Resources
Cybersecurity Glossary
70 essential security terms explained in plain English — for owners, managers and teams.
A
- Access control
- The rules and tools that decide who can see or change which systems and data. Good access control means each person has their own account and only the permissions their job requires.
Related guide - Account takeover
- When a criminal gains control of a legitimate user's account, usually with a stolen or guessed password. They can then read email, send convincing scams or move money while appearing to be that person.
Related guide - Antivirus and EDR
- Antivirus software looks for known malicious files on a device. Endpoint detection and response (EDR) goes further by watching for suspicious behavior, alerting you and helping you isolate an infected computer quickly.
Related guide - Attack surface
- All the places where an attacker could try to get into your business, such as user accounts, internet-facing systems, devices, apps and vendors. Reducing your attack surface means removing or locking down anything you do not need.
Related guide - Authentication
- The process of proving you are who you claim to be when signing in, usually with a password, a code, a passkey or a fingerprint. Stronger authentication combines more than one of these.
Related guide
B
- Backup
- A separate copy of your data that you can restore if the original is lost, deleted, corrupted or encrypted by ransomware. A backup is only useful if it is kept apart from the original and you have tested restoring it.
Related guide - Botnet
- A network of compromised computers, routers or smart devices controlled remotely by a criminal. Botnets are used to send spam, run denial-of-service attacks or guess passwords at scale, often without the device owners noticing.
- Brute force attack
- An attempt to break into an account by trying huge numbers of passwords until one works. Long, unique passwords, account lockouts and multi-factor authentication make brute force attacks impractical.
Related guide - Business email compromise (BEC)
- A scam in which criminals impersonate or take over a trusted email account, such as a boss, supplier or client, to trick someone into sending money or sensitive information. Fake invoices and changed bank details are the most common examples.
Related guide - BYOD (bring your own device)
- A policy that lets employees use their personal phones, tablets or laptops for work. It is convenient, but it needs clear rules and basic device protections so business data stays safe.
Related guide
C
- CIS Controls
- A prioritized set of security best practices published by the Center for Internet Security. Its first implementation group is a practical starting point for small businesses that want a recognized checklist to follow.
Related guide - Cloud security posture
- How well your cloud services, such as Microsoft 365, Google Workspace or AWS, are configured from a security point of view. Many cloud incidents are caused by settings left at their defaults rather than by flaws in the provider's platform.
Related guide - Credential stuffing
- An attack where criminals take usernames and passwords leaked from one website and try them on many others. It works because people reuse passwords, which is why a password manager and unique passwords matter.
Related guide - Cyber insurance
- Insurance that helps cover the costs of a cyber incident, such as investigation, recovery, legal advice and business interruption. Insurers increasingly require controls like MFA and tested backups before they will offer a policy.
Related guide
D
- Dark web
- Parts of the internet that are not indexed by normal search engines and require special software to reach. Stolen passwords, customer data and hacking tools are often traded there.
- Data breach
- An incident in which sensitive, protected or confidential information is accessed or disclosed without authorization. Depending on the data and where your customers live, a breach may trigger legal notification requirements.
Related guide - DDoS (distributed denial of service)
- An attack that floods a website or online service with so much traffic from many sources that legitimate users cannot reach it. Hosting providers and content delivery networks offer protections that absorb most of these attacks.
- Deepfake
- Realistic fake audio, video or images created with artificial intelligence to impersonate a real person. Criminals use deepfaked voices and video calls to make payment requests and other scams more convincing.
Related guide - DLP (data loss prevention)
- Tools and rules that detect and stop sensitive information, such as card numbers or health records, from being shared or sent outside the business by mistake or on purpose. Microsoft 365 and Google Workspace include DLP features on some plans.
Related guide - DMARC, DKIM and SPF
- Three email authentication standards that work together to prove messages really come from your domain. SPF lists which servers may send your mail, DKIM adds a digital signature, and DMARC tells receiving servers what to do with messages that fail those checks.
Related guide - DNS (Domain Name System)
- The internet's address book, which translates names like securitysage.org into the numeric addresses computers use. Protecting your domain registrar and DNS account is important because whoever controls DNS controls where your website and email go.
E
- Encryption
- Scrambling information so that only someone with the right key can read it. Even if encrypted data is stolen, it is useless to the thief without the key.
