Most explanations of cyber security start with a definition and end with a list of products. Neither tells you what is actually going on when a company is breached or an account is hijacked, and neither tells you what to do about it. The field is easier than it sounds once you see the shape of it: a small number of things worth protecting, a small number of ways attackers reach them, and a short list of habits that close most of those routes.
What Is Cyber Security?
Cyber security is everything done to keep three properties true about information and the systems that hold it. The information stays private, so only the right people can read it. It stays intact, so nobody can change it without being noticed. And it stays available, so the people who need it can get at it. The field calls this the CIA triad, for confidentiality, integrity and availability, and almost every attack you will ever read about is an attack on one of the three. A leak breaks confidentiality. A tampered invoice breaks integrity. Ransomware breaks availability.
That is the whole definition. The rest of the field is the detail of who breaks those properties, how, and what stops them.
What Cyber Security Protects
It helps to be concrete about the things under protection, because each one is attacked differently and defended differently.
- Devices. Laptops, phones, servers, and increasingly the cameras, printers and thermostats on a network. An attacker who controls a device can see what it sees and do what it does.
- Accounts and identities. The email account, the bank login, the company single sign-on. An attacker who has your credentials does not need to break anything: they log in.
- Data. Customer records, health records, source code, the spreadsheet with everyone's pay. Data is what gets stolen, sold, published or held to ransom.
- The systems that run things. The website, the payment processor, the plant control system. When these stop, the business stops.
Defenses sit in layers around those things, and the layering is deliberate. No single control is reliable, so each one is there to catch what the one outside it missed.
Who Carries Out Cyber Attacks and Why
The word "hacker" hides a lot of variety. The people behind attacks fall into a few groups, and knowing which one you are likely to meet changes what you defend against.
| Who | What they want | How they usually work |
|---|---|---|
| Financially motivated criminals | Money: ransoms, stolen cards, fraud, resale of data | Phishing, ransomware, extortion, at scale, against whoever is easiest |
| State-sponsored groups | Information, access, disruption | Patient, targeted intrusions into governments, contractors, infrastructure and the companies that supply them |
| Insiders | Money, revenge, or nothing at all | Misuse of access they already have, or a mistake with real consequences |
| Hacktivists | Attention | Defacements, leaks, denial of service against a cause's targets |
| Opportunists | Whatever is lying around | Automated scanning for anything exposed and unpatched |
For almost everyone reading this, the first group is the one that matters. It is by far the largest, it does not care who you are, and it runs on volume.
How Most Cyber Attacks Happen
Films show attackers breaking codes. Real attacks mostly involve someone logging in with a stolen password, someone clicking a link, or someone exploiting a flaw in software that a patch fixed months ago. The doors are few, and they are the same doors year after year.
The four doors, in the order the evidence ranks them right now:
- A flaw in software. Every program has bugs, some of which let an outsider run code or read data they should not. Vendors publish fixes; attackers race the people who have not installed them. In the 2026 Verizon Data Breach Investigations Report, exploiting vulnerabilities was the top entry point for the first time in the report's 19 years, at 31 percent of breaches, and AI has shrunk the time from a flaw being published to it being used from months to hours.
- A password. Stolen in a phishing attack, guessed, or reused from a breach at another site. Credential abuse was the leading entry point until this year and remains a close second.
- A person. Phishing emails, phone calls from "IT support," text messages about a package. The same report found that social engineering on mobile devices succeeded 40 percent more often than the year before. How these attacks are built is the subject of the phishing explainer.
- A supplier. Your data sits with your payroll provider, your marketing platform, your IT contractor. The 2026 report found third-party involvement in breaches up 60 percent, to 48 percent of all breaches.
Once through a door, the attack follows a pattern that is remarkably consistent, whether the target is a hospital or a hardware store.
- EntryA phished password, an unpatched server, a supplier account
- FootholdA tool installed so they can come back
- MoveFrom one machine to the ones that matter
- TakeCopy data out, or encrypt it in place
- ExtortPay for the key, or pay so the data is not published
- Detect and containThe earlier this step lands, the less of the rest happens
The threats themselves, ranked by how often they actually cause breaches and with the mechanism of each drawn out, are in cyber security threats explained.
Types of Cyber Security
Job titles and vendor categories slice the field into specialties. They all defend the same four things, just from different angles.
| Type | What it covers | What it looks like in practice |
|---|---|---|
| Network security | Traffic moving between machines | Firewalls, segmentation, intrusion detection |
| Endpoint security | The devices themselves | Antivirus and its successor, endpoint detection and response |
| Identity and access management | Who can log in to what | Multi-factor authentication, single sign-on, least privilege |
| Application security | The software a company builds and runs | Code review, testing, patching |
| Cloud security | Data and workloads hosted by someone else | Configuration, access control, encryption |
| Data security | The information itself | Encryption, classification, backups |
| Operational technology security | Systems that control physical things | Isolation of plant and building systems from the office network |
| Security operations | Watching for and responding to attacks | A security operations center, in-house or hired |
| Awareness and training | The people | Teaching staff what phishing looks like and what to do |
A small business does not need a specialist for each row. It needs the basics in each row done, which is usually one person or one firm covering all of them.
