Cybersecurity Glossary: 200 Terms Explained Simply

2FA (Two-Factor Authentication)

An extra security layer requiring two proofs of identity — e.g. your password plus a code from your phone. Stops most account takeovers.

Access Control

Rules that decide who or what can view or use resources in a system. Based on verified identity and permissions — enforced through logins, roles, and policies.

Access Control List (ACL)

A list attached to a file or resource naming exactly which users or systems may access it, and what they may do. A fundamental enforcement tool for access control.

Advanced Persistent Threat (APT)

A long-term, targeted cyberattack by skilled actors (often state-backed) who quietly stay inside a network for months.

Adware

Software that shows unwanted ads. Often bundled with free programs; some adware also tracks your browsing.

AES (Advanced Encryption Standard)

The world’s most widely used symmetric encryption algorithm, with 128, 192, or 256-bit keys. Protects everything from WiFi (WPA2/WPA3) and files to messaging apps.

Air Gap

Physically isolating a computer or network from all other networks, including the internet. Used for the most critical systems; data moves only through strictly controlled removable media.

Allowlist

A list of approved programs, websites, or senders — everything else is blocked by default. Stricter than a blocklist and common in high-security environments.

Antimalware

Software that detects and removes all kinds of malicious programs, not just viruses. Modern antimalware watches program behavior, not only known signatures.

Antivirus

Software that detects and removes malicious programs using known signatures and behavior analysis.

Attack Surface

All the possible points where an attacker could try to enter a system: open ports, apps, user accounts, and APIs. A smaller attack surface is easier to defend.

Attack Vector

The path or method an attacker uses to reach a target — a phishing email, a malicious USB drive, or an unpatched web application. Defenders work to close every vector.

Authentication

The process of verifying that someone really is who they claim to be — with a password, code, or fingerprint. Always comes before authorization.

Authorization

Deciding what an authenticated user is allowed to do: which files they can open, which systems they can touch. Managed through permissions and roles.

Backdoor

A hidden entry point into a system, left by malware or attackers to regain access later.

Backup (3-2-1 Rule)

Keep 3 copies of important data, on 2 different media types, with 1 copy offline or off-site. The most reliable defense against ransomware and hardware failure.

Baiting

A social engineering trick that lures victims with something tempting — a free USB drive, a fake prize, or a ‘free’ download. Curiosity does the attacker’s work.

Biometric Authentication

Verifying identity with a fingerprint, face, or voice instead of a password. Convenient and hard to forget — but unlike passwords, you cannot change biometrics if they are stolen.

Black Hat Hacker

A hacker who breaks into systems illegally for personal gain or harm.

Blocklist

A list of known-bad items — malicious IPs, domains, or senders — that are denied access. Easier to manage than allowlists but always one step behind new threats.

Blue Team

The defensive security team that protects an organization's systems and detects attacks.

Botnet

A network of infected computers controlled remotely by an attacker, used for spam, DDoS, or mining crypto.

Brute Force Attack

Trying every possible password combination until one works. Defeated by long passwords and lockouts.

Buffer Overflow

A bug where a program writes more data into memory than it can hold, spilling into neighboring areas. Attackers exploit this to crash programs or run their own code.

Bug Bounty

A program where companies pay ethical hackers for finding and reporting security flaws legally.

Business Email Compromise (BEC)

Fraud where attackers impersonate a boss or supplier by email to trick staff into wiring money or sharing data. Among the costliest cybercrimes — always verify payment requests by phone.

Certificate (Digital)

An electronic document proving a website's identity, enabling trusted HTTPS encryption.

Certificate Authority (CA)

A trusted organization that issues digital certificates proving a website’s identity. Your browser relies on CAs to confirm that HTTPS sites are genuine.

Chain of Custody

A documented record of who handled digital evidence and when, from collection to the courtroom. Any gap in the chain can make evidence inadmissible in court.

CIA Triad

The three core goals of information security: Confidentiality (only authorized access), Integrity (data stays accurate and unaltered), and Availability (systems keep working).

Ciphertext

Encrypted data in its scrambled, unreadable form. Only someone holding the correct key can turn ciphertext back into readable plaintext.

