Cybersecurity glossary

162 terms explained in plain English. Search, pick a topic, or jump to a letter.

Access control
Rules that decide who can see or do what on a system, and the mechanisms that enforce them.Identity & cryptography
Adware
Software that bombards you with ads, often bundled with free downloads. Some of it also tracks you.Malware
AES
Advanced Encryption Standard. The symmetric cipher used almost everywhere, from Wi-Fi to disk encryption.Identity & cryptography
Air gap
Physically isolating a system from other networks, including the internet, so it can’t be reached remotely.Defence & operations
Anomaly detection
Spotting behaviour that differs from what’s normal, such as a login at 3am from a new country.Defence & operations
Antivirus
Software that detects and removes known malware, traditionally by matching signatures.Defence & operations
API
Application Programming Interface. A defined way for programs to talk to each other. Exposed APIs are a common attack target.Web & cloud
APT
Advanced Persistent Threat. A skilled, well-resourced attacker, often state-backed, that breaks in quietly and stays hidden for a long time to steal data or spy.Attacks & threats
Artefact
A trace left on a system by activity, such as a log entry, a Prefetch file or a registry key, that investigators use as evidence.Forensics & analysisLearn more
Asymmetric encryption
Encryption with a pair of keys: a public key anyone can use to encrypt, and a private key only the owner uses to decrypt.Identity & cryptography
Attack surface
Every point where an attacker could try to get in: exposed services, apps, accounts, devices and people.Attacks & threats
Attack vector
The route an attacker uses to get in, such as a phishing email, an exposed service or a stolen password.Attacks & threats
Authentication
Proving you are who you say you are, for example with a password, a security key or a fingerprint.Identity & cryptography
Authorisation
Deciding what an authenticated user is allowed to do. Logging in is authentication; opening a file is authorisation.Identity & cryptography
Backdoor
A hidden way into a system that bypasses normal authentication, often left behind by malware so the attacker can return.Malware
Baseline
A record of what normal looks like for a system or network, so unusual activity stands out.Defence & operations
Beaconing
Malware regularly calling home to its command-and-control server. The steady rhythm is often how it gets caught.Forensics & analysis
Blue team
The defenders. They monitor, detect and respond to attacks and harden systems against them.Defence & operationsLearn more
Botnet
A network of infected devices controlled by one attacker, used for spam, credential stuffing or DDoS attacks.Malware
Brute force
Guessing a password or key by trying huge numbers of combinations until one works.Attacks & threats
Buffer overflow
Writing more data into a memory buffer than it can hold, spilling into neighbouring memory. Attackers use it to hijack a program.Attacks & threats
Bug bounty
A programme that pays independent researchers for responsibly reporting security flaws.Governance & careers
Business email compromise (BEC)
A scam where attackers impersonate an executive or supplier by email to trick staff into paying invoices or sending data.Attacks & threats
C2 (Command and Control)
The infrastructure attackers use to send instructions to compromised machines and receive stolen data.Malware
Certificate authority (CA)
A trusted organisation that issues digital certificates, vouching that a public key belongs to a particular website or person.Identity & cryptography
Chain of custody
A documented record of who handled evidence, when and how, so it holds up in an investigation or court.Forensics & analysisLearn more
CIA triad
Confidentiality, Integrity and Availability: the three goals almost every security control serves.Governance & careers
Cloud security posture management (CSPM)
Tools that continuously check cloud accounts for misconfigurations like public storage buckets or over-permissive roles.Web & cloud
Credential stuffing
Trying usernames and passwords leaked from one site on many others, betting that people reuse passwords.Attacks & threats
CSRF (Cross-site request forgery)
Tricking a logged-in user’s browser into sending an unwanted request, such as changing their email address.Web & cloud
CTF (Capture the Flag)
A security competition or practice challenge where you solve puzzles or hack deliberately vulnerable systems to find hidden ‘flags’.Governance & careers
CVE
Common Vulnerabilities and Exposures. A public ID (like CVE-2021-44228) given to a known security flaw so everyone can refer to it.Attacks & threats
CVSS
Common Vulnerability Scoring System. A 0 to 10 score describing how severe a vulnerability is.Attacks & threats
Cyber kill chain
A model that breaks an attack into stages, from reconnaissance to actions on objectives, so defenders can disrupt each one.Attacks & threats
Dark web
Parts of the internet reachable only through tools like Tor. Home to criminal marketplaces, leak sites and forums.Attacks & threats
Data breach
An incident where sensitive data is accessed or stolen by someone who shouldn’t have it.Attacks & threats
Data exfiltration
Moving stolen data out of a network to somewhere the attacker controls.Attacks & threats
DDoS
