Cybersecurity glossary
What is a Vector Database?
Learn what a vector database is, how it stores embeddings for semantic search and RAG, which access-control mistakes leak documents, and how to harden vector indexes used by LLM applications.
Definition
A vector database stores high-dimensional embeddings and retrieves nearest neighbors by similarity. In AI applications it is the index behind semantic search and RAG, returning document chunks whose vectors are close to a query vector.
Why vector databases matter
Keyword search asks “which documents contain these words?” A vector database asks “which stored embeddings sit nearest this query embedding?” That shift powers semantic search, recommendations, and most RAG assistants.
It also creates a new data store that security reviews often miss. The index may copy contracts, source code, or health notes into chunk payloads. If the application queries it with a user question but without the user’s ACLs, similarity becomes a privilege-escalation primitive: the closest chunk wins, regardless of who owns it.
How similarity search works
Embed content
An embedding model turns each chunk into a fixed-length vector and optional metadata payload.
Index vectors
The database builds an ANN structure (HNSW, IVF, and similar) so neighbors can be found quickly.
Embed the query
The same or a compatible model encodes the user question into a query vector.
Find neighbors
The engine returns top-k closest items, optionally filtered by metadata.
Return payloads
Text chunks, IDs, and scores go back to the application for prompting or display.
Mutate over time
Updates, deletes, and re-embeds change neighborhoods. Stale or hostile points can linger.
Security-sensitive surfaces
Unfiltered top-k
A query without tenant or ACL predicates returns the globally nearest chunks, including other customers’ data.
Payload oversharing
Indexes often store raw text, source URLs, and authors beside vectors. Those fields are the real secret.
Open management APIs
API keys with write or backup access dump the whole corpus, not just one search result.
Cross-collection queries
Debug tools and agents that can pick any namespace skip the collection the product intended to use.
Vector store versus source-of-truth systems
| Topic | Source system (wiki, DMS, SaaS) | Vector database |
|---|---|---|
| Primary job | Authoring, workflow, and human access | Fast similarity lookup for machines |
| Access control | Often mature roles and sharing links | Easy to forget; metadata filters are optional unless enforced |
| Deletes | User expects the document to vanish | Chunks and replicas may remain until explicit reindex and tombstones |
| Attack value | Direct document theft | Semantic dump, RAG poisoning, and neighbor-based leakage |
| Least privilege | Per-document ACLs | Per-query filters plus separate collections for high-sensitivity data |
- Treat the vector index as a sensitive replica of source documents, not a disposable cache.
- Enforce tenant and ACL filters server-side; never trust client-supplied metadata predicates alone.
- Keep query APIs off the public internet; applications should proxy searches with a user session.
- Split high-sensitivity corpora into separate collections with separate credentials.
- Propagate deletes and reclassifications to the index on a defined SLA.
- Encrypt at rest, rotate API keys, and restrict who can list, export, or upsert points.
- Record collection, filters, and returned IDs for every RAG query.
- Test neighbor leakage: query as tenant A and confirm tenant B chunks never appear.
The practical takeaway
A vector database is an index of embeddings used to find semantically similar chunks. In LLM products it is often the hidden copy of your knowledge base.
If similarity search can return a document, an assistant can quote it. Lock the index with the same tenancy and ACLs as the source, keep query keys off clients, and assume payloads are plaintext secrets sitting next to vectors.
Related security terms
Embedding
The numeric vectors that a vector database indexes and compares.
Retrieval-Augmented Generation (RAG)
The application pattern that queries vector stores at generation time.
Vector and Embedding Weaknesses
OWASP risk covering insecure indexes, leakage, and poisoned vectors.
Retrieval Poisoning
Attacks that manipulate which neighbors a query returns.
Large Language Model (LLM)
The consumer of retrieved chunks after similarity search.
Frequently asked questions
What is a vector database in simple terms?
It is a specialized store for lists of numbers (embeddings). You ask with another list of numbers, and it returns the stored items that are closest in meaning, not only exact keyword matches.
How is this different from Elasticsearch or Postgres?
Traditional search ranks tokens and filters. A vector database ranks geometric similarity. Many teams now use hybrid setups: keyword plus vectors, sometimes inside Postgres with pgvector rather than a standalone product.
Why is a vector database a security concern?
It often holds the same sensitive text as the source system, plus vectors that can leak topics or enable inversion. Weak filters return neighbors the caller should never see.
Do vectors contain the original document?
Not as plaintext, but chunks are usually stored as payload beside the vector. Even without payload, embeddings can reveal topics and, in research settings, support reconstruction attacks.
What is ANN search?
Approximate nearest neighbor search trades exactness for speed at large scale. Security still depends on who can query, which namespaces they hit, and what payloads come back.
Can one index serve many tenants safely?
Only with mandatory, server-side tenant filters or true namespace isolation. Client-supplied metadata filters are not a security boundary if they can be omitted.
Should vector databases be exposed to browsers?
Almost never. Querying from the client lets users probe similarity, dump neighbors, and bypass application ACLs. Keep queries on the server with the user’s session.
References
Explore authoritative guidance and frameworks related to vector database.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.