diff --git a/src/core/server/http/integration_tests/lifecycle.test.ts b/src/core/server/http/integration_tests/lifecycle.test.ts
index b16352838fad1..6dc7ece1359df 100644
--- a/src/core/server/http/integration_tests/lifecycle.test.ts
+++ b/src/core/server/http/integration_tests/lifecycle.test.ts
@@ -721,6 +721,7 @@ describe('Auth', () => {
       res.ok({
         headers: {
           'www-authenticate': 'from handler',
+          'another-header': 'yet another header',
         },
       })
     );
diff --git a/src/core/server/http/lifecycle/on_pre_response.ts b/src/core/server/http/lifecycle/on_pre_response.ts
index 45d7478df9805..50d3d7b47bf8d 100644
--- a/src/core/server/http/lifecycle/on_pre_response.ts
+++ b/src/core/server/http/lifecycle/on_pre_response.ts
@@ -120,8 +120,8 @@ export function adoptToHapiOnPreResponseFormat(fn: OnPreResponseHandler, log: Lo
               ...(result.headers as any), // hapi types don't specify string[] as valid value
             };
           } else {
+            findHeadersIntersection(response.headers, result.headers, log);
             for (const [headerName, headerValue] of Object.entries(result.headers)) {
-              findHeadersIntersection(response.headers, result.headers, log);
               response.header(headerName, headerValue as any); // hapi types don't specify string[] as valid value
             }
           }
diff --git a/x-pack/legacy/plugins/alerting/server/alerts_client.ts b/x-pack/legacy/plugins/alerting/server/alerts_client.ts
index a6ba936b76570..1346d403edda1 100644
--- a/x-pack/legacy/plugins/alerting/server/alerts_client.ts
+++ b/x-pack/legacy/plugins/alerting/server/alerts_client.ts
@@ -29,7 +29,7 @@ import {
   CreateAPIKeyResult as SecurityPluginCreateAPIKeyResult,
   InvalidateAPIKeyResult as SecurityPluginInvalidateAPIKeyResult,
 } from '../../../../plugins/security/server';
-import { PluginStartContract as EncryptedSavedObjectsStartContract } from '../../../../plugins/encrypted_saved_objects/server';
+import { EncryptedSavedObjectsPluginStart } from '../../../../plugins/encrypted_saved_objects/server';
 import { TaskManagerStartContract } from '../../../../plugins/task_manager/server';
 
 type NormalizedAlertAction = Omit<AlertAction, 'actionTypeId'>;
@@ -45,7 +45,7 @@ interface ConstructorOptions {
   taskManager: TaskManagerStartContract;
   savedObjectsClient: SavedObjectsClientContract;
   alertTypeRegistry: AlertTypeRegistry;
-  encryptedSavedObjectsPlugin: EncryptedSavedObjectsStartContract;
+  encryptedSavedObjectsPlugin: EncryptedSavedObjectsPluginStart;
   spaceId?: string;
   namespace?: string;
   getUserName: () => Promise<string | null>;
@@ -120,7 +120,7 @@ export class AlertsClient {
   private readonly invalidateAPIKey: (
     params: InvalidateAPIKeyParams
   ) => Promise<InvalidateAPIKeyResult>;
-  encryptedSavedObjectsPlugin: EncryptedSavedObjectsStartContract;
+  encryptedSavedObjectsPlugin: EncryptedSavedObjectsPluginStart;
 
   constructor({
     alertTypeRegistry,
diff --git a/x-pack/legacy/plugins/alerting/server/alerts_client_factory.ts b/x-pack/legacy/plugins/alerting/server/alerts_client_factory.ts
index eab1cc3ce627b..de789fba0ac38 100644
--- a/x-pack/legacy/plugins/alerting/server/alerts_client_factory.ts
+++ b/x-pack/legacy/plugins/alerting/server/alerts_client_factory.ts
@@ -11,7 +11,7 @@ import { AlertTypeRegistry, SpaceIdToNamespaceFunction } from './types';
 import { SecurityPluginStartContract } from './shim';
 import { KibanaRequest, Logger } from '../../../../../src/core/server';
 import { InvalidateAPIKeyParams } from '../../../../plugins/security/server';
-import { PluginStartContract as EncryptedSavedObjectsStartContract } from '../../../../plugins/encrypted_saved_objects/server';
+import { EncryptedSavedObjectsPluginStart } from '../../../../plugins/encrypted_saved_objects/server';
 import { TaskManagerStartContract } from '../../../../plugins/task_manager/server';
 
