Cyber Security Terms: 92 Definitions in Plain English

The vocabulary is the barrier. Someone tells you the SOC saw lateral movement after initial access through a phished credential, and the sentence is either obvious or meaningless depending on five words you either have or do not. Every glossary on the internet answers that by listing terms alphabetically, which puts trojan next to two-factor authentication and leaves you no way to tell which one is the problem and which one is the fix.

This one is grouped by what each word does. Threats first, then defenses, then the people and the process that run them, then the compliance vocabulary that shows up in contracts. Read it in order and the words arrive already sorted into the two piles that matter: things that attack you, and things that stop them. The page assumes you already know roughly what cyber security is and want the words the field uses to talk about it.

What Are the Key Terms of Cyber Security?

Twelve words carry the rest. Every other term on this page is a specific instance of one of these, and getting them in the right order early saves a great deal of confusion later. They are listed in the order they depend on each other rather than alphabetically, which is also the order the field itself uses when it reasons about a problem.

• Asset. Anything worth protecting: customer records, a payroll system, a laptop, a domain name, the ability to take orders on Monday morning. Security work starts by naming assets, because a control you cannot tie to an asset is a control nobody can justify.
• Threat. Something that could cause harm to an asset. A threat is a possibility, not an event. Ransomware is a threat to your file server whether or not it ever arrives.
• Threat actor. The person or group behind a threat. Criminal crews after money, nation-state groups after information, hacktivists after attention, and insiders acting deliberately or by accident. Naming the actor changes what you should expect them to do next.
• Vulnerability. A weakness that a threat could use. Unpatched software, a password reused from another site, a permission nobody removed when someone changed jobs, a process that lets an urgent email change a bank account.
• Exploit. The specific technique or piece of code that turns a vulnerability into access. The vulnerability is the unlocked window; the exploit is climbing through it.
• Attack surface. Everything an attacker could reach and try. Every internet-facing service, every laptop, every third-party application connected to your email, every employee with a mailbox. Reducing the attack surface means having fewer of those, not defending each one harder.
• Attack vector. The particular route taken on a given attempt: an email, an exposed remote desktop port, a stolen password, a compromised supplier.
• Risk. The combination of how likely a threat is to exploit a vulnerability and how much damage it would do. Risk is the number a business can actually make decisions with, because it accounts for consequence rather than just possibility.
• The CIA triad. Confidentiality, integrity and availability: the three properties security exists to preserve. Confidentiality is that only the right people can read it. Integrity is that nobody changed it without authorization. Availability is that it works when you need it. Ransomware is memorable because it attacks all three at once.
• Authentication. Proving you are who you claim to be, with a password, a code, a fingerprint or a hardware key. Abbreviated authN.
• Authorization. Deciding what you are allowed to do once you have proved it. Abbreviated authZ. A great many breaches are authorization failures rather than authentication failures: the login was legitimate, and the account could reach far more than it should have.
• Event and incident. An event is anything that happens on a system, of which there are millions a day. An incident is an event that actually harmed, or plausibly could harm, an asset. The whole detection industry exists to turn the first number into the second.

None of these definitions is ours to invent. The National Institute of Standards and Technology publishes the Computer Security Resource Center glossary, which aggregates terms from NIST's own standards and from CNSSI 4009-2022 across roughly ten thousand entries, with a warning worth repeating: each term and definition pair only means what it means inside the source document it came from. If a definition below matters to a contract you are signing, check the source rather than any glossary, this one included. If the whole subject is new, the beginner's walk through the basics covers the same ground more slowly and with fewer words at once.

What Are the 7 Pillars of Cybersecurity?

Search results for this question are mostly invented. Vendors publish lists of seven pillars that do not agree with each other, and no standards body publishes a general seven-pillar model of cyber security at all. What does exist, and what the phrase almost certainly traces back to, is the Department of Defense zero trust model.