Clickjacking

Tricking you into clicking something invisible — like a hidden button layered over a real webpage. Can hijack likes, purchases, or account settings.

Cloud Security

Protecting data and applications hosted on cloud platforms such as AWS, Google Cloud, or Azure. Covers secure configuration, access control, and encryption of cloud resources.

Command & Control (C2)

The server an attacker uses to send instructions to infected machines in a botnet.

Credential Stuffing

Using stolen username/password pairs from one breach to try logging into other sites. Blocked by unique passwords.

Cross-Site Scripting (XSS)

An attack injecting malicious scripts into trusted websites, which then run in visitors' browsers.

Cryptography

The science of secure communication — encryption, hashing, and digital signatures.

CSIRT (Computer Security Incident Response Team)

A dedicated team that handles security incidents: detection, containment, recovery, and learning lessons afterward. Larger organizations run their own CSIRT around the clock.

CSRF (Cross-Site Request Forgery)

An attack that tricks your logged-in browser into performing unwanted actions on a trusted site — like changing your email or password. Prevented with anti-CSRF tokens.

CVE

Common Vulnerabilities and Exposures — a public ID system for known security flaws (e.g. CVE-2024-1234).

CVSS (Common Vulnerability Scoring System)

A 0-to-10 score rating how severe a software vulnerability is, based on how easily it can be exploited and the damage it causes. Helps teams fix the worst flaws first.

Cyber Hygiene

Everyday security habits: installing updates, using strong unique passwords, keeping backups, and treating unknown links with suspicion. The digital equivalent of washing your hands.

Cyber Kill Chain

The seven stages of a typical attack: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders aim to break the chain as early as possible.

Dark Web

Hidden websites reachable only with special software like Tor. Used for both privacy and crime.

Data Breach

An incident where private data is stolen or exposed — by attackers or by mistake. Breaches can leak the passwords, IDs, and payment details of millions of people.

Data Exfiltration

The unauthorized copying or transfer of data out of an organization — the end goal of most breaches. DLP tools and outbound-traffic monitoring aim to stop it.

Data Loss Prevention (DLP)

Tools and policies that stop sensitive data from leaving an organization — blocking risky uploads, emails, or USB copies of confidential files.

DDoS (Distributed Denial of Service)

Overwhelming a website with traffic from many sources so real users cannot reach it.

Decryption

Converting encrypted data back to readable form using the correct key.

Defense in Depth

Protecting with multiple overlapping layers — firewall, antivirus, MFA, backups — so that one failure does not mean total compromise. No single layer is ever trusted alone.

Denial of Service (DoS)

Flooding a system with requests from a single source until it slows down or crashes. Its larger cousin, DDoS, uses many sources at once.

Dictionary Attack

Guessing passwords from lists of common words, phrases, and previously leaked passwords — far faster than pure brute force. Defeated by long, unique passphrases.

Digital Forensics

Recovering and analyzing digital evidence after a cyber incident, following legal procedures.

Digital Signature

A cryptographic proof that a message or file truly came from its claimed sender and was not altered.

DMZ (Demilitarized Zone)

A separated network zone for public-facing servers (like web servers), sitting between the internet and the private internal network. Limits the damage if a public server gets hacked.

DNS (Domain Name System)

The internet's phonebook — translates names like example.com into IP addresses.

Doxxing

Publishing someone’s private details — home address, phone number, family info — online to harass or threaten them. A crime in many countries; tighten your social media privacy settings.

Drive-by Download

Malware that installs itself simply because you visited a compromised website — no click required. Keeping your browser updated blocks most of these attacks.

Eavesdropping

Secretly listening in on network traffic or conversations to steal information. Encryption through HTTPS and VPNs makes intercepted data unreadable.

EDR (Endpoint Detection & Response)

Advanced security software on devices that detects and responds to threats in real time.

Email Spoofing

Faking the sender address so a message appears to come from your bank, boss, or a colleague. Never trust display names alone — check the real address and headers.

Encryption

Scrambling data with a key so only authorized parties can read it. The foundation of online privacy.

End-to-End Encryption (E2EE)

Encryption where only the sender and receiver can read messages — not even the service provider in the middle. Used by WhatsApp and Signal.