 export interface ConstructorOpts {
@@ -21,7 +21,7 @@ export interface ConstructorOpts {
   securityPluginSetup?: SecurityPluginStartContract;
   getSpaceId: (request: Hapi.Request) => string | undefined;
   spaceIdToNamespace: SpaceIdToNamespaceFunction;
-  encryptedSavedObjectsPlugin: EncryptedSavedObjectsStartContract;
+  encryptedSavedObjectsPlugin: EncryptedSavedObjectsPluginStart;
 }
 
 export class AlertsClientFactory {
@@ -31,7 +31,7 @@ export class AlertsClientFactory {
   private readonly securityPluginSetup?: SecurityPluginStartContract;
   private readonly getSpaceId: (request: Hapi.Request) => string | undefined;
   private readonly spaceIdToNamespace: SpaceIdToNamespaceFunction;
-  private readonly encryptedSavedObjectsPlugin: EncryptedSavedObjectsStartContract;
+  private readonly encryptedSavedObjectsPlugin: EncryptedSavedObjectsPluginStart;
 
   constructor(options: ConstructorOpts) {
     this.logger = options.logger;
diff --git a/x-pack/legacy/plugins/alerting/server/shim.ts b/x-pack/legacy/plugins/alerting/server/shim.ts
index 80d01ea722926..bc8b0eb863634 100644
--- a/x-pack/legacy/plugins/alerting/server/shim.ts
+++ b/x-pack/legacy/plugins/alerting/server/shim.ts
@@ -15,10 +15,10 @@ import { getTaskManagerSetup, getTaskManagerStart } from '../../task_manager/ser
 import { XPackMainPlugin } from '../../xpack_main/server/xpack_main';
 import KbnServer from '../../../../../src/legacy/server/kbn_server';
 import {
-  PluginSetupContract as EncryptedSavedObjectsSetupContract,
-  PluginStartContract as EncryptedSavedObjectsStartContract,
+  EncryptedSavedObjectsPluginSetup,
+  EncryptedSavedObjectsPluginStart,
 } from '../../../../plugins/encrypted_saved_objects/server';
-import { PluginSetupContract as SecurityPlugin } from '../../../../plugins/security/server';
+import { SecurityPluginSetup } from '../../../../plugins/security/server';
 import {
   CoreSetup,
   LoggerFactory,
@@ -44,8 +44,8 @@ export interface Server extends Legacy.Server {
 /**
  * Shim what we're thinking setup and start contracts will look like
  */
-export type SecurityPluginSetupContract = Pick<SecurityPlugin, '__legacyCompat'>;
-export type SecurityPluginStartContract = Pick<SecurityPlugin, 'authc'>;
+export type SecurityPluginSetupContract = Pick<SecurityPluginSetup, '__legacyCompat'>;
+export type SecurityPluginStartContract = Pick<SecurityPluginSetup, 'authc'>;
 export type XPackMainPluginSetupContract = Pick<XPackMainPlugin, 'registerFeature'>;
 
 /**
@@ -71,14 +71,14 @@ export interface AlertingPluginsSetup {
   taskManager: TaskManagerSetupContract;
   actions: ActionsPluginSetupContract;
   xpack_main: XPackMainPluginSetupContract;
-  encryptedSavedObjects: EncryptedSavedObjectsSetupContract;
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup;
   licensing: LicensingPluginSetup;
 }
 export interface AlertingPluginsStart {
   actions: ActionsPluginStartContract;
   security?: SecurityPluginStartContract;
   spaces: () => SpacesPluginStartContract | undefined;
-  encryptedSavedObjects: EncryptedSavedObjectsStartContract;
+  encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
   taskManager: TaskManagerStartContract;
 }
 
@@ -120,7 +120,7 @@ export function shim(
     actions: newPlatform.setup.plugins.actions as ActionsPluginSetupContract,
     xpack_main: server.plugins.xpack_main,
     encryptedSavedObjects: newPlatform.setup.plugins
-      .encryptedSavedObjects as EncryptedSavedObjectsSetupContract,
+      .encryptedSavedObjects as EncryptedSavedObjectsPluginSetup,
     licensing: newPlatform.setup.plugins.licensing as LicensingPluginSetup,
   };
 