The General Services Administration states it plainly in its Zero Trust Strategy Buyer's Guide for the DoD strategy: the approach includes seven pillars of zero trust, being User, Device, Application and Workload, Data, Network and Environment, Automation and Orchestration, and Visibility and Analytics. That is the list, from a US government document, and it is a zero trust architecture model rather than a description of the field as a whole.

Two other numbers circulate for the same idea, which is why the question keeps getting different answers. CISA's Zero Trust Maturity Model uses five pillars plus three cross-cutting capabilities, with four stages of progress in each: Traditional, Initial, Advanced and Optimal. The NIST Cybersecurity Framework, which is the model most US organizations actually get measured against, uses six Functions rather than pillars at all. The underlying architecture idea is the same one covered in zero trust: stop treating a position on the network as proof of anything.

Cyber Security Terms for Threats and Attacks

Thirty-one words for the ways things go wrong, in four runs: the malware family, the social engineering family, the network and application attacks, and the verbs describing what an intruder does once inside.

The malware family

• Malware. Any software written to do harm. It is the umbrella word, and viruses, worms, trojans, spyware and ransomware are all species of it. The distinctions below are about how the software spreads and what it does, which is exactly what malware sorts out in detail.
• Virus. Malware that attaches itself to a file or program and spreads when a person runs that file. The defining feature is that it needs human action to travel.
• Worm. Malware that spreads by itself across a network with no human action at all, which is why worm outbreaks move in minutes rather than weeks.
• Trojan. Malware disguised as something you wanted: a free tool, a cracked application, an invoice attachment. There is no self-replication; the disguise is the whole mechanism.
• Ransomware. Malware that encrypts files and demands payment for the key, now almost always paired with stealing the data first so the crew can extort you twice. Ransomware is sold as a service by groups who rent their software to other criminals in exchange for a share.
• Spyware. Software that watches and reports: browsing, files, screenshots, messages. Sometimes criminal, sometimes commercial, occasionally installed by someone the victim knows.
• Keylogger. A specific kind of spyware that records keystrokes, which captures passwords typed into any application regardless of how good the site's security is.
• Botnet. A network of compromised machines under one operator's control, rented out for spam, credential stuffing, fraud or flooding a target with traffic. Individual owners usually notice nothing.
• Command and control. Abbreviated C2. The channel malware uses to reach its operator for instructions and to send data out. Blocking C2 traffic is one of the few defenses that works after an infection has already happened.

The social engineering family

• Social engineering. Attacking the person rather than the software: persuading someone to hand over a credential, approve a login, open a file or move money. It is the category that survives every technical control, and social engineering is behind a large share of the incidents in the news.
• Phishing. A message impersonating someone you trust, usually to harvest a password or an approval. Phishing is the most reported internet crime in the United States, on the FBI complaint figures set out further down this page.
• Spear phishing. Phishing aimed at one person or team after research, using their name, role and real projects. Whaling is the same thing aimed at an executive. The per-message success rate is far higher than bulk phishing.
• Smishing and vishing. Phishing by text message and by phone call. Vishing has become the professional's tool, because a phone call can walk a help desk through a password reset in a way an email cannot.
• Business email compromise. Abbreviated BEC. Fraud that asks for money rather than a password: a changed bank account on a real invoice, an urgent wire, a supplier payment redirected. Per complaint business email compromise is by far the most costly attack in this section, which the FBI loss figures further down make plain.
• Pretexting. The invented story that makes a request believable. The new supplier, the auditor with a deadline, the IT technician fixing an outage. Every social engineering attack has one.
• MFA fatigue. Also called push bombing. The attacker already has the password and sends approval prompts repeatedly until the victim taps approve to make them stop. It is the reason number matching replaced simple approve buttons.

Knowing the tells in a phishing email is the single highest-value thing on this list for an individual reader, because it is the only category here where a human being is the control.

