The cybersecurity glossary.

Fraudulent messages that impersonate a trusted sender to trick people into revealing information, sending money, or installing malware. It remains the most common entry point for breaches because it targets human trust rather than technical flaws.

A highly targeted form of phishing aimed at a specific person or organisation, using personalised details to seem convincing. Because it's tailored to the victim, it is far harder to spot than a generic scam email.

A spear-phishing attack aimed specifically at senior executives whose access and authority make them especially valuable targets. The messages often mimic legal, financial, or board-level communications.

Phishing carried out over SMS text messages, often using fake delivery notices, bank alerts, or prize offers with malicious links. The informal nature of texting makes these especially effective.

Voice phishing conducted over phone calls, where an attacker impersonates a bank, IT support, or authority figure to extract information or payments. Caller-ID spoofing often makes the call appear legitimate.

Manipulating people rather than technology, using deception, urgency, or authority to get them to break normal security practices. It underpins many attacks because humans are often the easiest layer to exploit.

A social-engineering technique in which the attacker invents a believable scenario or false identity to justify a request for information or access. For example, posing as an auditor who needs account details.

Luring a victim with something enticing, such as a free download or a USB stick left in a car park, that actually delivers malware when used. It exploits curiosity and the appeal of getting something for nothing.

An attack that overwhelms a system, service, or network so it can no longer serve legitimate users. The goal is disruption rather than data theft.

A denial-of-service attack launched from many compromised machines at once, flooding the target with traffic that is difficult to filter. The distributed source makes it far more powerful and harder to stop.

An attacker secretly positions themselves between two communicating parties to eavesdrop on or alter the data being exchanged. Public Wi-Fi and unencrypted connections are common opportunities.

Inserting malicious input into a database query so an attacker can read, modify, or delete data they should not be able to reach. It is one of the oldest and most damaging web vulnerabilities.

Injecting malicious scripts into a web page so they execute in other users' browsers, stealing sessions, data, or credentials. It exploits pages that fail to sanitise user-supplied content.

Tricking a logged-in user's browser into sending an unwanted request to a site they are authenticated on, performing actions without their consent. Anti-CSRF tokens are the standard defence.

Manipulating a server into making requests to unintended destinations, such as internal systems or cloud metadata endpoints an attacker cannot reach directly. It can expose otherwise-hidden infrastructure.

Systematically trying enormous numbers of passwords or keys until the correct one is found. Long, unique, complex credentials make this approach impractically slow.

A brute-force variant that tries words and common passwords from a prepared list rather than every possible combination. It works because so many people choose predictable passwords.

Taking username-and-password pairs leaked in one breach and trying them automatically across many other sites. It succeeds because people reuse the same credentials everywhere.

Trying a few common passwords against many accounts, rather than many passwords against one, to avoid triggering lockouts. It quietly exploits weak, popular passwords at scale.

Stealing or forging a user's session identifier to take over their authenticated session without needing their password. Secure, expiring, encrypted session tokens reduce the risk.

Tricking a user into clicking something different from what they perceive, often by layering an invisible frame over a legitimate page. It can cause unintended actions like approving a transfer.

Faking an identity, such as an email address, phone number, IP, or website, to appear trustworthy and deceive the target. It is a building block of many phishing and network attacks.

Corrupting DNS responses so a domain name resolves to an attacker-controlled address instead of the legitimate one. Victims are silently redirected to malicious sites.

Sending falsified address-resolution messages on a local network to associate the attacker's device with another's IP. It enables eavesdropping and man-in-the-middle attacks on the same network.

An attack exploiting a vulnerability unknown to the vendor, meaning no patch exists yet and defenders have zero days to prepare. These are prized by attackers for their reliability.

Compromising a website known to be frequented by the intended victims, so they infect themselves simply by visiting. It is used when targets are hard to reach directly.

Compromising a trusted vendor, library, or update mechanism to reach that supplier's many customers at once. A single breach can cascade across thousands of organisations.

Gaining higher access rights than originally granted, turning a limited foothold into administrator-level control. It is a key step in turning a small breach into a serious one.

Techniques an attacker uses to move from one compromised system to others across a network, expanding their reach. Detecting it early can contain a breach before it spreads.