@@ -131,7 +131,7 @@ export function shim(
     // initializes after this function is called
     spaces: () => server.plugins.spaces,
     encryptedSavedObjects: newPlatform.start.plugins
-      .encryptedSavedObjects as EncryptedSavedObjectsStartContract,
+      .encryptedSavedObjects as EncryptedSavedObjectsPluginStart,
     taskManager: getTaskManagerStart(server)!,
   };
 
diff --git a/x-pack/legacy/plugins/alerting/server/task_runner/task_runner_factory.ts b/x-pack/legacy/plugins/alerting/server/task_runner/task_runner_factory.ts
index 67fef33b69c6d..d2ecfb64c8a81 100644
--- a/x-pack/legacy/plugins/alerting/server/task_runner/task_runner_factory.ts
+++ b/x-pack/legacy/plugins/alerting/server/task_runner/task_runner_factory.ts
@@ -5,7 +5,7 @@
  */
 import { Logger } from '../../../../../../src/core/server';
 import { RunContext } from '../../../../../plugins/task_manager/server';
-import { PluginStartContract as EncryptedSavedObjectsStartContract } from '../../../../../plugins/encrypted_saved_objects/server';
+import { EncryptedSavedObjectsPluginStart } from '../../../../../plugins/encrypted_saved_objects/server';
 import { PluginStartContract as ActionsPluginStartContract } from '../../../../../plugins/actions/server';
 import {
   AlertType,
@@ -19,7 +19,7 @@ export interface TaskRunnerContext {
   logger: Logger;
   getServices: GetServicesFunction;
   executeAction: ActionsPluginStartContract['execute'];
-  encryptedSavedObjectsPlugin: EncryptedSavedObjectsStartContract;
+  encryptedSavedObjectsPlugin: EncryptedSavedObjectsPluginStart;
   spaceIdToNamespace: SpaceIdToNamespaceFunction;
   getBasePath: GetBasePathFunction;
 }
diff --git a/x-pack/legacy/plugins/encrypted_saved_objects/index.ts b/x-pack/legacy/plugins/encrypted_saved_objects/index.ts
index 69058a7a33f59..ce343dba006cf 100644
--- a/x-pack/legacy/plugins/encrypted_saved_objects/index.ts
+++ b/x-pack/legacy/plugins/encrypted_saved_objects/index.ts
@@ -6,7 +6,7 @@
 
 import { Root } from 'joi';
 import { Legacy } from 'kibana';
-import { PluginSetupContract } from '../../../plugins/encrypted_saved_objects/server';
+import { EncryptedSavedObjectsPluginSetup } from '../../../plugins/encrypted_saved_objects/server';
 // @ts-ignore
 import { AuditLogger } from '../../server/lib/audit_logger';
 
@@ -29,7 +29,7 @@ export const encryptedSavedObjects = (kibana: {
 
     init(server: Legacy.Server) {
       const encryptedSavedObjectsPlugin = (server.newPlatform.setup.plugins
-        .encryptedSavedObjects as unknown) as PluginSetupContract;
+        .encryptedSavedObjects as unknown) as EncryptedSavedObjectsPluginSetup;
       if (!encryptedSavedObjectsPlugin) {
         throw new Error('New Platform XPack EncryptedSavedObjects plugin is not available.');
       }
diff --git a/x-pack/legacy/plugins/reporting/index.ts b/x-pack/legacy/plugins/reporting/index.ts
index d2a68e309a4b3..966e4ff209ad6 100644
--- a/x-pack/legacy/plugins/reporting/index.ts
+++ b/x-pack/legacy/plugins/reporting/index.ts
@@ -9,7 +9,7 @@ import { Legacy } from 'kibana';
 import { IUiSettingsClient } from 'kibana/server';
 import { resolve } from 'path';
 import { PluginStart as DataPluginStart } from '../../../../src/plugins/data/server';
-import { PluginSetupContract as SecurityPluginSetup } from '../../../plugins/security/server';
+import { SecurityPluginSetup } from '../../../plugins/security/server';
 import { PLUGIN_ID, UI_SETTINGS_CUSTOM_PDF_LOGO } from './common/constants';
 import { config as reportingConfig } from './config';
 import { LegacySetup, ReportingPlugin, reportingPluginFactory } from './server/plugin';
diff --git a/x-pack/legacy/plugins/reporting/server/plugin.ts b/x-pack/legacy/plugins/reporting/server/plugin.ts
index a2938d442f7df..e618d23e8ed1f 100644
--- a/x-pack/legacy/plugins/reporting/server/plugin.ts
+++ b/x-pack/legacy/plugins/reporting/server/plugin.ts
@@ -14,7 +14,7 @@ import {
 } from 'src/core/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { PluginStart as DataPluginStart } from '../../../../../src/plugins/data/server';
-import { PluginSetupContract as SecurityPluginSetup } from '../../../../plugins/security/server';
+import { SecurityPluginSetup } from '../../../../plugins/security/server';
 // @ts-ignore
 import { mirrorPluginStatus } from '../../../server/lib/mirror_plugin_status';
 import { XPackMainPlugin } from '../../xpack_main/server/xpack_main';
diff --git a/x-pack/legacy/plugins/siem/public/pages/common/translations.ts b/x-pack/legacy/plugins/siem/public/pages/common/translations.ts
index 3e20338375616..072aee50d5136 100644
--- a/x-pack/legacy/plugins/siem/public/pages/common/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/common/translations.ts
@@ -12,7 +12,7 @@ export const EMPTY_TITLE = i18n.translate('xpack.siem.pages.common.emptyTitle',
 