Network and application attacks

• Denial of service. Flooding a service until it stops responding. A distributed denial of service, or DDoS, does it from thousands of machines at once, which is what a botnet is usually rented for. A denial of service attack does not steal anything; it removes availability, one third of the CIA triad.
• Man in the middle. Sitting between two parties and reading or altering what passes, typically on a network the attacker controls. A man in the middle attack is the reason certificate warnings in a browser are worth reading rather than clicking through.
• SQL injection. Sending database commands through a web form or URL that the application passes to its database without checking. Old, still common, and still capable of dumping an entire customer table.
• Cross-site scripting. Abbreviated XSS. Getting your script to run in someone else's browser session on a site they trust, which can steal their session and act as them.
• Zero-day. A vulnerability with no patch available, either because the vendor does not know yet or has not shipped a fix. A zero-day is valuable precisely because no defender can be up to date against it.
• Supply chain attack. Compromising a supplier to reach its customers: a software update, a managed service provider, a hosted application holding your data. A supply chain attack works because the trust is already granted, so nothing about the access looks wrong.

What an intruder does once inside

• Credential stuffing. Taking username and password pairs from one breach and trying them at scale on other sites. Credential stuffing works only because password reuse is close to universal, which is why unique passwords matter more than complex ones.
• Password spraying. The inverse: one common password tried against thousands of accounts, slowly enough to avoid lockouts.
• Initial access. The first foothold. The most common routes are a stolen credential, a phished login, an exposed unpatched service and a compromised supplier.
• Privilege escalation. Turning a low-value account into a powerful one, either by exploiting a flaw or by finding credentials lying around on the machine already reached.
• Lateral movement. Spreading sideways from the first machine to the ones that matter. This is the phase where most intrusions could still be stopped, and the phase most organizations cannot see.
• Exfiltration. Copying data out. Usually to cloud storage over normal encrypted web traffic, which is why exfiltration rarely looks unusual on a firewall.
• Insider threat. Harm from someone who already has access. Mostly accidental, occasionally deliberate, and difficult because every control assumes the person belongs there.
• Advanced persistent threat. Abbreviated APT. CISA's NICCS glossary defines it as an adversary with sophisticated expertise and significant resources that can create opportunities using multiple attack vectors. In practice the word signals a well-funded group willing to stay hidden for months rather than cash out on Friday.
• Data breach. Confirmed unauthorized access to or disclosure of data. A data breach is the outcome, not the method, and is the word that triggers legal notification deadlines.

What Are the 7 Types of Cyber Security Threats?

The thirty-one terms above sort into seven families, and sorting them is more useful than memorizing them, because a defense usually works against a whole family rather than one named attack.

1. Malware. Anything running code you did not want run, from a keylogger to ransomware.
2. Social engineering. Phishing, vishing, business email compromise, pretexting. The person is the target.
3. Identity and credential attacks. Credential stuffing, password spraying, MFA fatigue, session theft. The login is real; the person behind it is not.
4. Network attacks. Denial of service, man in the middle, attacks on exposed remote access.
5. Application and web attacks. SQL injection, cross-site scripting, and exploitation of unpatched internet-facing software.
6. Supply chain and third-party attacks. Your supplier's compromise becomes yours. The 2026 Verizon Data Breach Investigations Report found breaches involving a third party accounting for 48 percent of all breaches, with supply chain incidents up 60 percent year on year, and 31 percent of all breaches starting with vulnerability exploitation.
7. Insider and human error. Misconfiguration, a file shared with the wrong person, an unhappy employee, an account nobody disabled.

The pattern that matters is the top right: identity attacks and social engineering are both common and damaging, which is why multi-factor authentication and phishing awareness outrank almost everything else a small organization could buy. The current threat picture goes through each family with what it looks like from the receiving end.

Cyber Security Terms for Defenses and Controls

Twenty-three words for the things that stop the words above. Grouped by what they defend: the device and the network, the identity, and the data itself.