Manipulating file paths in a request to access files outside the intended directory, such as configuration or password files. It exploits poor input validation on the server.

Injecting operating-system commands through a vulnerable application so they run on the underlying server. It can hand an attacker direct control of the host.

A security risk originating from within an organisation, whether a malicious, negligent, or compromised employee or contractor. Trusted access makes insiders particularly dangerous.

A well-resourced, stealthy adversary, often state-sponsored, that maintains long-term access to a target while avoiding detection. The focus is persistence and espionage rather than quick gain.

Malware that installs automatically when a user simply visits a compromised or malicious web page, with no click required. It exploits unpatched browsers and plugins.

Registering domain names that are common misspellings of popular sites to catch users who mistype a URL. The lookalike pages are used for phishing or malware delivery.

A precomputed table of hash values used to reverse password hashes quickly. Adding a unique salt to each password defeats this technique.

Recording every keystroke a victim types to capture passwords, messages, and other sensitive input. It can be delivered by malware or, more rarely, hardware devices.

Passively intercepting network traffic to capture sensitive information as it travels. Encryption is the primary defence against it.

Forcing a user to use a session identifier the attacker already knows, so their session can be hijacked after login. Regenerating the session ID at login prevents it.

A catch-all term for malicious software designed to damage, disrupt, spy on, or gain unauthorised access to systems. It includes viruses, worms, trojans, ransomware, and more.

Malicious code that attaches itself to legitimate files or programs and spreads when those are run or shared. Like a biological virus, it needs a host to replicate.

Self-replicating malware that spreads across networks on its own, without needing a host file or user action. Its autonomous spread can be explosively fast.

Malware disguised as legitimate software to trick users into installing it, then acting maliciously once inside. Named after the wooden horse, it relies on deception rather than force.

Malware that encrypts your files or locks your systems and demands payment to restore access. Modern strains often steal data first and threaten to leak it, known as double extortion.

Software that covertly gathers information about a user or system and sends it to a third party. It can capture browsing habits, credentials, or keystrokes.

Software that automatically displays or downloads unwanted advertisements, often bundled with other programs. While frequently just annoying, it can also track users or carry malware.

Stealthy malware that embeds deep in a system to hide its presence and maintain privileged access. Its concealment makes it notoriously hard to detect and remove.

A network of compromised devices controlled remotely by an attacker, used for spam, DDoS attacks, or fraud. Each infected device is a bot unknowingly serving the operator.

Malicious code that lies dormant until triggered by a specific condition, such as a date or an employee being removed. It is sometimes planted by disgruntled insiders.

Malware that operates in memory and abuses legitimate system tools, leaving little or no trace on disk. Its lack of files makes traditional antivirus far less effective.

Secretly hijacking a device's computing power to mine cryptocurrency for the attacker. Victims typically notice only slowdowns, higher bills, or overheating.

Destructive malware whose purpose is to erase or corrupt data permanently rather than to profit. It is often used for sabotage or to cover an attacker's tracks.

A hidden method of bypassing normal authentication to access a system, left by an attacker or built into software. It provides quiet, repeated re-entry.

Software that uses fake alarming warnings, such as bogus virus alerts, to frighten users into buying or installing something harmful. It preys on panic.

A trojan that gives an attacker full remote control over an infected device, as if sitting at the keyboard. It can watch, record, and manipulate the system at will.

Malware written in the macro language of applications like word processors or spreadsheets, triggered when an infected document is opened. Disabling untrusted macros is the key defence.

Malware that constantly changes its own code to evade signature-based detection while keeping the same function. Each copy looks different to antivirus tools.

A barrier that monitors and filters network traffic against a set of rules, blocking unauthorised connections in or out. It is a foundational network defence.

A firewall that adds deeper capabilities such as application awareness, intrusion prevention, and threat intelligence. It inspects traffic far more intelligently than a traditional firewall.

A filter that sits in front of a web application and blocks malicious HTTP requests, mitigating attacks like injection and XSS. It protects specifically at the application layer.

A system that monitors network or host activity for signs of malicious behaviour and raises alerts. It detects intrusions but does not block them itself.

Like an IDS, but able to actively block or drop malicious traffic as it is detected. It moves from warning to stopping threats in real time.