 export const EMPTY_MESSAGE = i18n.translate('xpack.siem.pages.common.emptyMessage', {
   defaultMessage:
-    'To begin using security information and event management, you’ll need to begin adding SIEM-related data to Kibana by installing and configuring our data shippers, called Beats. Let’s do that now!',
+    'To begin using security information and event management (SIEM), you’ll need to add SIEM-related data, in Elastic Common Schema (ECS) format, to the Elastic Stack. An easy way to get started is by installing and configuring our data shippers, called Beats. Let’s do that now!',
 });
 
 export const EMPTY_ACTION_PRIMARY = i18n.translate('xpack.siem.pages.common.emptyActionPrimary', {
diff --git a/x-pack/legacy/plugins/siem/server/plugin.ts b/x-pack/legacy/plugins/siem/server/plugin.ts
index 96eef2f44e5a0..94314367be59c 100644
--- a/x-pack/legacy/plugins/siem/server/plugin.ts
+++ b/x-pack/legacy/plugins/siem/server/plugin.ts
@@ -6,7 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { CoreSetup, PluginInitializerContext, Logger } from 'src/core/server';
-import { PluginSetupContract as SecurityPlugin } from '../../../../plugins/security/server';
+import { SecurityPluginSetup } from '../../../../plugins/security/server';
 import { PluginSetupContract as FeaturesSetupContract } from '../../../../plugins/features/server';
 import { initServer } from './init_server';
 import { compose } from './lib/compose/kibana';
@@ -17,7 +17,7 @@ import {
   ruleStatusSavedObjectType,
 } from './saved_objects';
 
-export type SiemPluginSecurity = Pick<SecurityPlugin, 'authc'>;
+export type SiemPluginSecurity = Pick<SecurityPluginSetup, 'authc'>;
 
 export interface PluginsSetup {
   features: FeaturesSetupContract;
diff --git a/x-pack/plugins/actions/server/lib/action_executor.ts b/x-pack/plugins/actions/server/lib/action_executor.ts
index be6916a74fe88..03a892a42792e 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.ts
@@ -12,7 +12,7 @@ import {
   GetServicesFunction,
   RawAction,
 } from '../types';
-import { PluginStartContract as EncryptedSavedObjectsStartContract } from '../../../encrypted_saved_objects/server';
+import { EncryptedSavedObjectsPluginStart } from '../../../encrypted_saved_objects/server';
 import { SpacesServiceSetup } from '../../../spaces/server';
 import { EVENT_LOG_ACTIONS } from '../plugin';
 import { IEvent, IEventLogger } from '../../../event_log/server';
@@ -21,7 +21,7 @@ export interface ActionExecutorContext {
   logger: Logger;
   spaces?: SpacesServiceSetup;
   getServices: GetServicesFunction;
-  encryptedSavedObjectsPlugin: EncryptedSavedObjectsStartContract;
+  encryptedSavedObjectsPlugin: EncryptedSavedObjectsPluginStart;
   actionTypeRegistry: ActionTypeRegistryContract;
   eventLogger: IEventLogger;
 }
diff --git a/x-pack/plugins/actions/server/lib/task_runner_factory.ts b/x-pack/plugins/actions/server/lib/task_runner_factory.ts
index c3e89e0c16efc..c78b43f4ef3ba 100644
--- a/x-pack/plugins/actions/server/lib/task_runner_factory.ts
+++ b/x-pack/plugins/actions/server/lib/task_runner_factory.ts
@@ -8,12 +8,12 @@ import { ActionExecutorContract } from './action_executor';
 import { ExecutorError } from './executor_error';
 import { Logger, CoreStart } from '../../../../../src/core/server';
 import { RunContext } from '../../../task_manager/server';
-import { PluginStartContract as EncryptedSavedObjectsStartContract } from '../../../encrypted_saved_objects/server';
+import { EncryptedSavedObjectsPluginStart } from '../../../encrypted_saved_objects/server';
 import { ActionTaskParams, GetBasePathFunction, SpaceIdToNamespaceFunction } from '../types';
 