On the device and the network

• Firewall. A filter between two networks that allows or blocks each connection against rules you set. A firewall enforces a policy about what may connect; it does not judge whether an allowed connection is honest.
• Antivirus. Software that looks for known-bad files by signature and by behavior. Necessary, no longer sufficient on its own, and still the thing most home users mean by security software.
• Endpoint detection and response. Abbreviated EDR. Antivirus plus a recording of what happened: which process started which, what it touched, where it connected. Endpoint detection and response is what lets an investigator answer questions after the fact rather than guess.
• SIEM. Security information and event management: a system that collects logs from everything and correlates them into alerts. A SIEM is the difference between having logs and being able to answer a question with them.
• SOAR. Security orchestration, automation and response. The layer that turns an alert into an automatic action, such as disabling an account or isolating a laptop, without waiting for a human.
• Intrusion detection and prevention. An IDS watches traffic and alerts on suspicious patterns. An IPS does the same and blocks. The difference is whether it is allowed to act on its own.
• Web application firewall. Abbreviated WAF. A filter in front of a website that inspects HTTP requests for injection and abuse, rather than looking at ports and addresses.
• DNS filtering. Blocking name lookups for known-malicious domains, which stops a click before a connection is ever made. Cheap, effective, and frequently the first control a small company should turn on.
• Network segmentation. Splitting a network so that reaching one part does not mean reaching everything. It is the control that turns a full-company outage into a bad afternoon in one department.

On identity

• Multi-factor authentication. Requiring more than one kind of proof: something you know, something you have, something you are. Multi-factor authentication defeats an attacker holding only a stolen password, which is the position almost every credential attack starts from, and it is the single highest-value control on this page.
• Passkey. A cryptographic credential stored on your device that replaces the password entirely and cannot be typed into a fake site, because it refuses to work on the wrong domain. The phishing-resistant end of the MFA spectrum, alongside hardware security keys.
• Password manager. Software that generates and stores a unique password per site. The security benefit people miss is that it will not autofill on a look-alike domain, which makes it a phishing detector as well as a vault. Pair it with a strong passphrase on the vault itself.
• Single sign-on. Abbreviated SSO. One identity provider authenticates you once for many applications. It reduces password sprawl and concentrates risk: whoever holds that one account holds everything behind it.
• Least privilege. Giving every account only the access it needs for its job, and nothing else. It is the control that decides how far an intrusion can travel after step one.
• Zero trust. An architecture that grants no trust based on network location and verifies every request against identity, device health and policy. Not a product, despite the marketing.
• Privileged access management. Abbreviated PAM. Controls specifically for administrator accounts: checked out when needed, recorded while in use, rotated afterward.

On data and software

• Encryption. Turning readable data into unreadable data that only a key can reverse. Encryption in transit protects data moving between machines; encryption at rest protects it sitting on a disk. Neither protects data from an attacker holding a valid login.
• Hashing. A one-way transformation that produces a fixed-length fingerprint of data and cannot be reversed. Passwords should be stored hashed and salted, meaning with a unique random value mixed in per password, so that identical passwords do not produce identical fingerprints.
• VPN. A virtual private network, an encrypted tunnel between your device and somewhere else. A corporate VPN puts you on the office network. A consumer VPN moves your traffic's apparent origin, which is a privacy tool rather than a security one, and it is oversold as the latter.
• Patch management. The process of finding, testing and installing software updates. Dull, unglamorous, and the direct answer to the DBIR finding that nearly a third of breaches start with vulnerability exploitation.
• Vulnerability scanning. Automated checking of systems against a database of known flaws. Vulnerability scanning tells you what is missing a patch; it does not tell you whether anyone could actually exploit it in your environment.
• Penetration testing. A person attempting to break in under agreed rules and reporting how they did it. Penetration testing answers the question a scanner cannot: what a skilled attacker could actually reach.
• Backup. A copy of data held separately, and the control that most reliably defeats ransomware. CISA's rule of thumb is three copies, on two kinds of media, with one off-site, and at least one copy immutable or offline so it cannot be encrypted along with everything else. A backup nobody has restored from is a hypothesis, not a backup.

Cyber Security Terms for People and Process

Thirteen words for who does the work and what the work is called. This is the vocabulary of job titles, meeting names and the metrics a board asks about.