Related guide - Encryption at rest and in transit
- Encryption at rest protects data where it is stored, such as on a laptop drive or in a cloud folder. Encryption in transit protects data as it moves across a network, such as when you visit a website that uses HTTPS.
Related guide - Endpoint
- Any device that connects to your network or business systems, including laptops, desktops, phones, tablets and servers. Endpoints are where most attacks land, so keeping them updated and protected is a core task.
Related guide - Exploit
- A piece of code or a technique that takes advantage of a specific vulnerability to make a system do something it should not. Applying security updates promptly closes the holes that exploits rely on.
F
- Firewall
- A security control that allows or blocks network traffic based on a set of rules. Most small offices have one built into their router, and computers have their own software firewalls as well.
Related guide
G
- GDPR
- The General Data Protection Regulation, the European Union's data protection law. It can apply to US businesses that offer goods or services to people in the EU or monitor their behavior, and it requires appropriate security for personal data.
Related guide
H
- HIPAA
- The Health Insurance Portability and Accountability Act, a US law that includes rules for protecting patients' health information. It applies to healthcare providers, health plans and clearinghouses, and to business associates that handle health data on their behalf.
Related guide
I
- Identity and access management (IAM)
- The combination of processes and tools used to create user accounts, control what each person can access and remove access when they leave. Strong IAM is the foundation of modern security.
Related guide - Immutable backup
- A backup copy that cannot be changed or deleted for a set period, even by an administrator. Immutable or offline copies are an important defense because ransomware often tries to destroy backups first.
Related guide - Incident response
- The planned, organized way a business detects, contains and recovers from a security incident. A written incident response plan means people know who to call and what to do instead of improvising under pressure.
Related guide - Indicator of compromise (IoC)
- A clue that a system may have been breached, such as an unfamiliar login location, a new mailbox forwarding rule or unexpected software. Spotting these early can stop a small problem from becoming a major incident.
Related guide - Insider threat
- A risk that comes from people inside the business, such as employees or contractors, whether through carelessness, mistakes or deliberate misuse. Least privilege, clear policies and prompt removal of access for leavers reduce this risk.
- IoT (Internet of Things)
- Everyday devices that connect to the internet, such as security cameras, smart TVs, thermostats and printers. They are often poorly secured, so it is best to change their default passwords and keep them on a separate network.
Related guide
L
- Least privilege
- The principle of giving each person and system only the access they need to do their job, and nothing more. If an account is compromised, least privilege limits how much damage an attacker can do.
Related guide
M
- Malware
- Short for malicious software, a catch-all term for programs designed to harm, spy on or take control of a device. Viruses, ransomware, spyware and trojans are all types of malware.
- Man-in-the-middle attack
- An attack where someone secretly intercepts communication between two parties, for example on an unsafe public Wi-Fi network. Encrypted connections and VPNs make this much harder.
Related guide - MDM (mobile device management)
- Software that lets a business manage and secure company or personal devices used for work. It can enforce screen locks and encryption, install updates and remotely wipe business data from a lost or stolen device.
Related guide - MFA (multi-factor authentication)
- A sign-in method that requires two or more types of proof, such as a password plus a code from an app or a security key. Turning on MFA is one of the most effective steps a small business can take against account takeover.
Related guide
N
- NIST Cybersecurity Framework (NIST CSF)
- A widely used, voluntary framework from the US National Institute of Standards and Technology for managing cybersecurity risk. Version 2.0 organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Related guide
P
- Passkey
- A modern replacement for passwords that uses a cryptographic key stored on your device and unlocked with your fingerprint, face or PIN. Passkeys cannot be guessed or reused and are highly resistant to phishing.
Related guide - Password manager
- An app that creates, stores and fills in strong, unique passwords for every account, protected by one master password. It removes the temptation to reuse passwords and makes sharing logins within a team safer.
Related guide - Patch management
- The routine process of finding, testing and installing software updates that fix security flaws. Many successful attacks use vulnerabilities for which an update was already available.
Related guide - PCI DSS
- The Payment Card Industry Data Security Standard, a set of security requirements for any business that stores, processes or transmits payment card data. Your requirements depend largely on how you accept card payments.
Related guide - Penetration test
- An authorized, simulated attack on your systems carried out by security professionals to find weaknesses before criminals do. It should only ever be performed with written permission and an agreed scope.
Related guide - Phishing
- Fraudulent messages, usually emails, designed to trick people into clicking a link, opening an attachment, entering a password or sending money. Phishing is one of the most common ways attacks on small businesses begin.