 export interface TaskRunnerContext {
   logger: Logger;
-  encryptedSavedObjectsPlugin: EncryptedSavedObjectsStartContract;
+  encryptedSavedObjectsPlugin: EncryptedSavedObjectsPluginStart;
   spaceIdToNamespace: SpaceIdToNamespaceFunction;
   getBasePath: GetBasePathFunction;
   getScopedSavedObjectsClient: CoreStart['savedObjects']['getScopedClient'];
diff --git a/x-pack/plugins/actions/server/plugin.ts b/x-pack/plugins/actions/server/plugin.ts
index cb0e3347541fd..dab09fc455ecf 100644
--- a/x-pack/plugins/actions/server/plugin.ts
+++ b/x-pack/plugins/actions/server/plugin.ts
@@ -20,8 +20,8 @@ import {
 } from '../../../../src/core/server';
 
 import {
-  PluginSetupContract as EncryptedSavedObjectsSetupContract,
-  PluginStartContract as EncryptedSavedObjectsStartContract,
+  EncryptedSavedObjectsPluginSetup,
+  EncryptedSavedObjectsPluginStart,
 } from '../../encrypted_saved_objects/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
 import { LicensingPluginSetup } from '../../licensing/server';
@@ -67,13 +67,13 @@ export interface PluginStartContract {
 
 export interface ActionsPluginsSetup {
   taskManager: TaskManagerSetupContract;
-  encryptedSavedObjects: EncryptedSavedObjectsSetupContract;
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup;
   licensing: LicensingPluginSetup;
   spaces?: SpacesPluginSetup;
   event_log: IEventLogService;
 }
 export interface ActionsPluginsStart {
-  encryptedSavedObjects: EncryptedSavedObjectsStartContract;
+  encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
   taskManager: TaskManagerStartContract;
 }
 
diff --git a/x-pack/plugins/case/server/plugin.ts b/x-pack/plugins/case/server/plugin.ts
index c52461cade058..37d087433a2ed 100644
--- a/x-pack/plugins/case/server/plugin.ts
+++ b/x-pack/plugins/case/server/plugin.ts
@@ -9,7 +9,7 @@ import { CoreSetup, Logger, PluginInitializerContext } from 'kibana/server';
 import { ConfigType } from './config';
 import { initCaseApi } from './routes/api';
 import { CaseService } from './services';
-import { PluginSetupContract as SecurityPluginSetup } from '../../security/server';
+import { SecurityPluginSetup } from '../../security/server';
 
 function createConfig$(context: PluginInitializerContext) {
   return context.config.create<ConfigType>().pipe(map(config => config));
diff --git a/x-pack/plugins/case/server/services/index.ts b/x-pack/plugins/case/server/services/index.ts
index 684d905a5c71f..531d5fa5b87e5 100644
--- a/x-pack/plugins/case/server/services/index.ts
+++ b/x-pack/plugins/case/server/services/index.ts
@@ -21,10 +21,7 @@ import {
   UpdatedCaseType,
   UpdatedCommentType,
 } from '../routes/api/types';
-import {
-  AuthenticatedUser,
-  PluginSetupContract as SecurityPluginSetup,
-} from '../../../security/server';
+import { AuthenticatedUser, SecurityPluginSetup } from '../../../security/server';
 
 interface ClientArgs {
   client: SavedObjectsClientContract;
diff --git a/x-pack/plugins/encrypted_saved_objects/server/index.ts b/x-pack/plugins/encrypted_saved_objects/server/index.ts
index 5e6edb95ec37a..3b4b91de355c7 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/index.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/index.ts
@@ -9,7 +9,7 @@ import { ConfigSchema } from './config';
 import { Plugin } from './plugin';
 
 export { EncryptedSavedObjectTypeRegistration, EncryptionError } from './crypto';
-export { PluginSetupContract, PluginStartContract } from './plugin';
+export { EncryptedSavedObjectsPluginSetup, EncryptedSavedObjectsPluginStart } from './plugin';
 
 export const config = { schema: ConfigSchema };
 export const plugin = (initializerContext: PluginInitializerContext) =>
diff --git a/x-pack/plugins/encrypted_saved_objects/server/mocks.ts b/x-pack/plugins/encrypted_saved_objects/server/mocks.ts
index 7f53f47760f12..13d7127db7835 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/mocks.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/mocks.ts
@@ -4,21 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PluginSetupContract, PluginStartContract } from './plugin';
+import { EncryptedSavedObjectsPluginSetup, EncryptedSavedObjectsPluginStart } from './plugin';
 
 function createEncryptedSavedObjectsSetupMock() {
   return {
     registerType: jest.fn(),
     __legacyCompat: { registerLegacyAPI: jest.fn() },
     usingEphemeralEncryptionKey: true,
-  } as jest.Mocked<PluginSetupContract>;
+  } as jest.Mocked<EncryptedSavedObjectsPluginSetup>;
 }
 
