stick or a vendor connection that nobody accounted for.
Zero trust
A security principle. No connection is trusted just because it comes from a particular place in the network. Identity must always be checked.
Jump server
A server that all remote access passes through. It gives an overview, but it also becomes a valuable target for attackers.
Compensating control
A measure that reduces the risk from a vulnerability without removing the vulnerability itself. Blocking unauthorised traffic to equipment that cannot be updated is a compensating control.
Penetration test
A test in which experts try to break into a system with the owner's permission. The aim is to find weaknesses before anyone else does.
VPN
An encrypted connection into a network. The user can then reach the network as if they were on site.
Firewall
A system that decides which traffic may pass between two networks, for example between the internet and the company network.
SIEM
A system that collects logs from across the organisation and looks for signs of attacks. SIEM stands for security information and event management.
Encryption and identity
Encryption and identity terms
Encryption
Making information unreadable to anyone without the right key.
WireGuard
A modern technology for encrypted connections. Its code is about 4,000 lines long, so it is small enough to review in full. XoT uses WireGuard to encrypt the traffic.
Curve25519, ChaCha20 and BLAKE2s
The cryptographic methods that WireGuard uses. Curve25519 lets the parties exchange keys securely. ChaCha20 encrypts the traffic. BLAKE2s is a hash function, which calculates a short, fixed-length value from data.
Digital certificate
A digital identity document for a user, a computer or a system. In XoT, every user and every device has its own certificate.
X.509
The most common standard for digital certificates.
PKI
A system for issuing and managing digital certificates. PKI stands for public key infrastructure.
Challenge and response
A check in which one party asks a question that only the holder of the right key can answer. In XoT, the user and the Lock run the check in both directions, twice a minute.
Multi-factor authentication
A login that requires at least two different kinds of proof of identity. For example, a password and a code on your phone. It is often shortened to MFA.
Laws and standards
Regulatory terms
NIS2
The EU directive on cybersecurity. In Sweden it applies through the Swedish Cybersecurity Act.
Swedish Cybersecurity Act
The Swedish law that implements NIS2. It came into force on 15 January 2026.
IEC 62443
A series of standards for security in industrial control systems. It describes zones, conduits, security levels and seven foundational requirements.
Cyber Resilience Act
An EU regulation that sets requirements for products with digital elements, meaning hardware and software. It places more responsibility for security on the manufacturer.
SBOM
A list of the software components that a product contains. With it, you can tell whether a new vulnerability affects you. SBOM stands for software bill of materials.