Endpoint

Any device connected to a network — laptop, phone, server — that needs protection.

Ethical Hacker

A security professional authorized to test systems for weaknesses so they can be fixed.

Evil Twin

A fake WiFi hotspot with a trustworthy name (like ‘Free Airport WiFi’) set up to steal your data. Always confirm the exact network name with staff before connecting.

Exploit

Code or technique that takes advantage of a software vulnerability.

Fileless Malware

Malware that runs entirely in memory without installing files on disk, making it hard for traditional antivirus to spot. Detected by behavior-monitoring tools like EDR.

Firewall

A barrier that filters network traffic, blocking unauthorized connections while allowing legitimate ones.

Fuzzing

Automatically feeding random or malformed data into software to trigger crashes and uncover vulnerabilities. A standard technique in security testing.

Grey Hat Hacker

A hacker operating between legal and illegal — e.g. finding flaws without permission but reporting them.

Hacker

Someone with deep computer skills who finds clever ways into systems. Hackers can be criminal (black hat), authorized (white hat), or somewhere in between (grey hat).

Hardening

Reducing a system’s attack surface: disabling unused services, removing default passwords, and applying secure settings. A standard first step when setting up any server.

Hashing

Converting data into a fixed-length fingerprint. One-way: you cannot reverse a hash to get the original.

Honeypot

A decoy system designed to attract attackers so defenders can study their methods.

HTTP

The basic protocol browsers use to fetch web pages — sent in plain, readable text. Its secure encrypted version is HTTPS; never enter passwords on plain HTTP sites.

HTTPS

The secure version of HTTP — encrypts data between your browser and a website.

IAM (Identity and Access Management)

Systems that manage who users are and what they can access across an organization. Includes single sign-on, multi-factor authentication, and role-based permissions.

IDS (Intrusion Detection System)

A system that monitors networks for malicious activity and raises alerts.

Incident Response

The planned process of detecting, containing, and recovering from a security breach.

Indicator of Compromise (IOC)

A clue that a system has been breached — a malicious IP address, file hash, or domain name. Defenders share IOCs so others can detect the same attack.

Insider Threat

A security risk coming from inside: employees or contractors who misuse their access, whether maliciously or through careless mistakes. Hard to stop with perimeter defenses alone.

IoT Security

Securing internet-connected devices — cameras, smart TVs, thermostats — which often ship with weak default passwords and rarely receive updates.

IP Address

A unique number identifying every device on a network (e.g. 192.168.1.1).

IPS (Intrusion Prevention System)

Like an IDS, but it also blocks detected attacks automatically.

ISO 27001

The international standard for managing information security inside organizations. Certification proves a company follows strict, audited security practices.

Juice Jacking

Stealing data or installing malware through a compromised public USB charging port.

Key Management

The secure creation, storage, rotation, and destruction of encryption keys. Even the strongest encryption fails if keys are lost, stolen, or hardcoded into software.

Keylogger

Malware that secretly records every keystroke to steal passwords and messages.

Lateral Movement

An attacker's technique of moving from one compromised machine to others inside a network.

Least Privilege

Giving users and programs only the minimum access they need to do their job — nothing more. Limits how much damage any single compromised account can cause.

MAC Address

A unique hardware identifier burned into every network device. Used for network access control, though attackers can fake (spoof) it.

Malware

Malicious software — an umbrella term for viruses, ransomware, spyware, and trojans.

Malware Analysis

Studying malware in a safe, isolated lab to learn what it does and how to detect it. Static analysis reads its code; dynamic analysis watches it run inside a sandbox.

Malware Signature

A unique fingerprint — often a hash — of a known malware sample. Antivirus products match suspicious files against databases holding millions of signatures.

Man-in-the-Middle (MITM)

An attack secretly intercepting communication between two parties, e.g. on unsafe WiFi.

Metadata

Data about data: a photo’s location, a document’s author, an email’s routing history. Attackers mine metadata for reconnaissance — strip it before sharing files publicly.

MFA (Multi-Factor Authentication)

Like 2FA but with two or more verification factors. The single best account protection.

MITRE ATT&CK

A public knowledge base cataloging the real tactics and techniques attackers use, based on observed attacks. Defenders use it to map intrusions and plan detections.