 function createEncryptedSavedObjectsStartMock() {
   return {
     isEncryptionError: jest.fn(),
     getDecryptedAsInternalUser: jest.fn(),
-  } as jest.Mocked<PluginStartContract>;
+  } as jest.Mocked<EncryptedSavedObjectsPluginStart>;
 }
 
 export const encryptedSavedObjectsMock = {
diff --git a/x-pack/plugins/encrypted_saved_objects/server/plugin.ts b/x-pack/plugins/encrypted_saved_objects/server/plugin.ts
index d9185251ca466..a0218c51c2723 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/plugin.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/plugin.ts
@@ -20,13 +20,13 @@ import {
 import { EncryptedSavedObjectsAuditLogger } from './audit';
 import { SavedObjectsSetup, setupSavedObjects } from './saved_objects';
 
-export interface PluginSetupContract {
+export interface EncryptedSavedObjectsPluginSetup {
   registerType: (typeRegistration: EncryptedSavedObjectTypeRegistration) => void;
   __legacyCompat: { registerLegacyAPI: (legacyAPI: LegacyAPI) => void };
   usingEphemeralEncryptionKey: boolean;
 }
 
-export interface PluginStartContract extends SavedObjectsSetup {
+export interface EncryptedSavedObjectsPluginStart extends SavedObjectsSetup {
   isEncryptionError: (error: Error) => boolean;
 }
 
@@ -59,7 +59,7 @@ export class Plugin {
     this.logger = this.initializerContext.logger.get();
   }
 
-  public async setup(core: CoreSetup): Promise<PluginSetupContract> {
+  public async setup(core: CoreSetup): Promise<EncryptedSavedObjectsPluginSetup> {
     const { config, usingEphemeralEncryptionKey } = await createConfig$(this.initializerContext)
       .pipe(first())
       .toPromise();
diff --git a/x-pack/plugins/security/server/index.ts b/x-pack/plugins/security/server/index.ts
index 17e49b8cf40d3..c0e86b289fe54 100644
--- a/x-pack/plugins/security/server/index.ts
+++ b/x-pack/plugins/security/server/index.ts
@@ -12,7 +12,7 @@ import {
   RecursiveReadonly,
 } from '../../../../src/core/server';
 import { ConfigSchema } from './config';
-import { Plugin, PluginSetupContract, PluginSetupDependencies } from './plugin';
+import { Plugin, SecurityPluginSetup, PluginSetupDependencies } from './plugin';
 
 // These exports are part of public Security plugin contract, any change in signature of exported
 // functions or removal of exports should be considered as a breaking change.
@@ -24,7 +24,7 @@ export {
   InvalidateAPIKeyParams,
   InvalidateAPIKeyResult,
 } from './authentication';
-export { PluginSetupContract };
+export { SecurityPluginSetup };
 export { AuthenticatedUser } from '../common/model';
 
 export const config: PluginConfigDescriptor<TypeOf<typeof ConfigSchema>> = {
@@ -35,7 +35,7 @@ export const config: PluginConfigDescriptor<TypeOf<typeof ConfigSchema>> = {
   ],
 };
 export const plugin: PluginInitializer<
-  RecursiveReadonly<PluginSetupContract>,
+  RecursiveReadonly<SecurityPluginSetup>,
   void,
   PluginSetupDependencies
 > = (initializerContext: PluginInitializerContext) => new Plugin(initializerContext);
diff --git a/x-pack/plugins/security/server/mocks.ts b/x-pack/plugins/security/server/mocks.ts
index d5c08d5ab1ab9..ababf12c2be60 100644
--- a/x-pack/plugins/security/server/mocks.ts
+++ b/x-pack/plugins/security/server/mocks.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PluginSetupContract } from './plugin';
+import { SecurityPluginSetup } from './plugin';
 
 import { authenticationMock } from './authentication/index.mock';
 import { authorizationMock } from './authorization/index.mock';
@@ -19,7 +19,7 @@ function createSetupMock() {
       mode: mockAuthz.mode,
     },
     registerSpacesService: jest.fn(),
-    __legacyCompat: {} as PluginSetupContract['__legacyCompat'],
+    __legacyCompat: {} as SecurityPluginSetup['__legacyCompat'],
   };
 }
 
diff --git a/x-pack/plugins/security/server/plugin.ts b/x-pack/plugins/security/server/plugin.ts
index ce682d8b30eb7..5764418234739 100644
--- a/x-pack/plugins/security/server/plugin.ts
+++ b/x-pack/plugins/security/server/plugin.ts
@@ -49,7 +49,7 @@ export interface LegacyAPI {
 /**
  * Describes public Security plugin contract returned at the `setup` stage.
  */
-export interface PluginSetupContract {
+export interface SecurityPluginSetup {
   authc: Authentication;
   authz: Pick<Authorization, 'actions' | 'checkPrivilegesWithRequest' | 'mode'>;
 