Software that detects, quarantines, and removes known malware, traditionally using signatures of previously seen threats. It remains a useful baseline layer of defence.

Tools that continuously monitor devices for suspicious behaviour and give responders the means to investigate and contain threats. It goes well beyond signature-based antivirus.

An approach that unifies detection and response across endpoints, networks, email, and cloud into a single view. It aims to catch threats that span multiple layers.

Security Information and Event Management software aggregates and analyses log data from across an organisation to spot and investigate threats. It is the nerve centre of many security teams.

Security Orchestration, Automation and Response tools automate repetitive security tasks and coordinate incident response. They help small teams handle large volumes of alerts.

Requiring two or more independent proofs of identity to log in, so a stolen password alone is not enough. It is one of the single most effective account protections.

A form of multi-factor authentication that specifically combines exactly two factors, such as a password and a phone code. It dramatically reduces the risk of account takeover.

A system that lets users authenticate once and gain access to many applications without logging in again. It improves usability and centralises access control.

A service that encrypts your connection and routes it through a secure server, protecting data on untrusted networks. It also masks your IP address from the sites you visit.

Scrambling data with a key so that only authorised parties holding the key can read it. It protects information both in transit and at rest.

The disciplined process of keeping software up to date so known vulnerabilities are fixed before attackers exploit them. Delays here are behind many avoidable breaches.

An authorised, simulated attack by security specialists to find and prove exploitable weaknesses, then report how to fix them. See penetration testing services for how this works in practice.

A broad, largely automated scan that identifies and catalogues known weaknesses across systems. It provides breadth, complementing the depth of a penetration test.

Security professionals who play the attacker, testing defences with realistic adversarial tactics. Their job is to find what a real attacker would.

The defenders responsible for detecting, responding to, and preventing attacks. They build and operate an organisation's protective measures.

A collaborative approach where red and blue teams work together, sharing findings to improve defences faster. It blends offence and defence for mutual benefit.

The principle of granting users and systems only the minimum access they need to do their job. It limits how far any single compromise can spread.

Dividing a network into isolated zones so that a breach in one area cannot freely reach the rest. It contains attackers and limits damage.

Running untrusted code or files in an isolated environment where they cannot affect the wider system. It is used to safely analyse suspicious programs.

A decoy system deliberately made attractive to attackers, used to detect, study, or divert them. Any interaction with it is inherently suspicious.

Tools and policies that detect and stop sensitive data from leaving an organisation improperly. They guard against both accidental and malicious leaks.

Copies of data kept so it can be restored after loss, corruption, or a ransomware attack. Backups are only trustworthy if they are isolated and regularly tested.

Granting permissions based on a user's role rather than to individuals one by one. It simplifies management and enforces consistency.

Educating staff to recognise and resist threats like phishing and social engineering. Since people are a common target, informed users are a powerful defence.

A program that rewards independent researchers for responsibly reporting security flaws. It harnesses outside expertise to find issues before attackers do.

Proactively searching systems for signs of hidden threats that automated tools may have missed. It assumes attackers may already be inside and goes looking.

Physically isolating a system from unsecured networks so it has no direct connection to the internet. It is used to protect the most sensitive systems.

A security model that trusts nothing by default and verifies every user and device for every request. It replaces the old idea of a trusted internal network.

Reducing a system's attack surface by removing unnecessary features, closing unused ports, and tightening configuration. A hardened system offers attackers fewer openings.

Capping how many requests a user or client can make in a given time to blunt brute-force and abuse. It slows attackers without blocking legitimate use.

Temporarily disabling an account after too many failed login attempts to frustrate guessing attacks. It must be balanced to avoid enabling denial of service.

A weakness in a system, application, or process that could be exploited to compromise security. It is the open window an attacker looks for.

The technique or piece of code that takes advantage of a vulnerability to cause harm. If the vulnerability is the open window, the exploit is climbing through it.

Any potential cause of an unwanted security incident, whether a person, event, or circumstance. Threats become dangerous when paired with a vulnerability.

The combination of how likely a threat is to exploit a vulnerability and how severe the impact would be. Security work is largely about understanding and reducing risk.

