Appendix: Technical Terms Reference

---

ABS — Anti-lock Braking System. A vehicle safety system that prevents wheels from locking under hard braking, allowing the driver to maintain steering. When ABS "chatters," it's rapidly cycling the brakes to optimize stopping. Ch 1 — "ABS chattered beneath a car that had not been moving for several seconds."

Active Directory — Microsoft's directory service for Windows corporate environments. Manages user accounts, authentication, permissions, and group policy across an organization's network. Nearly every Windows-based enterprise runs it. Ch 10.

API — Application Programming Interface. A defined set of methods for communicating with a software system. A "legacy API endpoint" is a data access point left in place when the system around it was rebuilt — the door is still there, the room it led to no longer is. Ch 10 — "a legacy API endpoint on the customer portal."

CDT — Central Daylight Time. The time zone in effect in Nashville during warmer months. Ch 15 — referenced in the formal account of the crash: "April 17, 2026, at 7:23 PM CDT."

CISO — Chief Information Security Officer. The executive responsible for an organization's information security posture — owns the security budget, sets security policy, and bears professional responsibility when things go wrong. In enterprise security, the CISO is typically Will's counterpart: the person who hired the pen tester and will receive the report. Ch 8 — "the CISO — Chief Information Security Officer, the executive who owned the security budget and bore professional responsibility when things went wrong."

CISSP — Certified Information Systems Security Professional. A practitioner-level security certification administered by ISC², widely recognized as the senior credential in the field. Requires five or more years of documented experience across security domains in addition to a comprehensive examination. Holding a CISSP signals sustained professional practice, not recent training. Ch 8 — listed as an expected job function in CYT Systems' LinkedIn staffing profile.

CMC — A Nashville commercial landmark, abbreviated in signage, visible from the windows of CYT Systems' office suite. Ch 19.

CRAC — Computer Room Air Conditioning. Dedicated climate-control hardware designed for the thermal load of server equipment, which generates substantial heat in a confined space. CRAC units run on shorter cycles and maintain tighter temperature tolerances than standard commercial HVAC. Ch 14 — the cooling hardware in the underground installation below County Road 14.

DHCP — Dynamic Host Configuration Protocol. The protocol by which a router automatically assigns IP addresses to devices on a network. "Cycling on its DHCP interval" means the router is periodically re-issuing address leases — routine background network activity that Angie can feel as a regular pulse in the signal layer. Ch 11.

DNS — Domain Name System. The distributed directory that translates human-readable hostnames (like cytsystems.com) into the numeric IP addresses computers use to route traffic. DNS configuration is a standard component of any external perimeter review; locked-down DNS suggests a security-aware organization. Ch 10 — "External DNS — the domain name system, the directory that translates hostnames to addresses — was locked down."

DOB — Date of Birth. Standard identifier on official records. Ch 13 — on the missing persons record for Dana Osei.

DR — Disaster Recovery. The infrastructure and procedures for restoring systems after a catastrophic failure. DR-Node-4 is Meridian's disaster recovery node, hosted off-site at Clearfield Infrastructure Partners (a CYT Systems subsidiary). Keeping DR infrastructure off-site and third-party-hosted is standard practice — which is why the scope document could exclude it without raising immediate flags. Ch 5 — DR-Node-4 in Meridian's network documentation. Ch 9 — "The DR scope is out."

EXIF — Exchangeable Image File Format. The metadata embedded in digital photograph files, recording camera model, lens, exposure settings, and time of capture. EXIF data is invisible to casual viewing but extractable with standard tools. The timestamp Will relies on in Ch 15 is in the EXIF data of his photographs from the underground installation. Ch 15.

HID — HID Global, the dominant manufacturer of proximity access control hardware. "HID readers" and "HID badges" are industry shorthand for the contactless card readers and proximity cards used in commercial building access control. The underlying technology is RFID; HID is the brand so prevalent that its name has become the generic term in physical security contexts, the same way "Band-Aid" stands in for any adhesive bandage. Standard HID proximity cards (125kHz) can be cloned with off-the-shelf hardware; higher-security HID iCLASS cards are more resistant. Ch 10 — "a single-entry turnstile with an HID badge reader."

HOA — Homeowners Association. A neighborhood governance body that manages common areas and enforces property standards. Ch 2 — "the HOA president."

HVAC — Heating, Ventilation, and Air Conditioning. The general category of building climate control. In commercial buildings, HVAC closets are a consistent physical security finding: typically accessible from common areas, they offer entry points that security reviews often miss. Angie uses HVAC cycling as a background pulse when navigating the signal layer. Ch 5 — Zoe identifies an HVAC closet as a billable physical security finding. Ch 6, 7, 11 — ambient signal-layer environment.

IP — Internet Protocol. The addressing system that identifies devices on a network. "An IP address" identifies a specific host; "the IP ending in .47" refers to the fourth device in the underground installation's network segment, first active October 14, 2024. Ch 5 — IP address in Meridian's network documentation. Ch 14, 15, 16, 20 — the .47 address as evidentiary anchor.