Related guide - Privileged account
- An account with elevated permissions, such as an administrator account for your computers, cloud tenant or network equipment. These accounts are prime targets and should be used only when needed and always protected with MFA.
Related guide
R
- Ransomware
- Malware that encrypts or steals your files and demands payment to restore them or keep them private. Tested backups, MFA, timely updates and staff awareness are the best defenses.
Related guide - Risk assessment
- A structured review of what could go wrong, how likely it is and how much harm it would cause. It helps you spend your security budget on the problems that matter most first.
Related guide
S
- Security awareness training
- Education that helps employees recognize and avoid threats such as phishing, scams and unsafe data handling. The most effective programs are short, regular and practical rather than a once-a-year lecture.
Related guide - SIEM (security information and event management)
- A system that collects logs and alerts from many sources, such as computers, firewalls and cloud services, and analyzes them to spot suspicious activity. Small businesses often access SIEM capabilities through a managed service.
- Single sign-on (SSO)
- A setup that lets people sign in once with one strong, MFA-protected account to access many business apps. It simplifies life for users and makes it easier to remove all access when someone leaves.
Related guide - Smishing
- Phishing carried out by text message. Common examples include fake delivery notices, bank alerts and messages pretending to be from the boss asking for gift cards.
Related guide - SOC 2
- An independent audit report, based on criteria from the American Institute of Certified Public Accountants (AICPA), that describes how a service provider protects customer data. Larger customers often ask software and service vendors for a SOC 2 report.
Related guide - Spear phishing
- A targeted phishing attack aimed at a specific person or business, often using details gathered from websites and social media to seem convincing. Finance staff and executives are frequent targets.
Related guide - Spoofing
- Disguising a message, phone number, website or email address so it appears to come from a trusted source. Email authentication with SPF, DKIM and DMARC makes it harder for criminals to spoof your domain.
Related guide - Spyware
- Malware that secretly monitors what you do on a device, such as capturing keystrokes, passwords or screenshots, and sends that information to an attacker.
- Supply chain attack
- An attack that reaches you through a trusted supplier, such as a compromised software update, IT provider or business partner. Knowing which vendors have access to your systems and data is the first step to managing this risk.
Related guide
T
- Threat
- Anything with the potential to cause harm to your systems or data, such as a criminal group, a phishing campaign, a natural disaster or an employee mistake.
- Threat actor
- The person or group behind a cyberattack, ranging from opportunistic scammers and organized criminal gangs to hacktivists and nation-state groups. Most small business attacks come from financially motivated criminals.
- Trojan
- Malware disguised as legitimate software or a harmless file, such as a fake invoice or a pirated app. Once opened, it gives attackers a foothold on the device.
V
- Vendor risk management
- The process of assessing and monitoring the security of suppliers and service providers that handle your data or connect to your systems. It includes asking the right questions before signing and reviewing access regularly.
Related guide - Vishing
- Voice phishing: scams carried out by phone call or voicemail, often pretending to be a bank, a government agency, IT support or a senior colleague. AI voice cloning is making these calls more convincing.
Related guide - VPN (virtual private network)
- A tool that creates an encrypted connection between a device and a network over the internet. Businesses use VPNs to give remote staff secure access to internal systems, and they add protection on untrusted Wi-Fi.
Related guide - Vulnerability
- A weakness in software, hardware, configuration or process that an attacker could exploit. Examples include an unpatched program, a default password or an internet-exposed admin page.
- Vulnerability scan
- An automated check that looks for known weaknesses, missing updates and misconfigurations across your systems. It is faster and broader than a penetration test but does not attempt to exploit what it finds.
Related guide
W
- WPA3
- The latest Wi-Fi security standard, which offers stronger protection for wireless networks than its predecessor, WPA2. Use WPA3 where your devices support it, or WPA2 with a long passphrase if they do not.
Related guide
Z
- Zero-day
- A vulnerability that is unknown to the software maker, or for which no fix is yet available, so defenders have had zero days to patch it. Layered defenses and fast updating once a patch is released are the best protection.
- Zero trust
- A security approach that assumes no user or device should be trusted automatically, even inside the office network. Every access request is verified based on identity, device health and context.
Related guide
No terms found. Try another word.
Ready when you are
Secure your digital future today with SecuritySage - where cybersecurity meets simplicity, allowing you to focus on growth while we handle the rest.
Get Started
Related guide