Cyber security terminology can be difficult to navigate. This glossary explains common cyber security terms, threats, technologies and approaches in clear, straightforward language.
Cyber security terms A to Z
Account takeover
When an attacker gains control of someone else's online account. It usually happens through stolen passwords, phishing, malware or a hijacked login session. Once inside, the attacker can steal information, pose as the account holder, change security settings, make fraudulent payments, or use the account to attack other people.
Advanced persistent threat (APT)
A prolonged, targeted attack in which someone establishes access to a network and then works to stay there undetected for a long time. The groups behind APTs are usually highly skilled or well resourced, and they are after sensitive information, intellectual property, surveillance opportunities or long-term access to critical systems.
Artificial intelligence (AI)
Technology that lets computer systems do things associated with human intelligence, such as recognising patterns, analysing information, making predictions and generating content. AI can strengthen cyber defence by making detection and analysis faster. Attackers use it too, to automate attacks, develop convincing scams and create deceptive content.
Attack surface
All the points through which an attacker could try to reach an organisation's systems, data or people. It covers devices, software, cloud services, user accounts, suppliers and employees. Cutting back unnecessary access, services and vulnerabilities makes an organisation harder to attack.
Authentication
Confirming that a person, device or system is who or what it claims to be, before access is granted. Methods include passwords, security keys, biometrics, passkeys and verification codes. The stronger the authentication, the harder it is for an attacker to make use of stolen credentials.
Behaviour change
A measurable improvement in how people respond to cyber security risks. What matters is what employees actually do, not whether they finished the training. Reporting suspicious emails faster, using secure authentication, checking unusual requests, repeating risky actions less often.
Business email compromise (BEC)
A targeted scam in which an attacker impersonates or compromises a trusted colleague, executive, customer or supplier. The messages are convincing, and they typically ask for a payment, redirect an invoice, request sensitive information, or push someone into changing account details. BEC leans on social engineering far more than on malware.
Callback phishing
A phishing attack that pushes the recipient to ring a fraudulent number, often using a fake invoice, a subscription renewal or an urgent security warning. On the call, the attacker works to get the victim to reveal information, install remote-access software, visit a malicious website or hand over access to systems.
Cloud security
The policies, processes and technologies that protect data, applications, accounts and services hosted in the cloud. It covers controlling access, configuring services securely, protecting data and monitoring activity. It also means being clear about which responsibilities sit with the organisation and which sit with the cloud provider.
Credential exposure
Usernames, passwords, authentication tokens or other login information becoming visible to unauthorised people. Credentials get exposed through data breaches, malware, phishing, insecure storage and accidental publication. Treat any exposed credential as compromised, because attackers move quickly to use or resell them.
Credential harvesting
Deliberately collecting usernames, passwords or other authentication details for malicious use. Attackers harvest credentials through fake login pages, phishing messages, malicious forms, browser-stealing malware and fraudulent applications. What they collect then feeds account takeover, fraud or further attacks.
Credential stuffing
An automated attack that tries stolen username and password combinations against lots of websites and services. It works because people reuse passwords across accounts. Unique passwords, password managers, passkeys and multi-factor authentication all cut its success rate sharply.
Cyber attack
A deliberate attempt to access, disrupt, damage, manipulate or misuse digital systems, services or data. The techniques include phishing, malware, credential theft, exploitation of vulnerabilities and denial-of-service attacks. Motives vary: financial gain, espionage, disruption, activism, theft of information.
Cyber resilience
An organisation's ability to prepare for, withstand, respond to and recover from cyber incidents while keeping essential operations running. It combines prevention with detection, incident response, backups, recovery planning, employee preparedness and business continuity.
Data breach
An incident where personal, confidential or sensitive information is accessed, disclosed, altered, stolen, destroyed or lost without proper authorisation. The cause might be a cyber attack, human error, a lost device, a misconfigured system or inappropriate internal access. The consequences can be legal, financial and reputational.
Data loss prevention (DLP)
Technology and processes that identify sensitive information and stop it being shared, transferred, copied or stored where it shouldn't be. DLP controls can monitor email, cloud services, devices and networks. They protect confidential data against accidental disclosure, insider activity and deliberate theft.
Deepfake
AI-generated or manipulated audio, video or imagery built to imitate a real person convincingly, or to show events that never happened. Attackers use deepfakes to impersonate executives, colleagues and trusted contacts in fraud, social engineering, misinformation and identity-based attacks.
Email threat simulation
A controlled test of whether technical email security controls can detect and block realistic threats such as malicious attachments, suspicious links and impersonation attempts. Phishing simulations mainly assess employee behaviour. Email threat simulations assess the technology.
Encryption
Converting readable information into a protected form that cannot normally be understood without the right cryptographic key. It protects sensitive data both in storage and in transit, so that information which is intercepted or stolen still cannot be read by unauthorised people.