Distributed Denial of Service. Flooding a service with traffic from many machines so real users can’t reach it.Attacks & threats
Defence in depth
Layering several independent controls so that if one fails, others still stand in the attacker’s way.Defence & operations
DFIR
Digital Forensics and Incident Response. Investigating what happened in a breach and containing it.Forensics & analysisLearn more
Digital signature
A cryptographic stamp proving who created a file or message and that it hasn’t been changed since.Identity & cryptography
Disk image
A bit-for-bit copy of a storage device, made so investigators can examine it without touching the original.Forensics & analysis
DLP (Data Loss Prevention)
Tools and rules that stop sensitive data from leaving an organisation by email, upload or USB.Defence & operations
DMZ
A separate network zone for public-facing servers, so a compromise there doesn’t expose the internal network.Networking
DNS
Domain Name System. The internet’s phone book, translating names like example.com into IP addresses.Networking
DNS tunnelling
Hiding data or commands inside DNS queries to sneak them past firewalls.Networking
Drive-by download
Malware that installs itself just from visiting a compromised or malicious web page.Attacks & threats
Dynamic analysis
Studying malware by running it in a safe, isolated environment and watching what it does.Forensics & analysisLearn more
EDR
Endpoint Detection and Response. Software on laptops and servers that records activity, detects threats and lets responders isolate machines.Defence & operations
Encryption
Scrambling data so only someone with the right key can read it.Identity & cryptography
Endpoint
Any device that connects to a network: laptops, phones, servers, even printers.Defence & operations
Event log
A system’s record of what happened, such as logins, process starts and errors. On Windows, each event has an ID like 4624.Forensics & analysis
Exploit
Code or a technique that takes advantage of a vulnerability to make a system do something it shouldn’t.Attacks & threats
False negative
A real attack that security tools failed to flag. Far more dangerous than a false positive.Defence & operations
False positive
An alert that looks like an attack but turns out to be harmless. Weeding these out is a big part of a SOC analyst’s day.Defence & operations
Fileless malware
Malware that runs in memory or through built-in tools like PowerShell, leaving little or nothing on disk.Malware
Firewall
A control that allows or blocks network traffic based on rules.Networking
Forensic image
A verified, hashed copy of a disk or memory, taken so analysis never alters the original evidence.Forensics & analysis
GDPR
The EU’s General Data Protection Regulation, which sets rules for handling personal data and reporting breaches.Governance & careers
Hardening
Reducing a system’s attack surface by removing unused services, tightening settings and applying patches.Defence & operations
Hash
A fixed-length fingerprint of a file or text (like SHA-256). Analysts use hashes to identify known malware.Identity & cryptographyLearn more
Honeypot
A decoy system set up to attract attackers so defenders can study them or detect them early.Defence & operations
HTTPS
HTTP over TLS. The padlock in your browser: traffic between you and the site is encrypted and the site’s identity is checked.Web & cloud
IAM
Identity and Access Management. The policies and tools that control who has access to what.Identity & cryptography
IDS / IPS
Intrusion Detection System / Intrusion Prevention System. Watches traffic for attacks; an IPS can also block them.Networking
Incident response
The organised way a team prepares for, detects, contains, removes and recovers from a security incident.Defence & operationsLearn more
Infostealer
Malware that grabs saved passwords, cookies and crypto wallets from a machine and sends them to the attacker.Malware
Insider threat
Risk from people inside an organisation, whether malicious, careless or tricked.Attacks & threats
IOC (Indicator of Compromise)
Evidence that a system may have been breached, such as a malicious IP address, domain or file hash.Forensics & analysis
IP address
A number that identifies a device on a network, like 192.168.1.10 (IPv4) or 2001:db8::1 (IPv6).Networking
Jailbreak
Bypassing the restrictions on a device or an AI model to make it do things its makers blocked.Attacks & threats
Keylogger
Software or hardware that records every key you press, used to steal passwords and messages.Malware
Lateral movement
When an attacker who has broken into one machine moves on to others inside the same network.Attacks & threats
Least privilege
Giving each user and program only the access it truly needs, so a compromise does as little damage as possible.Identity & cryptography
LOLBins
Living-off-the-land binaries. Legitimate built-in tools (like certutil or PowerShell) that attackers abuse to avoid detection.Attacks & threatsLearn more
MAC address
A hardware identifier burned into a network card, used to deliver traffic on a local network.Networking
Malware
Any software designed to harm, spy on or take control of a system: viruses, worms, trojans, ransomware and more.MalwareLearn more
Man-in-the-middle (MitM)
An attacker secretly sitting between two parties, reading or changing what they send each other.Attacks & threats
