The Kaliteq glossary

Agile methodologies (notably Scrum and Kanban) organize work in short, iterative cycles, with frequent deliveries and continuous adjustments based on feedback.

An AI agent is a system able to plan and execute a sequence of actions autonomously to reach a goal, relying on an LLM and external tools, rather than simply answering a single question.

An API is a set of rules that lets two pieces of software communicate, exposing functionality or data without either one needing to know the other's internal workings.

CMMI is a maturity model that describes five progression levels (initial, defined, managed, quantitatively managed, optimizing) to assess how well an organization's processes are under control, originally for software development and later extended to other domains.

The cap table lists all of a company's shareholders and their share of the capital, including dilutive instruments (stock options, convertible notes), at a given point in time.

A carbon footprint assessment measures all greenhouse gas emissions generated directly and indirectly by an organization's activity, typically broken down into three scopes (1, 2 and 3).

The CISO drives the organization's cybersecurity strategy: defining the security policy, coordinating risk and incident management, and reporting the company's exposure to leadership.

The CIS Controls are a prioritized list of concrete security measures, published by the Center for Internet Security, designed to be implemented progressively starting with the highest-impact controls.

COBIT (Control Objectives for Information and Related Technologies) is an IT governance framework that connects business goals to IT goals and provides management and control practices for each domain.

A CVE is a unique public identifier assigned to a known software vulnerability, letting every security actor refer unambiguously to the same flaw.

CVSS is a standardized 0-to-10 scale that scores a vulnerability's severity using objective criteria (ease of exploitation, impact on confidentiality, integrity and availability).

Under GDPR, consent is a freely given, specific, informed and unambiguous indication by which a person agrees to the processing of their data, and it must be as easy to withdraw as it was to give.

CI/CD refers to the automation of build, test and deployment steps, enabling changes to be shipped to production frequently and reliably.

The CSRD is an EU directive that significantly widens the number of companies required to publish a detailed sustainability report, following standardized disclosure rules (ESRS), covering environmental, social and governance topics.

Under GDPR, a data processor is any organization that processes personal data on behalf of a data controller, following its instructions, under a contract that precisely governs this relationship.

A DPIA is a formal assessment, required for data processing likely to result in a high risk to individuals, evaluating necessity, proportionality and the measures needed to reduce that risk.

The DPO is the person responsible for ensuring GDPR compliance within the organization: advising, monitoring, training teams and acting as the point of contact with the data protection authority.

A Data Room is a secure space, usually digital, where the documents needed for a due diligence, fundraising round or audit are centralized, with fine-grained access control and consultation tracking.

A Design Sprint is an intensive work format, usually run over four to five days, that takes a team from problem definition to a prototype tested with real users.

Design Thinking is a user-centered problem-solving method structured around empathy, problem definition, ideation, prototyping and testing.

DevOps refers to a set of cultural and technical practices that bring development and operations teams closer together to deliver software faster and more reliably.

DORA metrics (from the DevOps Research and Assessment program) measure a software team's performance across four indicators: deployment frequency, lead time for changes, change failure rate and time to restore service.

An EDR agent runs on endpoints and servers, continuously watching for suspicious behavior, raising alerts and automatically isolating a compromised machine.

ESG refers to the three families of non-financial criteria used to assess an organization's responsibility and sustainability: its environmental impact, its social practices and the quality of its governance.

The AI Act is the EU regulation that classifies AI systems by risk level (unacceptable, high, limited, minimal) and imposes proportionate obligations, notably on transparency and risk management, for the most sensitive uses.

Fine-tuning consists of partially retraining an existing AI model on a company-specific dataset, specializing its behavior without starting from scratch.

ANSSI is France's reference cybersecurity authority: it publishes recommendations, qualifies service providers and supports organizations hit by major attacks.

A Gantt chart represents a project's schedule over time as horizontal bars, showing task dependencies, milestones and the owner of each step.

Generative AI refers to systems capable of producing original content (text, images, code, audio) rather than merely classifying or predicting existing data.