@@ -166,7 +166,7 @@ export class Plugin {
       csp: core.http.csp,
     });
 
-    return deepFreeze<PluginSetupContract>({
+    return deepFreeze<SecurityPluginSetup>({
       authc,
 
       authz: {
diff --git a/x-pack/plugins/spaces/server/lib/spaces_client/spaces_client.test.ts b/x-pack/plugins/spaces/server/lib/spaces_client/spaces_client.test.ts
index 24a994e836e87..74e75fb8f12c7 100644
--- a/x-pack/plugins/spaces/server/lib/spaces_client/spaces_client.test.ts
+++ b/x-pack/plugins/spaces/server/lib/spaces_client/spaces_client.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PluginSetupContract as SecuritySetupContract } from '../../../../security/server';
+import { SecurityPluginSetup } from '../../../../security/server';
 import { SpacesClient } from './spaces_client';
 import { ConfigType, ConfigSchema } from '../../config';
 import { GetSpacePurpose } from '../../../common/model/types';
@@ -224,17 +224,17 @@ describe('#getAll', () => {
     [
       {
         purpose: undefined,
-        expectedPrivilege: (mockAuthorization: SecuritySetupContract['authz']) =>
+        expectedPrivilege: (mockAuthorization: SecurityPluginSetup['authz']) =>
           mockAuthorization.actions.login,
       },
       {
         purpose: 'any',
-        expectedPrivilege: (mockAuthorization: SecuritySetupContract['authz']) =>
+        expectedPrivilege: (mockAuthorization: SecurityPluginSetup['authz']) =>
           mockAuthorization.actions.login,
       },
       {
         purpose: 'copySavedObjectsIntoSpace',
-        expectedPrivilege: (mockAuthorization: SecuritySetupContract['authz']) =>
+        expectedPrivilege: (mockAuthorization: SecurityPluginSetup['authz']) =>
           mockAuthorization.actions.ui.get('savedObjectsManagement', 'copyIntoSpace'),
       },
     ].forEach(scenario => {
diff --git a/x-pack/plugins/spaces/server/lib/spaces_client/spaces_client.ts b/x-pack/plugins/spaces/server/lib/spaces_client/spaces_client.ts
index f964ae7d7ac32..22c34c03368e3 100644
--- a/x-pack/plugins/spaces/server/lib/spaces_client/spaces_client.ts
+++ b/x-pack/plugins/spaces/server/lib/spaces_client/spaces_client.ts
@@ -6,7 +6,7 @@
 import Boom from 'boom';
 import { omit } from 'lodash';
 import { KibanaRequest } from 'src/core/server';
-import { PluginSetupContract as SecurityPluginSetupContract } from '../../../../security/server';
+import { SecurityPluginSetup } from '../../../../security/server';
 import { isReservedSpace } from '../../../common/is_reserved_space';
 import { Space } from '../../../common/model/space';
 import { SpacesAuditLogger } from '../audit_logger';
@@ -17,7 +17,7 @@ const SUPPORTED_GET_SPACE_PURPOSES: GetSpacePurpose[] = ['any', 'copySavedObject
 