IT — Information Technology. The general term for an organization's computing and network infrastructure and the team that manages it. "IT closet," "IT help desk," and "west IT closet" all appear in the context of the Meridian engagement. Ch 5 — Zoe's reconnaissance report. Ch 10 — the Meridian engagement.

KVM — Keyboard, Video, Mouse. A hardware switch that allows a single keyboard, monitor, and mouse to control multiple servers directly, bypassing the network entirely. KVM presence in a server room indicates the installation was built for local administrative access — a professional-grade setup detail. Ch 14 — console KVM in the underground installation; KVM unit at the monitoring station.

LED — Light-Emitting Diode. A lighting technology producing a cooler, whiter light than halogen. The distinction in Ch 1 is a sensory marker: the pre-crash lights were halogen, amber and warm; LED fixtures produce a different quality of light that signals a different era of infrastructure. Ch 1 — "Not clean modern LED white but the warmer glow of halogen." Ch 14, 15, 16 — the LED strip illuminating the underground installation.

NDA — Non-Disclosure Agreement. A legal contract requiring parties to keep specified information confidential. Will signs one with Elsie Sloane as part of the Meridian engagement. Standard in pen testing — the client is disclosing sensitive infrastructure details; the tester is committing not to use or share them. Ch 9 — "The NDA that had been drafted by someone who understood what they were asking Will to sign."

OSINT — Open Source Intelligence. Gathering information from publicly available sources: LinkedIn profiles, job postings, company websites, regulatory filings, social media, news archives, satellite imagery. Standard first phase of any penetration test or social engineering engagement. The quality of OSINT determines the quality of everything that follows. Modern pen testers will use artificial intelligence tools to great;y improve the speed and quality of information garnered from this process. Ch 15.

PD — Police Department. Ch 3 — "Nashville PD."

PDF — Portable Document Format. A file format that renders documents consistently across platforms regardless of the software used to create them. CYT Systems' technical overview is a PDF — nominally gated behind a lead-generation form, but accessible via a direct URL embedded in the page source, without credentials. Ch 8.

RFID — Radio Frequency Identification. The contactless wireless technology underlying building access cards, transit cards, inventory tracking, and similar systems. Standard commercial proximity cards transmit a fixed ID number when powered by a nearby reader — the reader recognizes the ID and grants or denies access. The vulnerability: the transmitted ID can be captured and replicated. Ch 10 — "the temporary RFID card Ostrander's assistant had mailed him."

SLA — Service Level Agreement. A formal commitment from a vendor specifying the level of service they will provide — uptime guarantees, response time commitments, support windows. "Standard SLA" in Elsie's context means the disaster recovery vendor's agreement is unremarkable and not worth examining. Ch 9 — "A vendor they've used for two other portfolio companies. Standard SLA."

SMB — Server Message Block. The primary file-sharing and network authentication protocol in Windows environments. Enabled by default on virtually every Windows machine. Outdated SMB dialects (SMBv1 in particular) are a persistent security finding across enterprise networks — they carry known critical vulnerabilities and are a reliable pen test find even in otherwise well-maintained environments. Ch 10 — "SMB was enabled across the Windows fleet."

SSL — Secure Sockets Layer. The predecessor to TLS (Transport Layer Security), which superseded it; SSL is still used colloquially to refer to the encryption layer underlying HTTPS. SSL certificates authenticate a server's identity and establish an encrypted connection. Certificate hygiene — whether they're current, correctly scoped, and not issued as wildcards where they shouldn't be — is a standard external perimeter checklist item. Ch 10 — "SSL certificates — Secure Sockets Layer, the encryption layer underlying HTTPS — were current and correctly provisioned."

UPS — Uninterruptible Power Supply. A battery-backed power system that keeps equipment running through short outages and provides a controlled shutdown window during longer ones. Standard in any professional server installation. Ch 10 — two UPS units in the Meridian IT closet.

VLAN — Virtual Local Area Network. A logical partition of a physical network that keeps traffic separated as if on distinct physical networks, without requiring separate hardware. Commonly used to isolate guest networks from internal corporate networks, and internal networks from server infrastructure. Being connected to the guest VLAN when scoped for internal access is a process failure — the network is there but the wrong network. Ch 10 — "The connection came up on the Meridian guest VLAN, which was wrong."

VPN — Virtual Private Network. An encrypted tunnel that routes network traffic through an intermediary, masking the originating IP address and protecting traffic from interception. VPN-outbound routing is standard operational security for a penetration tester: it prevents the tester's real IP address from appearing in client logs or external monitoring. Ch 12 — Will's home network configuration.

while-true — A programming construct (while (true) { ... }) that instructs a computer to execute a block of code continuously, looping back to the beginning the instant it finishes, without any exit condition. It runs until something external — a crash, a power failure, a deliberate interrupt — stops it. The loop itself has no mechanism for stopping. In the context of CYT's operation, it is the most accurate description available: a person's behavioral pattern, run continuously, updated on each pass by the source still being present, with no exit condition the person can reach. The pattern chases itself. Ch 7 — "Like a while-true." Ch 11 — "A while-true. With a person in it."