Memory forensics
Analysing a capture of a computer’s RAM to find running processes, network connections and malware that never touched the disk.Forensics & analysis
MFA
Multi-factor authentication. Proving who you are with more than one thing, such as a password plus a code from your phone.Identity & cryptography
MFA fatigue
Spamming someone with login approval prompts until they tap ‘approve’ just to make them stop.Attacks & threats
MITRE ATT&CK
A free, public knowledge base of real-world attacker tactics and techniques, used by defenders to describe and detect attacks.Defence & operations
MTTD / MTTR
Mean time to detect and mean time to respond. How quickly a security team notices and deals with incidents.Defence & operations
NAT
Network Address Translation. Lets many devices share one public IP address, as your home router does.Networking
OSINT
Open-Source Intelligence. Intelligence gathered from publicly available information like websites, social media and public records.Forensics & analysisLearn more
OWASP Top 10
A regularly updated list of the most critical web application security risks.Web & cloud
Packet
A small chunk of data sent across a network, with headers saying where it came from and where it’s going.Networking
Packet capture (PCAP)
A recording of network traffic, usually opened in Wireshark to see exactly what was sent.Networking
Passkey
A phishing-resistant replacement for passwords that uses a key pair stored on your device.Identity & cryptography
Password manager
An app that generates and stores a unique, strong password for every site, so you only remember one.Identity & cryptography
Password spraying
Trying a few common passwords against many accounts, staying under lockout limits.Attacks & threats
Patch
An update that fixes a bug or security vulnerability.Defence & operations
Payload
The part of an attack that does the damage, such as the ransomware an exploit delivers.Malware
Penetration test
An authorised, simulated attack on a system to find weaknesses before real attackers do.Governance & careers
Persistence
Techniques attackers use to survive reboots and keep access, like scheduled tasks or registry run keys.Attacks & threats
Phishing
Tricking people into clicking a link, opening a file or handing over credentials, usually by email or message.Attacks & threatsLearn more
PKI
Public Key Infrastructure. The certificates, authorities and rules that let us trust public keys at scale.Identity & cryptography
Playbook
A step-by-step guide for handling a specific type of alert or incident, so responses are fast and consistent.Defence & operations
Port
A numbered endpoint on a device for a particular service, such as 443 for HTTPS or 22 for SSH.Networking
Port scan
Probing a host to see which ports are open and what’s listening. Nmap is the classic tool.Networking
Prefetch
Windows files that record which programs ran and when. A goldmine for forensic investigators.Forensics & analysisLearn more
Privilege escalation
Gaining higher permissions than you started with, for example going from a normal user to administrator or root.Attacks & threats
Prompt injection
Hiding instructions in content an AI system reads, to make it ignore its rules or leak data.Attacks & threats
Proxy
A server that forwards traffic on your behalf, used for filtering, caching, privacy or intercepting web requests in testing.Networking
Purple team
Red and blue teams working together, testing attacks and tuning detections side by side.Defence & operations
Ransomware
Malware that encrypts files and demands payment for the key, often while also threatening to leak stolen data.Malware
RAT (Remote Access Trojan)
Malware that gives an attacker full remote control of a machine, usually without the owner noticing.Malware
RDP
Remote Desktop Protocol. Windows remote access that, left exposed to the internet, is a favourite ransomware entry point.Networking
Reconnaissance
The information-gathering phase of an attack: finding people, systems and weaknesses to target.Attacks & threats
Red team
Attackers working for the organisation. They emulate real adversaries to test how well defences hold up.Governance & careers
Responsible disclosure
Reporting a vulnerability privately to the vendor and giving them time to fix it before going public.Governance & careers
Reverse engineering
Taking compiled software apart to understand how it works, often to analyse malware.Forensics & analysis
Reverse shell
A connection from a compromised machine back to the attacker, giving them a command line that slips past inbound firewall rules.Attacks & threats
Risk
The chance that a threat exploits a vulnerability, multiplied by how bad the result would be.Governance & careers
Rootkit
Malware that hides deep in the operating system to conceal itself and other malicious activity.Malware
Salt
Random data added to a password before hashing, so identical passwords produce different hashes and precomputed tables don’t work.Identity & cryptography
Sandbox
An isolated environment where suspicious files can be run safely without affecting real systems.Defence & operations
Security awareness training
Teaching staff to recognise phishing, handle data safely and report anything suspicious.Governance & careers
Segmentation
Splitting a network into zones so an attacker who gets into one can’t easily reach the rest.Networking