Endpoint
Any device that connects to an organisation's network, applications or services. Laptops, desktops, smartphones, tablets, servers. Endpoints are a common target, so they are usually protected with security updates, access controls, encryption, anti-malware and endpoint detection technologies.
Firewall
Hardware or software that monitors and controls incoming and outgoing network traffic against defined security rules. A firewall can block unauthorised connections, restrict access between networks and reduce exposure to malicious activity, though it is normally only one part of a wider security strategy.
Generative AI
AI that creates new content — text, images, audio, video, computer code — in response to instructions. It can improve productivity and creativity. It also introduces risks around confidential information, inaccurate outputs, copyright, malicious content and convincing social engineering.
Hacker
Someone who uses technical knowledge to understand, test, access or manipulate computer systems. Some hackers work legally, finding vulnerabilities so they can be fixed. Malicious hackers access systems without permission to steal information, commit fraud, cause disruption or pursue other harmful ends.
Human risk
The cyber security risk that comes from people's actions, decisions, access or circumstances. It covers mistakes, deliberate misuse and manipulation by attackers. Responding to phishing, sharing sensitive information, using weak authentication, bypassing security controls, approving fraudulent requests.
Human Risk Management (HRM)
A structured approach to identifying, measuring and reducing the cyber security risk associated with people. HRM combines behavioural data, training, communications, simulations and targeted interventions, so that an organisation can put its resources where the risk actually sits: the specific behaviours, individuals or groups that present the most.
Incident response
The organised process for preparing for, detecting, investigating, containing, removing and recovering from a cyber security incident. Good incident response limits damage, restores operations, preserves evidence and keeps affected parties informed. It also identifies the improvements that make the next incident less likely or less severe.
Insider threat
A cyber security risk involving someone who already has legitimate access to an organisation's systems, information or facilities. It can be malicious, negligent or accidental, and it can involve employees, contractors or trusted partners. Data theft, unauthorised disclosure, misuse of access, accidental exposure of sensitive information.
Internet of Things (IoT)
Physical devices that connect to networks or the internet and exchange data: smart cameras, sensors, printers, medical devices, building controls. They create security risks when they use weak authentication, carry unpatched vulnerabilities, or get deployed without proper monitoring and network controls.
Malware
Software or code built to damage systems, steal information, spy on users, disrupt operations or provide unauthorised access. It includes ransomware, spyware, Trojans, viruses and worms. It arrives through phishing, malicious websites, compromised software or the exploitation of security vulnerabilities.
Malvertising
Using online advertising to distribute malware, redirect people to fraudulent websites or support other malicious activity. Malicious adverts reach legitimate websites through compromised advertising networks, and they use convincing offers, fake warnings and deceptive downloads to get people to click.
Multi-factor authentication (MFA)
A login process that requires two or more different types of verification: something you know, something you possess, something you are. A password plus a trusted device or a fingerprint, for example. MFA gives you protection that still holds when one credential has been compromised.
Passkey
A passwordless authentication method built on cryptographic credentials stored securely on a trusted device or in a password manager. Access is normally approved with a device PIN, a fingerprint or face recognition. Passkeys resist traditional phishing because there is no reusable password for an attacker to steal.
Password manager
Software that securely creates, stores and enters passwords and other login credentials. It makes long, unique passwords for every account practical, which removes the risk created by weak passwords and password reuse. Business password managers also support controlled credential sharing and access management.
Phishing
An attempt to trick someone into revealing information, downloading malware, making a payment, sharing credentials or granting access. Email is the most common route, but the same attacks arrive through messaging platforms, social media, QR codes, phone calls and text messages.
Phishing simulation
A controlled campaign that sends realistic but harmless phishing messages to employees to measure how they respond. Simulations surface risky behaviours, reinforce reporting processes and give you something to build targeted learning around. The results are most useful when they drive improvements to behaviour and controls, rather than just producing a failure rate.
Pretexting
A social engineering technique where the attacker invents a convincing identity, story or situation to gain someone's trust. They might pose as a colleague, a supplier, a customer or an authority figure, then use that invented scenario to extract information, money, credentials or access.
Quishing
Phishing carried out through a malicious or fraudulent QR code. Scanning it can lead to a fake login page, a payment request, a malicious website or a malware download. QR codes make a suspicious destination harder to spot, because the underlying web address is not visible until it is too late.
Ransomware
Malware used to disrupt an organisation by encrypting data, blocking access to systems or stealing sensitive information. The attacker then demands payment, usually threatening to publish the stolen data if the victim refuses. Modern ransomware attacks combine encryption, data theft, extortion and disruption.
Risky behaviour
An action or decision that makes a cyber incident more likely, or its impact worse. Sharing credentials. Approving unexpected requests without verifying them. Ignoring security warnings, storing information insecurely, or sitting on suspicious activity instead of reporting it.
Secure behaviour
An action or decision that reduces cyber security risk. Reporting suspicious messages, verifying unusual payment requests through a trusted channel, protecting credentials, using approved systems, and following security procedures when handling sensitive information.