The total set of points where an attacker could attempt to enter or extract data from a system. Shrinking it means fewer ways to be attacked.

The specific path or method an attacker uses to gain access, such as a phishing email or an exposed port. Each vector is a route that needs defending.

Any individual or group behind a malicious action, from lone opportunists to organised crime and nation-states. Understanding their motives helps anticipate their moves.

Common Vulnerabilities and Exposures is a public catalogue that assigns each known vulnerability a unique reference identifier. It gives everyone a common name for the same flaw.

The Common Vulnerability Scoring System rates a vulnerability's severity from 0 to 10 to help teams prioritise. Higher scores signal more urgent risk.

The part of an attack that carries out the intended malicious action once a system is compromised. Everything else exists to deliver it.

A model describing the stages of an attack, from reconnaissance through to achieving the objective. Breaking any link in the chain can stop the attack.

A piece of forensic evidence, such as an odd IP address, file hash, or log entry, that suggests a system has been breached. IoCs help detect and investigate incidents.

Tactics, Techniques, and Procedures are the characteristic behaviours of a particular attacker. Recognising them helps defenders attribute and predict attacks.

The three core goals of security: Confidentiality, Integrity, and Availability. Nearly every control serves one or more of these.

The process of verifying that someone or something is who they claim to be. It answers the question, who are you?

Determining what an authenticated user is allowed to do or access. It answers the question, what are you permitted to do?

Assurance that someone cannot deny having performed an action, typically provided by digital signatures and logs. It creates accountability.

Layering multiple, independent security controls so that if one fails, others still protect the system. No single measure is trusted to do everything.

Systematically identifying potential threats and weaknesses early in design so they can be addressed before they are built in. It is cheaper to prevent flaws than to fix them later.

A security alert that flags benign activity as malicious. Too many of them erode trust and overwhelm analysts.

A real threat that goes undetected because no alert fires. These are the dangerous misses defenders most fear.

A software update that fixes a bug or security vulnerability. Applying patches promptly is one of the simplest, highest-impact defences.

Hardware, software, or services used within an organisation without the knowledge or approval of its IT team. It creates unmanaged, often insecure, gaps.

Combining several individually minor weaknesses into one serious attack. It is why low-risk findings can still matter when linked together.

A design idea that systems should behave in ways users expect, reducing dangerous mistakes. Surprising behaviour often leads to insecure workarounds.

The science of securing information using mathematical techniques so it can be kept confidential and verified. It underpins almost all modern digital security.

Encryption that uses the same secret key to both encrypt and decrypt data. It is fast, but the key must be shared securely between parties.

Encryption using a mathematically linked key pair, a public key to encrypt and a private key to decrypt. It solves the problem of sharing keys safely.

The framework of certificates, authorities, and policies that manages public keys and digital identities. It lets strangers trust each other's keys online.

Converting data into a fixed-length string that cannot practically be reversed, used to verify integrity and store passwords. The same input always yields the same hash.

Random data added to a password before hashing, so that identical passwords produce different hashes. It defeats precomputed attacks like rainbow tables.

A cryptographic stamp that proves a message came from a specific sender and was not altered. It provides authenticity and non-repudiation.

A digital credential that verifies a website's identity and enables an encrypted connection. It is what puts the padlock and the s in HTTPS.

Transport Layer Security is the protocol that encrypts data as it travels between browsers and servers. It is the modern successor to SSL.

The Advanced Encryption Standard is a fast and widely trusted symmetric encryption algorithm. It secures everything from Wi-Fi to disk encryption.

A foundational asymmetric algorithm used for encryption and digital signatures. Its security rests on the difficulty of factoring very large numbers.

Encryption where only the communicating users can read the messages, not even the service provider in between. It offers the strongest confidentiality for communications.

A method for two parties to agree on a shared secret key over an insecure channel. It makes private communication possible without meeting first.

A random or unique number used only once in a cryptographic operation to prevent replay. Reusing one can seriously weaken the security it provides.

The secure version of HTTP, which encrypts traffic between a browser and a website using TLS. It protects data from eavesdropping and tampering in transit.

The Domain Name System translates human-friendly domain names into the numeric IP addresses computers use. It is often called the phone book of the internet.