Session hijacking
Stealing a logged-in user’s session token so you can act as them without needing their password.Web & cloud
Shadow IT
Apps and devices staff use without the IT or security team’s knowledge or approval.Governance & careers
SIEM
Security Information and Event Management. A platform that collects logs from across an organisation and raises alerts on suspicious patterns.Defence & operations
Signature
A known pattern, like a hash or byte sequence, that security tools match to recognise a specific threat.Defence & operations
Smishing
Phishing by SMS text message, often posing as a delivery company or bank.Attacks & threatsLearn more
SOAR
Security Orchestration, Automation and Response. Tools that automate repetitive SOC tasks like enriching alerts or blocking IPs.Defence & operations
SOC
Security Operations Centre. The team that monitors an organisation around the clock and responds to security alerts.Defence & operationsLearn more
Social engineering
Manipulating people, rather than machines, into breaking security rules or giving away information.Attacks & threats
Spear phishing
Phishing aimed at a specific person, using details about them to make the message convincing.Attacks & threats
Spoofing
Faking the source of something, such as an email sender, caller ID or IP address, to appear trustworthy.Attacks & threats
Spyware
Malware that secretly watches what you do and sends it to someone else.Malware
SQL injection
A web attack where malicious input tricks an application into running unintended database commands.Web & cloud
SSH
Secure Shell. An encrypted way to log in to and run commands on a remote machine.Networking
Static analysis
Examining a file without running it: its strings, hashes, structure and code.Forensics & analysisLearn more
Supply chain attack
Compromising a trusted supplier, such as a software update or library, to reach all of its customers at once.Attacks & threats
Symmetric encryption
Encryption where the same key locks and unlocks the data. Fast, but both sides need to share the key safely.Identity & cryptography
Tabletop exercise
A discussion-based rehearsal where a team walks through how they would handle an imagined incident.Governance & careers
TCP / UDP
The two main transport protocols. TCP guarantees delivery and order; UDP is faster but makes no promises.Networking
Threat actor
The person or group behind an attack, from lone criminals to nation-state teams.Attacks & threats
Threat hunting
Proactively searching for attackers who have slipped past automated detection.Defence & operations
Threat intelligence
Information about attackers, their tools and their targets that helps defenders prioritise and detect threats.Defence & operations
Threat model
A structured look at what you’re protecting, from whom, and how they might attack it.Governance & careers
Timeline analysis
Putting every recovered event in time order to reconstruct exactly what happened during an incident.Forensics & analysis
TLS
Transport Layer Security. The protocol that encrypts web traffic, email and much more in transit.Identity & cryptography
Tor
A network that routes traffic through several volunteer relays to hide where it came from.Networking
Triage
Quickly deciding whether an alert is real, how serious it is and who should handle it.Defence & operationsLearn more
Trojan
Malware disguised as legitimate software to trick people into running it.Malware
TTPs
Tactics, techniques and procedures. How a particular attacker tends to operate, which is harder to change than an IP address.Attacks & threats
Typosquatting
Registering look-alike domains or package names (like g00gle.com) to catch people’s typos.Attacks & threats
Vishing
Voice phishing: scam phone calls that pose as banks, support desks or colleagues.Attacks & threats
VPN
Virtual Private Network. An encrypted tunnel between your device and another network.Networking
Vulnerability
A weakness in software, hardware or a process that an attacker could exploit.Attacks & threats
Vulnerability scan
An automated check of systems against a database of known vulnerabilities and misconfigurations.Defence & operations
WAF
Web Application Firewall. Filters HTTP traffic to block attacks like SQL injection and XSS before they reach an app.Web & cloud
Watering hole attack
Compromising a website a target group often visits, then infecting them when they drop by.Attacks & threats
Whaling
Spear phishing aimed at senior executives, often to authorise large payments.Attacks & threats
Wiper
Malware built purely to destroy data, sometimes disguised as ransomware.Malware
Worm
Malware that spreads from machine to machine on its own, without anyone having to run it.Malware
XDR
Extended Detection and Response. EDR’s bigger sibling, correlating data from endpoints, email, network and cloud.Defence & operations
XSS (Cross-site scripting)
A web attack that injects malicious scripts into pages other users will view.Web & cloud
YARA
A rule language for describing and detecting malware by its patterns, used widely by analysts.Forensics & analysis
Zero trust
A security model that never trusts a request just because it comes from inside the network. Every access is verified.Defence & operations
Zero-day
A vulnerability attackers know about before the vendor has a fix, leaving defenders zero days to prepare.Attacks & threats