 const PURPOSE_PRIVILEGE_MAP: Record<
   GetSpacePurpose,
-  (authorization: SecurityPluginSetupContract['authz']) => string
+  (authorization: SecurityPluginSetup['authz']) => string
 > = {
   any: authorization => authorization.actions.login,
   copySavedObjectsIntoSpace: authorization =>
@@ -28,7 +28,7 @@ export class SpacesClient {
   constructor(
     private readonly auditLogger: SpacesAuditLogger,
     private readonly debugLogger: (message: string) => void,
-    private readonly authorization: SecurityPluginSetupContract['authz'] | null,
+    private readonly authorization: SecurityPluginSetup['authz'] | null,
     private readonly callWithRequestSavedObjectRepository: any,
     private readonly config: ConfigType,
     private readonly internalSavedObjectRepository: any,
diff --git a/x-pack/plugins/spaces/server/plugin.ts b/x-pack/plugins/spaces/server/plugin.ts
index b8ef81c05f7aa..52ff7eaee3d68 100644
--- a/x-pack/plugins/spaces/server/plugin.ts
+++ b/x-pack/plugins/spaces/server/plugin.ts
@@ -14,7 +14,7 @@ import {
   PluginInitializerContext,
 } from '../../../../src/core/server';
 import { PluginSetupContract as FeaturesPluginSetup } from '../../features/server';
-import { PluginSetupContract as SecurityPluginSetup } from '../../security/server';
+import { SecurityPluginSetup } from '../../security/server';
 import { LicensingPluginSetup } from '../../licensing/server';
 import { XPackMainPlugin } from '../../../legacy/plugins/xpack_main/server/xpack_main';
 import { createDefaultSpace } from './lib/create_default_space';
diff --git a/x-pack/plugins/spaces/server/spaces_service/spaces_service.ts b/x-pack/plugins/spaces/server/spaces_service/spaces_service.ts
index f8ed58fa57551..95bda96d89461 100644
--- a/x-pack/plugins/spaces/server/spaces_service/spaces_service.ts
+++ b/x-pack/plugins/spaces/server/spaces_service/spaces_service.ts
@@ -8,7 +8,7 @@ import { map, take } from 'rxjs/operators';
 import { Observable, Subscription } from 'rxjs';
 import { Legacy } from 'kibana';
 import { Logger, KibanaRequest, CoreSetup } from '../../../../../src/core/server';
-import { PluginSetupContract as SecurityPluginSetup } from '../../../security/server';
+import { SecurityPluginSetup } from '../../../security/server';
 import { LegacyAPI } from '../plugin';
 import { SpacesClient } from '../lib/spaces_client';
 import { ConfigType } from '../config';
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/aad/index.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/aad/index.ts
index d7bee93f5c94b..7194c642e7015 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/aad/index.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/aad/index.ts
@@ -8,7 +8,7 @@ import Joi from 'joi';
 import Hapi from 'hapi';
 import { Legacy } from 'kibana';
 import KbnServer from '../../../../../../../src/legacy/server/kbn_server';
-import { PluginStartContract } from '../../../../../../plugins/encrypted_saved_objects/server';
+import { EncryptedSavedObjectsPluginStart } from '../../../../../../plugins/encrypted_saved_objects/server';
 
 interface CheckAADRequest extends Hapi.Request {
   payload: {
@@ -25,7 +25,8 @@ export default function(kibana: any) {
     name: 'aad-fixtures',
     init(server: Legacy.Server) {
       const newPlatform = ((server as unknown) as KbnServer).newPlatform;
-      const esoPlugin = newPlatform.start.plugins.encryptedSavedObjects as PluginStartContract;
+      const esoPlugin = newPlatform.start.plugins
+        .encryptedSavedObjects as EncryptedSavedObjectsPluginStart;
 
       server.route({
         method: 'POST',
diff --git a/x-pack/test/plugin_api_integration/plugins/encrypted_saved_objects/index.ts b/x-pack/test/plugin_api_integration/plugins/encrypted_saved_objects/index.ts
index a194e477da755..e61b8f24a1f69 100644
--- a/x-pack/test/plugin_api_integration/plugins/encrypted_saved_objects/index.ts
+++ b/x-pack/test/plugin_api_integration/plugins/encrypted_saved_objects/index.ts
@@ -8,8 +8,8 @@ import { Request } from 'hapi';
 import { boomify, badRequest } from 'boom';
 import { Legacy } from 'kibana';
 import {
-  PluginSetupContract,
-  PluginStartContract,
+  EncryptedSavedObjectsPluginSetup,
+  EncryptedSavedObjectsPluginStart,
 } from '../../../../plugins/encrypted_saved_objects/server';
 
 const SAVED_OBJECT_WITH_SECRET_TYPE = 'saved-object-with-secret';
@@ -26,7 +26,7 @@ export default function esoPlugin(kibana: any) {
         path: '/api/saved_objects/get-decrypted-as-internal-user/{id}',
         async handler(request: Request) {
           const encryptedSavedObjectsStart = server.newPlatform.start.plugins
-            .encryptedSavedObjects as PluginStartContract;
+            .encryptedSavedObjects as EncryptedSavedObjectsPluginStart;
           const namespace = server.plugins.spaces && server.plugins.spaces.getSpaceId(request);
           try {
             return await encryptedSavedObjectsStart.getDecryptedAsInternalUser(
@@ -44,7 +44,8 @@ export default function esoPlugin(kibana: any) {
         },
       });
 
-      (server.newPlatform.setup.plugins.encryptedSavedObjects as PluginSetupContract).registerType({
+      (server.newPlatform.setup.plugins
+        .encryptedSavedObjects as EncryptedSavedObjectsPluginSetup).registerType({
         type: SAVED_OBJECT_WITH_SECRET_TYPE,
         attributesToEncrypt: new Set(['privateProperty']),
         attributesToExcludeFromAAD: new Set(['publicPropertyExcludedFromAAD']),