• Security operations center. Abbreviated SOC. The team, and often the room, that monitors alerts and responds to them. A security operations center can be in-house, outsourced, or a hybrid where a provider covers nights and weekends.
• CISO. Chief information security officer, the executive accountable for security. Smaller companies buy the role by the day as a virtual CISO or vCISO.
• Red team. People attacking on purpose, with permission, to test defenses. A red team engagement is broader than a penetration test: the goal is a stated objective, such as reaching payroll data, by any route.
• Blue team. The defenders. Purple teaming is the two working together in the open rather than as a contest, which produces better fixes and worse stories.
• Threat intelligence. Information about who is attacking whom and how, used to decide what to defend against first. Useful when it changes a decision, decorative when it does not.
• Threat hunting. Actively searching logs for intrusions no alert fired on, starting from a hypothesis rather than an alarm. It exists because detection rules only find what someone thought of in advance.
• Incident response. The process of handling an incident from detection through containment, eradication, recovery and the lessons afterward. An incident response plan written before an incident is the difference between a bad week and a catastrophic one.
• Playbook. A written procedure for one incident type: ransomware, a lost laptop, a compromised mailbox. Playbooks exist so that decisions are made in advance rather than at two in the morning.
• Tabletop exercise. A discussion-based rehearsal where the team talks through a scenario. The value is almost always in discovering that nobody knows who calls the insurer or where the offline contact list lives.
• Mean time to detect and mean time to respond. Abbreviated MTTD and MTTR. How long from intrusion to noticing, and from noticing to containing. These two numbers describe a security program better than any list of products.
• Security awareness training. Teaching staff to recognize attacks aimed at them. It works when it builds a reflex, such as verifying money by phone, and fails when it is an annual video people click through.
• MSSP and MDR. A managed security service provider runs security tools for you. Managed detection and response goes further and takes responsibility for investigating and acting on what those tools find. The second costs more and is what most small companies actually need.
• Bug bounty. Paying outside researchers for vulnerabilities they report, under a published policy. Coordinated disclosure is the same idea without money: a stated way for a stranger to tell you about a flaw without a lawyer getting involved.

Getting into this work has its own vocabulary of qualifications, and the certifications employers ask for sorts out which initials after a name mean what.

Cyber Security Terms for Compliance and Governance

Thirteen words that show up in contracts, questionnaires and audits. This vocabulary is where security meets procurement, and where a wrong definition costs real money.

• Control. A specific safeguard, technical or administrative, that reduces a risk. Frameworks are lists of controls; audits check whether yours exist and work.
• Risk assessment. A structured review of what could go wrong, how likely it is and what it would cost, producing a ranked list rather than a feeling.
• Audit and attestation. An audit is an independent examination against a standard. An attestation is the auditor's signed statement of what they found. Note that neither is a certification, and that the two words are not interchangeable.
• SOC 2. An attestation report from a licensed CPA firm on the design, and in a Type 2 report the operating effectiveness over time, of controls against the Trust Services Criteria. SOC 2 is the report US software buyers ask for most often.
• ISO 27001. An international standard for an information security management system, and unlike SOC 2 a genuine certification issued by an accredited body. The favored answer outside the United States.
• PCI DSS. The Payment Card Industry Data Security Standard, which applies to anyone who stores, processes or transmits card data. PCI DSS is contractual rather than statutory, enforced by the card brands and acquiring banks.
• HIPAA. The US health privacy law governing protected health information held by providers, plans and their business associates. Its Security Rule sets the safeguards and its Breach Notification Rule sets the deadlines.
• GDPR. The European Union's General Data Protection Regulation, which reaches US companies that handle EU residents' personal data. Its 72-hour breach notification window to a supervisory authority is the clause most often missed.
• CCPA. The California Consumer Privacy Act, as amended by the CPRA, giving California residents rights over their personal information. The template most other US state privacy laws now follow.
• NIST Cybersecurity Framework. A voluntary framework, at version 2.0, organizing security outcomes into six Functions. It is the common language US organizations use to describe a program to a board or an insurer.
• CMMC. The Cybersecurity Maturity Model Certification, the Department of Defense program requiring contractors handling controlled unclassified information to be assessed against NIST SP 800-171.
• PII and PHI. Personally identifiable information and protected health information. Which category data falls into determines which law applies, which deadlines run, and what a breach costs.
• Breach notification. The legal obligation to tell regulators and affected people after a breach, on a deadline that varies by state, sector and country. It is why the word breach is used carefully by lawyers and loosely by everyone else, and why what to do after a data breach is a process rather than an apology.

