Glossary

Networking, in plain English

Zero-trust and SD-WAN come with a lot of jargon. Here's what the terms actually mean — no marketing, just clear definitions.

A

Access control policy: Rules that decide which identities and devices can reach which resources.; An access control policy expresses, in one place, who (identity) and what (device) is allowed to connect to a given resource and under what conditions. In a zero-trust model, policies are evaluated on every connection rather than assumed from network location.; RelatedZero trust Least privilege Microsegmentation

B

BYOD (Bring Your Own Device): Letting people use personal devices to access work systems.; BYOD improves flexibility but widens the attack surface, since the organization doesn't fully control the endpoint. Device posture checks and least-privilege access make BYOD safer by gating access on the device's current security state.; RelatedDevice posture Least privilege Zero trust

C

CIDR: A compact notation for an IP address range, e.g. 10.0.0.0/8.; Classless Inter-Domain Routing notation describes a block of IP addresses by a prefix length. Overlapping CIDR ranges across merged networks or multiple clouds are a common source of connectivity pain — overlay networks sidestep this with their own stable addressing.; RelatedOverlay network Multi-cloud networking NAT traversal
Control plane: The part of a network that decides how traffic should flow and what's allowed.; The control plane distributes configuration, identity and policy — deciding who can talk to whom. It is separated from the data plane, which actually carries the traffic. Compromising the control plane must never expose the contents of the data plane.; RelatedData plane Zero trust Access control policy

D

Data plane: The part of a network that actually moves your packets.; The data plane forwards traffic between endpoints according to decisions made by the control plane. In a well-designed system the data plane is end-to-end encrypted, so even the operator can't read what flows across it.; RelatedControl plane End-to-end encryption ForgeLink
Device posture: A device's current security state — patch level, disk encryption, OS, etc.; Posture checks verify that a device meets security requirements before and during a connection. If a device drifts out of compliance (say, disk encryption is disabled), access can be narrowed or revoked automatically — a core part of continuous verification.; RelatedZero trust BYOD (Bring Your Own Device)ZTNA (Zero Trust Network Access)

E

Edge computing: Running compute close to where data is produced, rather than in a central cloud.; Edge computing places processing near the source — a store, a factory, a remote site — to cut latency and bandwidth. Connecting these many small, often resource-constrained nodes securely is exactly what a lightweight overlay mesh is built for.; RelatedOT (Operational Technology)Mesh network Overlay network
End-to-end encryption: Traffic encrypted at the source and only decrypted at the destination.; With end-to-end encryption, no intermediary — including the network operator — can read the data in transit. Modern overlays build this on audited primitives and rotate keys automatically so a single leaked key has limited blast radius.; RelatedForgeLink mTLS (mutual TLS)Data plane

F

ForgeLink: FastForge's proprietary mesh protocol — military-grade AES-256 encryption, built for self-forming networks.; ForgeLink is the encrypted transport at the core of Interconnect. It forms direct, authenticated links between peers and encrypts every packet end-to-end with military-grade AES-256, rotating keys automatically. Built for the mesh: low overhead, NAT-friendly, and runs anywhere from hyperscaler VMs down to constrained edge hardware.; RelatedEnd-to-end encryption Data plane Mesh network

I

Identity provider (IdP): The system of record for user identities and authentication.; An identity provider (such as an SSO platform) authenticates users and asserts who they are to other systems. Zero-trust networks delegate authentication to the IdP and bind network access to verified identity rather than IP address.; RelatedSSO (Single Sign-On)SCIM Zero trust

L

Lateral movement: An attacker spreading from one compromised system to others.; Once inside a flat network, an attacker can move sideways to reach higher-value targets. Microsegmentation and least-privilege access contain lateral movement by ensuring a compromised endpoint can only reach the few resources it was explicitly permitted.; RelatedMicrosegmentation Least privilege Zero trust
Least privilege: Granting the minimum access needed to do the job — nothing more.; The principle of least privilege limits each identity and device to exactly the resources it requires. It shrinks the attack surface and limits the damage from any single compromise. It's a foundational idea behind zero-trust access.; RelatedZero trust Lateral movement Access control policy

M

Mesh network: A topology where nodes connect directly to each other, not through a hub.; In a full or partial mesh, peers establish direct encrypted links rather than backhauling all traffic through a central concentrator. This reduces latency and removes single points of failure — the basis of modern overlay connectivity.; RelatedOverlay network NAT traversal Site-to-site connectivity
Microsegmentation: Dividing a network into small zones with their own access rules.; Microsegmentation isolates workloads or systems from each other so that access between them is explicitly controlled. It's a primary defense against lateral movement, especially for sensitive systems like payment or patient data.; RelatedLateral movement Least privilege OT (Operational Technology)
mTLS (mutual TLS): TLS where both client and server prove their identity with certificates.; Standard TLS authenticates only the server; mutual TLS additionally requires the client to present a valid certificate. This two-way verification is common in zero-trust and service-to-service communication, where neither side should be trusted by default.; RelatedEnd-to-end encryption Zero trust Identity provider (IdP)
Multi-cloud networking: Connecting workloads securely across more than one cloud provider.; Each cloud has its own networking model, and stitching them together with native peering is brittle. A provider-agnostic overlay gives one consistent, policy-based network across AWS, GCP, on-prem and the edge. See our multi-cloud solution for how this works in practice.; RelatedOverlay network CIDR Mesh network