NAT (Network Address Translation)

Technology that lets many devices share one public IP address by translating internal addresses. Used by home routers; it also hides the internal network layout.

Network Segmentation

Dividing a network into separate sections so a breach in one area cannot easily spread to others. Directly limits an attacker’s lateral movement.

Next-Gen Firewall (NGFW)

A firewall that goes beyond port filtering: it inspects applications, blocks malware, and filters malicious URLs in real time.

OAuth

An open standard that lets you log into apps with your Google or Apple account without sharing your password. Apps receive limited-permission tokens instead of your credentials.

OSINT (Open-Source Intelligence)

Gathering intelligence from publicly available sources — legal and widely used by defenders.

OWASP

Open Worldwide Application Security Project — publishes the famous Top 10 web security risks.

Password Manager

An app that generates and stores a strong, unique password for every site, protected by one master password. The practical fix for dangerous password reuse.

Password Policy

An organization’s enforced rules for passwords: minimum length, complexity, rotation, and account lockouts. Strong policies are technically enforced, not just suggested.

Password Spraying

Trying a few common passwords against many accounts to avoid lockouts. Defeated by MFA.

Patch

A software update fixing bugs or security vulnerabilities. Install patches promptly.

Patch Management

The organized process of finding, testing, and installing software updates across every device. Unpatched systems remain the most common entry point for attackers.

Payload

The malicious part of an attack — what the malware actually does once delivered.

Penetration Testing

Authorized simulated attacks on a system to find weaknesses before criminals do.

PGP (Pretty Good Privacy)

A long-standing program for encrypting emails and files with public-key cryptography. Also lets you digitally sign messages to prove they truly came from you.

Pharming

Redirecting you to a fake website even when you typed the correct address, via DNS tricks.

Phishing

Fake emails or messages pretending to be trusted senders to steal your credentials.

PII (Personally Identifiable Information)

Data that can identify a person: name, national ID, address, or biometrics. Protecting PII is required by privacy laws in most countries.

Pivoting

After compromising one machine, an attacker uses it as a stepping stone to reach deeper, hidden parts of a network. Detected by watching for unusual internal traffic.

PKI (Public Key Infrastructure)

The system of certificate authorities, digital certificates, and keys that makes HTTPS and secure email trustworthy at internet scale.

Plaintext

Readable, unencrypted data. A basic security rule: never store passwords or secrets in plaintext where anyone with file access can read them.

Port

A numbered doorway on a device for network services (e.g. port 443 for HTTPS).

Pretexting

Inventing a believable false scenario — ‘I’m from IT support’ — to trick someone into revealing information. A core social engineering technique.

Private Key

The secret half of a cryptographic key pair, which must never be shared. Used to decrypt incoming data and to create digital signatures.

Privilege Escalation

An attacker gaining higher permissions than they started with — e.g. from user to admin.

Privileged Access Management (PAM)

Tools that tightly control powerful administrator accounts: vaulting their passwords, recording their sessions, and granting access only when needed.

Proxy

A middleman server between you and the internet, hiding your IP or filtering traffic.

Public Key

The shareable half of a cryptographic key pair. Anyone can use your public key to send you encrypted messages or to verify your digital signatures.

Purple Team

A combined red (attack) and blue (defense) team that improves both sides together.

Quishing

Phishing through QR codes that lead to malicious websites. Scammers paste fake QR codes over real ones on parking meters and posters — always preview the URL before opening.

Ransomware

Malware that encrypts your files and demands payment for the key. Backups are the best defense.

RAT (Remote Access Trojan)

Malware giving an attacker full remote control of an infected device.

Red Team

The offensive security team that simulates real attackers to test defenses.

Replay Attack

Capturing valid data — like a login request — and resending it later to gain unauthorized access. Prevented with nonces, timestamps, and one-time session tokens.

Reverse Engineering

Taking apart software or malware to understand how it works, without access to its source code. Essential for malware analysis and for finding hidden vulnerabilities.

Risk Assessment

Identifying what could go wrong, estimating how likely and how damaging it would be, then deciding which risks to fix, accept, or insure against.