GitOps is a practice that uses a Git repository as the single source of truth for the desired state of infrastructure and deployments, with every change going through a review (pull request) before automatic application.

Hexagonal architecture (or "ports and adapters") isolates an application's business logic from external technical details (database, UI, third-party APIs), connected through well-defined interfaces.

IAM covers the processes and tools that manage the full lifecycle of digital identities: account creation, rights assignment, periodic access review and revocation upon departure.

The Information Security Policy is the reference document that formalizes an organization's security rules, principles and responsibilities. It is the foundation on which every technical and organizational control is later built.

ITIL (Information Technology Infrastructure Library) is a set of best practices for IT service management: incident, change, problem and request management.

The Jobs To Be Done framework holds that users "hire" a product to get a specific job done in a given context, and encourages designing the product around that functional need rather than a user persona.

Kanban is a visual work management method, organized in columns representing the steps of a workflow (to do, in progress, done), which limits work in progress to smooth out delivery.

A KPI is a quantifiable measure used to assess whether a strategic or operational goal is being met, tracked regularly to inform decisions.

An LLM is an AI model trained on massive amounts of text, able to understand and generate natural language to answer questions, summarize or draft content.

The legal basis is the legal ground, among the six provided by GDPR (consent, contract, legal obligation, vital interest, public interest task, legitimate interest), that justifies a personal data processing activity.

An MVP is the simplest version of a product that lets a team test a hypothesis with real users at minimal cost, before deciding whether to invest further.

MCP is an open protocol that standardizes how an AI model connects to external tools, databases and services, rather than building a proprietary integration for each source.

MFA requires at least two independent proofs of identity to access an account: a password combined with a one-time code, a physical key or a biometric factor.

The NIST Cybersecurity Framework is a widely adopted reference model that structures cybersecurity management around five functions: identify, protect, detect, respond and recover.

The North Star Metric is the single indicator that best captures the value a product delivers to its users, used as a shared compass to prioritize product decisions.

OKRs are a goal-setting method that pairs an ambitious qualitative objective with three or four measurable key results used to judge whether it has been achieved.

A personal data breach is a security incident that accidentally or unlawfully leads to the destruction, loss, alteration or unauthorized disclosure of personal data.

Product Discovery covers the research activities carried out before building a feature, to check that it is desirable for users, viable for the business and technically feasible.

Prompt engineering is the practice of formulating and structuring the instructions given to a generative AI model to obtain more relevant, reliable and usable responses.

A POC is a limited demonstration, built quickly and cheaply, meant to verify that an idea or technology is technically feasible before investing further.

A RACI matrix clarifies, for each task or decision in a project, who is Responsible for doing it (R), who is Accountable for the result (A), who must be Consulted (C) and who must be Informed (I).

The record of processing activities lists, for each activity involving personal data, its purpose, the data concerned, recipients, retention period and associated security measures.

RAG combines a document retrieval engine with an LLM: before answering, the system fetches the most relevant passages from a company's own knowledge base, then feeds them into the model's context.

A roadmap presents, over time, the major priorities and milestones of an IT, product or security strategy, aligning stakeholders on what will be done and in what order.

A SIEM centralizes and correlates event logs across the entire information system to detect attack patterns invisible when looking at any single source alone.

The SOC is the team (in-house or outsourced) and tooling dedicated to continuous monitoring, detection and first response to security incidents, around the clock or during business hours depending on the organization's maturity.

Technical debt refers to the future cost created by quick or imperfect technical choices made to move faster in the short term, which will eventually need to be fixed.

Technology due diligence is the in-depth examination of a company's information system, software architecture, security and technical teams, carried out ahead of a fundraising round, acquisition or investment.

Technology watch is the organized, continuous monitoring of technology developments, market trends and competitor initiatives, to anticipate opportunities and threats rather than discover them too late.

A term sheet is a non-binding document that summarizes the main proposed terms of an investment (valuation, amount, governance, preferential rights), before the final legal documents are drafted.

The Zero Trust model assumes that no user or device is trustworthy by default, even inside the corporate network: every access is verified, authenticated and scoped to the strict minimum.