The framework the compliance vocabulary keeps circling back to is worth having in full. NIST published version 2.0 of the Cybersecurity Framework in February 2024, and its six Functions are the closest thing to an authoritative answer to what a security program is supposed to do.

Govern was added in version 2.0 and sits at the center of NIST's own diagram, because it informs how an organization implements the other five.

Cyber Security Acronyms and What They Stand For

Half the vocabulary is initials, and most people meet the initials before the words. This is the lookup table for a reader who arrived holding an acronym from an email.

Cyber Security Terms That Get Confused

Seven pairs account for most of the confusion, and each one is a distinction with a practical consequence.

• Threat against vulnerability against risk. The threat is what could hurt you, the vulnerability is the weakness it would use, and the risk is the two combined with the damage it would do. A threat with no matching vulnerability is not a risk, which is why patching changes risk and worrying does not.
• Virus against malware. Every virus is malware; most malware is not a virus. Virus means specifically that it attaches to a file and needs a person to run it, which describes very little of what circulates today.
• Encryption against hashing. Encryption is reversible with the key, so it is for data you need back. Hashing is one-way, so it is for verifying something matches without storing it. Passwords are hashed, never encrypted; if a service can email you your existing password, it did this wrong.
• Authentication against authorization. Authentication is proving who you are. Authorization is what you may do afterward. Multi-factor authentication fixes the first and does nothing at all for the second, which is what least privilege is for.
• IDS against IPS. Detection alerts a human. Prevention blocks automatically. The trade-off is that a false positive from an IDS wastes an analyst's time, while a false positive from an IPS takes down a service.
• MSSP against MDR. A managed security service provider operates your tools and forwards you alerts. A managed detection and response provider investigates those alerts and takes agreed action. The first sells you capacity, the second sells you an outcome.
• Penetration test against red team engagement. A penetration test finds as many vulnerabilities as possible in a defined scope and reports them. A red team pursues one objective by any available route, including social engineering and physical entry, and tests whether the defenders notice. Asking for the second and buying the first is a common and expensive mix-up.

For an individual rather than a company, one more distinction matters more than any of these: a credit freeze is not the same as a fraud alert. If your data appeared in a breach, freeze your credit with all three bureaus rather than relying on an alert, because a freeze blocks new accounts and an alert only requests extra verification.

Where Official Cyber Security Definitions Come From

Four sources carry the authoritative definitions in the United States, and all four are free.

The NIST Computer Security Resource Center glossary is the largest, aggregating terms from NIST standards and CNSSI 4009-2022 into roughly ten thousand entries, each showing the publication it came from. Its own guidance is to cite the source publication rather than the glossary page, because terminology changes as documents are published and withdrawn. NIST IR 7298 Revision 3, the Glossary of Key Information Security Terms, published in July 2019, describes that online glossary and the database of terms behind it, drawn from FIPS publications, the SP 800 series, selected internal reports and CNSSI 4009.

CISA publishes the NICCS glossary, which it describes as complementing NIST IR 7298 Rev. 3, and which is the friendlier of the two for a reader outside government. Each entry carries a definition, often an extended definition, related terms, and a citation to wherever the definition originates. CNSSI 4009, the Committee on National Security Systems glossary, sits underneath both as the source of many federal definitions.

Checking a word takes about a minute. Search the CSRC glossary for the term, read the definition, and look at which publication it came from. If two definitions disagree, the one from the document that governs your situation wins, which in practice means the standard your contract or regulator names. This is the step that separates a word used precisely from a word used decoratively, and in a contract or a breach notification the difference is expensive.