Rogue Access Point

An unauthorized WiFi access point on a network — planted by attackers, or set up carelessly by staff — that can intercept traffic. Found with wireless security scans.

Rootkit

Deeply hidden malware designed to stay invisible while giving attackers control.

RSA

One of the first public-key cryptosystems, named after Rivest, Shamir, and Adleman. Still widely used for secure key exchange and digital signatures.

Salting

Adding unique random data to each password before hashing it, so identical passwords produce different hashes. Defeats rainbow-table attacks against stolen password databases.

Sandbox

An isolated environment for safely running suspicious files or programs.

Script Kiddie

An unskilled attacker who uses ready-made hacking tools without understanding how they work. Noisy and easy to catch — but still dangerous against poorly defended targets.

Secure Boot

A startup feature that verifies software signatures before the operating system loads, blocking malware that tries to infect the boot process.

Secure Coding

Writing software with security built in from the start: validating all input, handling errors safely, and avoiding known bug patterns. Prevents vulnerabilities at their source.

Security Audit

A systematic, independent review of an organization’s security controls, policies, and legal compliance. Finds dangerous gaps before attackers — or regulators — do.

Security Awareness Training

Teaching employees to recognize phishing, use strong passwords, and handle sensitive data safely. Necessary because humans remain the most frequently attacked layer.

Security Baseline

The minimum agreed security settings every system must meet: password rules, logging, patching, and encryption. Each device is measured against the baseline.

Security Incident

Any event that threatens confidentiality, integrity, or availability — from a malware alert to a full data breach. Every incident triggers the incident response process.

Security Token

A physical or software device that generates login codes or cryptographic proof of identity — like a YubiKey or authenticator app. Stronger than SMS codes, which can be intercepted.

Session Hijacking

Stealing someone's active login session to impersonate them online.

Shadow IT

Hardware or software employees use without IT approval — personal cloud storage, unauthorized apps. Creates blind spots the security team cannot see or protect.

Shoulder Surfing

Stealing passwords or PINs by watching over someone’s shoulder or through cameras. Defeated with privacy screens and shielded keypads.

SIEM

Security Information and Event Management — software collecting and analyzing security logs centrally.

Signature-Based Detection

Identifying malware by matching it against fingerprints (signatures) of known threats. Fast and accurate for known malware, but blind to brand-new attacks.

SIM Swapping

Tricking a mobile carrier into transferring your phone number to the attacker’s SIM card, hijacking your SMS verification codes. Use app-based authenticators instead of SMS 2FA.

Single Sign-On (SSO)

Logging in once to access many applications — for example, one company account opening email, docs, and HR portals. Convenient, but that single account must be strongly protected.

Smishing

Phishing via SMS text messages, often with malicious links.

Sniffing

Capturing network packets to read traffic that is not encrypted. On open WiFi, anyone nearby can sniff — HTTPS and VPNs make captured packets useless.

SOAR (Security Orchestration, Automation and Response)

Platforms that automate repetitive security work: enriching alerts, blocking malicious IPs, and guiding analysts through response playbooks step by step.

SOC (Security Operations Center)

The team/facility monitoring an organization's security around the clock.

Spam

Unsolicited bulk messages, usually email. Often carries phishing links or malware attachments; filters block most of it, but some always slips through.

Spear Phishing

Phishing personalized for one specific target, using their name, job, or interests. Far more convincing than generic spam — verify unusual requests through a separate channel.

Spyware

Malware secretly spying on your activity, messages, and location.

SQL Injection

An attack inserting malicious database commands into a website's input fields.

SSL/TLS

Encryption protocols securing data in transit (the 'S' in HTTPS).

SSRF (Server-Side Request Forgery)

Tricking a web server into making requests to internal systems on the attacker’s behalf — potentially reaching databases or cloud credentials that are not internet-facing.

Steganography

Hiding secret data inside innocent-looking files, such as a message concealed in a photo. Used by spies — and by malware — to smuggle information past inspection.

Supply Chain Attack

Compromising software by attacking its supplier: tainted updates, hijacked code libraries, or breached vendors. A single such attack can infect thousands of downstream users.

Symmetric Encryption

Encryption where the same key both locks and unlocks data — AES is the leading example. Fast and simple, but both sides must exchange the key securely first.