N

NAT traversal: Establishing direct connections between devices behind routers/firewalls.; Most devices sit behind Network Address Translation, which hides them from inbound connections. NAT traversal techniques let two such peers form a direct, encrypted link without manually opening firewall ports — essential for a self-forming mesh.; RelatedMesh network Overlay network ForgeLink

O

OT (Operational Technology): Hardware and software that runs physical/industrial processes.; OT covers the controllers, sensors and machinery on a factory floor or in critical infrastructure. These systems often can't be patched like IT and must be carefully segmented when connected to networks, lest they be exposed to threats they weren't built to withstand.; RelatedMicrosegmentation Edge computing Zero trust
Overlay network: A virtual network built on top of existing physical/cloud networks.; An overlay creates its own addressing and encrypted paths that ride over whatever underlying connectivity exists. This decouples your network model from any single provider or location, enabling consistent policy everywhere and avoiding CIDR conflicts.; RelatedMesh network CIDR Multi-cloud networking

S

SASE: Secure Access Service Edge — converged networking and security delivered as a service.; SASE is an architectural model that combines wide-area networking with security functions (like zero-trust access and threat protection) into a single cloud-delivered service. ZTNA is one of the security capabilities typically found within a SASE framework.; RelatedSD-WAN ZTNA (Zero Trust Network Access)Zero trust
SCIM: A standard for automatically provisioning and de-provisioning user accounts.; System for Cross-domain Identity Management keeps user accounts in sync between an identity provider and downstream applications. With SCIM, removing someone from your IdP automatically revokes their access everywhere — closing a common offboarding gap.; RelatedIdentity provider (IdP)SSO (Single Sign-On)Least privilege
SD-WAN: Software-defined wide-area networking — managing site connectivity in software.; SD-WAN replaces manually configured branch routers with centrally managed, software-defined connectivity across sites and clouds. Combined with zero-trust, it lets new locations join securely in minutes instead of weeks of hardware and config.; RelatedSite-to-site connectivity SASE Overlay network
Site-to-site connectivity: Securely linking whole locations — offices, branches, data centers.; Site-to-site connectivity joins entire networks rather than individual users. Modern approaches install a lightweight gateway per site that auto-joins a mesh, removing the truck rolls and per-site configuration of legacy hardware VPNs.; RelatedSD-WAN Mesh network Split tunneling
Split tunneling: Sending only some traffic through the secure tunnel, the rest directly.; Split tunneling routes only traffic destined for protected resources over the encrypted overlay, while general internet traffic goes out directly. This improves performance but must be configured carefully so sensitive traffic is never inadvertently sent in the clear.; RelatedMesh network Site-to-site connectivity End-to-end encryption
SSO (Single Sign-On): Logging in once to access many applications.; Single sign-on lets users authenticate once with an identity provider and then reach multiple systems without re-entering credentials. It improves security by centralizing authentication, enabling strong MFA, and giving one place to cut off access.; RelatedIdentity provider (IdP)SCIM Zero trust

V

VPN (Virtual Private Network): An encrypted tunnel onto a private network, typically via a central gateway.; Traditional VPNs grant authenticated users broad access to a flat internal network — convenient, but a large attack surface and a weak fit for remote-first work. Zero-trust network access is the modern replacement, granting per-application rather than network-wide access.; RelatedZTNA (Zero Trust Network Access)Zero trust Split tunneling

Z

Zero trust: Never trust by network location; verify every identity and device, continuously.; Zero trust discards the idea of a trusted internal network. Every connection is authenticated, authorized against policy, and continuously re-verified against device posture — so being on the network grants nothing by itself. It's the foundation of modern secure access.; RelatedZTNA (Zero Trust Network Access)Least privilege Device posture
ZTNA (Zero Trust Network Access): Granting access to specific applications based on identity, not network position.; ZTNA gives a verified user access to individual applications rather than the whole network — the opposite of a flat VPN. Access decisions combine identity, device posture and policy, and are re-evaluated continuously. It's the practical implementation of zero trust for access.; RelatedZero trust VPN (Virtual Private Network)Device posture

Missing a term you’d like defined? Let us know

From jargon to a running network

Now that the terms make sense, see how they come together — a live mesh in minutes, not a glossary of promises.

See a live demo Explore solutions