Secure Behaviour Management (SBM)
An approach focused on measuring, understanding and improving how people behave when they meet a cyber security risk. SBM uses behavioural data and targeted interventions to reinforce secure actions and reduce the risky ones that keep recurring. It also shows whether security awareness activity is producing any behavioural change at all.
Security awareness training
Education that helps employees understand cyber security risks, recognise threats and respond well. The programmes that work do more than deliver information. They use relevant content, practice, reinforcement and measurement, so that employees build secure habits that hold up in everyday work.
Security culture
The shared attitudes, beliefs, expectations and behaviours that shape how people approach cyber security inside an organisation. Where the culture is strong, employees factor security into everyday decisions, report concerns without hesitating, and understand their own part in protecting the organisation.
Security Information and Event Management (SIEM)
Technology that collects and analyses security information and event data from systems, applications, networks and devices. A SIEM platform helps security teams spot suspicious activity, investigate incidents and correlate events from different sources. It generates alerts when behaviour matches a known or suspected threat.
Security Operations Centre (SOC)
The team or function that continuously monitors an organisation's technology environment for cyber threats. SOC staff investigate alerts, analyse suspicious activity and coordinate incident response, using security tools and threat intelligence to detect and contain attacks as early as they can.
Smishing
Phishing delivered by SMS or another mobile text-messaging service. The messages create urgency and carry links, phone numbers or payment requests. They usually impersonate delivery companies, banks, government services or employers, to get the recipient to disclose information or do something unsafe.
Social engineering
Using deception, trust, urgency, authority or other psychological techniques to persuade someone to disclose information or take an unsafe action. It happens over email, phone, messaging platforms, social media and face to face. It gets past technical security controls by going around them and targeting people directly.
Spear phishing
A phishing attack tailored to a specific person, role, department or organisation. The attacker researches the target first, then works in real names, projects, suppliers or business activities. The result is far more convincing than a generic phishing attempt.
Supply chain attack
An attack that reaches an organisation through a trusted supplier, service provider, software product or business partner. Attackers exploit weaker security somewhere else in the chain, then use that trusted relationship to distribute malicious software, steal information or reach further organisations.
Threat actor
The individual, group or organisation behind a cyber threat. Threat actors include cybercriminals, nation-state groups, hacktivists and insiders. Their motivations range across financial gain, espionage, disruption, ideology, revenge and theft of information.
Threat intelligence
Information about existing or emerging cyber threats that helps an organisation make security decisions. It can cover attackers, techniques, vulnerabilities, malicious infrastructure, malware and compromised credentials. Good threat intelligence supplies the context that lets a security team prioritise, detect and respond to the threats that actually apply to them.
Threat sharing
The controlled exchange of cyber threat information between trusted organisations, industries or security communities. What gets shared includes malicious indicators, attack techniques, vulnerabilities and emerging risks. Participants detect threats earlier as a result, and collective defence improves, while confidentiality and sharing restrictions still hold.
TLP — Traffic Light Protocol
A classification system that indicates how widely a piece of sensitive cyber security information may be shared. TLP markings tell recipients what the distribution restrictions are, which reduces the risk of inappropriate disclosure. The current framework uses four labels: TLP:RED, TLP:AMBER, TLP:GREEN and TLP:CLEAR.
Trojan
Malware disguised as legitimate software, a document or another trusted file, so that someone will install or open it. Once it runs, a Trojan may steal information, download more malware, monitor activity or give an attacker remote access to the device.
Two-step verification (2SV)
A login process that requires two separate verification steps before access is granted, commonly a password followed by a code, a notification or a security key. It differs from MFA in that the two steps do not have to come from different authentication factor categories.
Virus
Malicious code that attaches itself to legitimate files or programs and spreads when the infected content is opened or run. Viruses can modify or destroy data, disrupt systems or deliver further malicious code. They usually need some user or system action to spread.
Vishing
Voice phishing, carried out by phone call or voice message. Attackers impersonate banks, colleagues, suppliers, technical support teams or authorities, then use urgency or authority to get someone to disclose information, transfer money, install software or provide access.
Whaling
A highly targeted form of phishing aimed at senior executives, C-suite leaders and other high-profile people who hold sensitive information or authority over important decisions. Attackers research the target carefully and build messages around payments, confidential information, legal matters or other high-value business activity.
Zero-day vulnerability
A software or hardware security weakness that the supplier does not know about, or for which no effective fix exists yet. Attackers can exploit a zero day before anyone is able to patch it, which is why rapid detection, temporary mitigations and layered security controls matter so much here.
Zero trust
A security approach built on continuously verifying users, devices and access requests, rather than trusting them automatically because of where they are or what they were allowed to do before. Zero trust applies least privilege, strong authentication, device checks and ongoing monitoring, to limit unnecessary access and contain the damage when an account or system is compromised.
Turn cyber security knowledge into safer behaviour
TSC helps organisations translate complex security risks into practical awareness, training and measurable behaviour change.
Explore our cyber security awareness services