Tailgating

Following an authorized person through a secured door without swiping a badge yourself. Defeated by turnstiles, security guards, and employee awareness.

Threat

Anything that could harm systems or data: attackers, malware, natural disasters, or human error. Risk exists wherever a threat meets a vulnerability.

Threat Actor

Whoever is behind an attack: cybercriminals, hacktivists, malicious insiders, or nation-states. Knowing the actor helps defenders predict goals and methods.

Threat Hunting

Proactively searching a network for hidden attackers instead of waiting for alerts to fire. Skilled hunters look for subtle anomalies that automated tools miss.

Threat Intelligence

Collected knowledge about attackers' tools and tactics, used to defend proactively.

Threat Model

A structured way of asking ‘what can go wrong?’ for a system: listing valuable assets, potential attackers, and likely attack paths before designing defenses.

Tokenization

Replacing sensitive data — like credit card numbers — with random tokens that are worthless if stolen. The real data stays locked inside a secure vault.

Tor

Privacy software routing traffic through volunteer relays to hide your identity and location.

Trojan Horse

Malware disguised as legitimate software to trick you into installing it.

TTP (Tactics, Techniques, and Procedures)

The ‘how’ of an attack: tactics are the attacker’s goals, techniques are their methods, and procedures are the specific steps taken. Threat intelligence tracks TTPs to anticipate future attacks.

Typosquatting

Registering misspelled domain names (like goggle.com) to catch mistyped visitors with phishing pages or malware. Always check URLs carefully before entering credentials.

UEBA (User and Entity Behavior Analytics)

Security tools that learn each user’s normal behavior and flag anomalies — like a 3 AM login from another country. Catches hijacked accounts and insider threats.

USB Drop Attack

Leaving infected USB drives in parking lots or offices, betting that curiosity will make someone plug one in. Never connect a USB device you found or received unexpectedly.

Virtual Machine (VM)

Software that emulates an entire computer inside your computer. Used to safely analyze malware, build isolated test labs, and run servers efficiently.

Virus

Malware that attaches itself to legitimate programs and spreads when those programs run. The classic malware type — still hunted by antivirus through signatures and behavior analysis.

Vishing

Voice phishing — scam phone calls pretending to be banks, police, or tech support.

VLAN (Virtual LAN)

Logically dividing one physical network into separate virtual networks. Keeps departments or device types isolated from each other without buying extra hardware.

VPN (Virtual Private Network)

An encrypted tunnel hiding your traffic from local snoopers, useful on public WiFi.

Vulnerability

A weakness in software or systems that attackers can exploit.

Vulnerability Assessment

Systematically scanning systems to discover known weaknesses, then ranking them by severity. Usually the first step before deeper penetration testing.

Vulnerability Management

The ongoing cycle of finding, prioritizing, fixing, and re-checking vulnerabilities. A mature security program treats it as continuous work, never a one-time task.

Vulnerability Scanning

Using automated tools to probe systems for known flaws and misconfigurations. Fast and broad coverage, but can miss complex or brand-new issues.

WAF (Web Application Firewall)

A firewall specialized in protecting websites from attacks like SQL injection.

Watering Hole Attack

Compromising websites that your targets visit frequently, infecting them when they stop by. Named after predators that wait near watering holes.

Whaling

Phishing targeted at high-profile victims like CEOs.

White Hat Hacker

An ethical hacker who tests systems with permission to improve security.

Wi-Fi Security (WPA2/WPA3)

The encryption standards that protect wireless networks. Use WPA3 — or WPA2 with a strong password — and avoid WEP and open networks entirely.

Worm

Self-replicating malware that spreads across networks without user action.

XDR (Extended Detection and Response)

EDR’s bigger sibling: it pulls threat data from endpoints, networks, email, and cloud into one correlated view, so analysts can respond faster to complex attacks.

XXE (XML External Entity)

An attack that abuses XML parsers to read files on the server or probe internal networks. Prevented by disabling external entities in the XML parser.

Zero Trust

A security model trusting nothing by default — every access request is verified.

Zero-Day

A vulnerability unknown to the vendor — with zero days of warning before attacks begin.