A numeric label that identifies a device on a network so data can be routed to it. It is how machines find one another online.

A numbered endpoint on a device that directs network traffic to the right service or application. Web traffic, for example, typically uses ports 80 and 443.

A server that sits between a client and the internet, forwarding requests on the client's behalf. It can add privacy, filtering, or caching.

A server that sits in front of web servers and forwards client requests to them, often adding load balancing and protection. It hides and shields the servers behind it.

A small unit of data transmitted over a network, containing both content and addressing information. Larger messages are split into many packets.

A small piece of data a website stores in your browser to remember information such as login state. Cookies enable sessions but can also be used to track users.

A period of interaction between a user and a system, tracked after login so the user is not repeatedly re-authenticated. Sessions must be protected against hijacking.

An Application Programming Interface lets software systems talk to each other in a defined way. Insecure APIs are an increasingly common attack target.

An open standard that lets users grant apps limited access to their accounts without sharing passwords. It is what powers log-in-with buttons.

A compact, signed token used to securely transmit identity and claims between parties. It is widely used for authentication in modern web apps.

Cross-Origin Resource Sharing is a set of browser rules controlling whether a page can request resources from a different domain. Misconfiguration can expose data.

A core browser rule that restricts how a page from one origin can interact with content from another. It is a foundational web-security boundary.

A response header that tells the browser which sources of scripts, styles, and other content are allowed. It is a strong defence against cross-site scripting.

HTTP Strict Transport Security is a header that forces browsers to use HTTPS, preventing downgrade attacks. Once set, the browser refuses plain HTTP for the site.

Network Address Translation lets many devices share a single public IP address. It also incidentally hides internal addresses from the outside.

A logical subdivision of a network that groups devices for organisation and control. Subnetting supports segmentation and efficient routing.

A device or service that distributes incoming traffic across multiple servers to improve performance and resilience. It also helps absorb traffic spikes.

A Content Delivery Network distributes copies of content across many servers worldwide so users load it from a nearby location. It speeds delivery and can absorb attacks.

A unique hardware identifier assigned to a device's network interface. It operates at a lower level than an IP address.

The core suite of protocols that governs how data is packaged, addressed, and delivered across the internet. Almost all online communication relies on it.

Meeting the security and privacy requirements set by laws, regulations, or industry standards. It demonstrates a baseline of responsible practice.

The General Data Protection Regulation is an EU law governing how personal data must be handled and protected. It carries significant penalties for breaches.

The Payment Card Industry Data Security Standard is a set of requirements for organisations that handle card payments. It aims to protect cardholder data.

An international standard for establishing and maintaining an information security management system. Certification signals a structured, audited approach to security.

A reporting framework that evaluates how well a service provider protects customer data across principles like security and availability. It is widely requested by enterprise customers.

A US law setting requirements for protecting sensitive health information. It governs how healthcare data may be stored and shared.

The organised process of preparing for, detecting, containing, and recovering from security incidents. A tested plan dramatically reduces damage.

The plans and procedures for restoring IT systems and data after a major disruptive event. It focuses on getting technology back online.

Broader planning to keep an organisation operating during and after a disruption, beyond just IT. It covers people, processes, and premises too.

The process of identifying, analysing, and prioritising risks so resources can be focused where they matter most. It turns vague worry into informed decisions.

A formal review that checks whether security controls and policies are in place and working. Audits provide independent assurance.

A contract that defines the expected level of service, including security and uptime commitments. It sets accountable, measurable expectations.

An incident where confidential data is accessed, disclosed, or stolen without authorisation. Breaches can trigger legal, financial, and reputational fallout.

The Chief Information Security Officer is the senior executive responsible for an organisation's security strategy. They bridge technical risk and business leadership.

A formal document setting out an organisation's rules and expectations for protecting its systems and data. It gives everyone a clear, consistent standard.

Governance, Risk, and Compliance is an integrated approach to aligning security with business objectives, risk appetite, and regulations. It keeps security purposeful and accountable.

Categorising data by sensitivity so appropriate protections can be applied to each level. Not all data needs the same safeguards.

Building privacy protections into systems and processes from the outset rather than bolting them on later. It makes good data handling the default.