How to Protect Yourself From Cyber Attacks
Government agencies and the big annual reports keep arriving at the same short list, because the same few controls keep closing the same few doors. None of them require expertise. All of them require actually doing them.
Cyber Security for Individuals, Small Businesses and Security Teams
The field has one set of principles and three very different audiences. The right amount of effort depends on which one you are.
How Much a Data Breach Costs
The average is large and the range is enormous. IBM's 2026 Cost of a Data Breach study puts the global average at $4.99 million, a record and 12 percent up on the year before, with financial services breaches averaging $6.3 million. One in four malicious breaches in the study were AI-enabled, and those cost about $6 million each. Ransomware appeared in 39 percent of the breaches studied, up from 34 percent.
For an individual, the cost is measured differently: months of targeted scams, a frozen credit file, and the hours spent proving a loan was not yours. The breach reports on this site are written to make the second kind of cost concrete.
Cyber Security Terms Explained
Ten terms cover most of what you will read. Each is a section or a page somewhere on this site; these are the one-line versions.
| Term | What it means |
|---|---|
| Vulnerability | A flaw in software or a setup that an attacker could use |
| Exploit | Code or a technique that uses a vulnerability |
| Patch | The vendor's fix for a vulnerability. Installing it is what "updating" means |
| Malware | Any software written to do harm: viruses, trojans, spyware, ransomware |
| Ransomware | Malware that encrypts your files and demands payment for the key, now usually paired with a threat to publish what was stolen |
| Phishing | A message designed to make you hand over a password, click a link or send money |
| Multi-factor authentication | Proving who you are with something more than a password: a code, a prompt, a key |
| Encryption | Scrambling data so it is unreadable without the key |
| Firewall | A filter that decides which network traffic is allowed through |
| Endpoint detection and response | Software on a device that watches for attacker behavior rather than just known viruses |
Is Cyber Security a Good Career?
The question shows up in almost every search on this topic, so the short answer belongs here. Yes, with a caveat. Demand for people who can do the work is real and pay is strong, but the entry-level market is crowded with people who hold a certificate and cannot yet do the work. The path in usually runs through IT support or networking first, then a specialization. The careers and certifications pages cover which certifications employers actually ask for and what the jobs pay.
Key takeaways
- Cyber security keeps information private, intact and available. Almost every attack breaks one of the three.
- Attacks get in through four doors: a software flaw, a stolen password, a tricked person, or a breached supplier. Software flaws overtook passwords as the top entry point in 2026.
- Multi-factor authentication, updates, long unique passwords, backups, skepticism about unexpected messages and least privilege stop most attacks. None require expertise.
- Forced password rotation is the habit most people have that does not help. Length and uniqueness do.
- A small business is a volume target and usually hires its monitoring rather than building it.
- The average breach cost a company $4.99 million in 2026. For an individual, the cost is months of targeted scams and a frozen credit file.
Common questions
What is cyber security in simple words?
Cyber security is keeping your devices, accounts and data safe from people who want to steal, damage or lock them. In practice it means a short list of habits: a second factor on your logins, updates installed, long unique passwords, backups, and treating unexpected messages with suspicion.
What is the difference between cyber security and information security?
Information security is the broader term: protecting information in any form, including paper files and conversations. Cyber security is the part of it concerned with digital systems and networks. In everyday use the two are interchangeable, and job titles use them that way.
What are the main types of cyber security?
Network security, endpoint security, identity and access management, application security, cloud security, data security, operational technology security, security operations and awareness training. They all protect the same things from different angles, and a small organization needs the basics of each rather than a specialist in each.
What is the CIA triad?
Confidentiality, integrity and availability: information stays private, stays unaltered, and stays reachable by the people who need it. It is the oldest model in the field and still the quickest way to classify an attack.
What is the most common type of cyber attack?
By complaint count, phishing and spoofing, with 191,561 reports to the FBI's Internet Crime Complaint Center in 2025. By what actually causes breaches at organizations, exploiting software vulnerabilities overtook stolen credentials in the 2026 Verizon report, at 31 percent.
Is cyber security hard to learn?
The fundamentals are not. The habits that stop most attacks fit on one page and require no technical background. Working in the field is harder, because it rests on networking, operating systems and programming knowledge that takes time to build, and the entry-level job market is crowded.
Is cyber security a good career?
Demand and pay are strong, and the work is varied. The honest caveat is that a certificate alone rarely gets a first job; most people enter through IT support or networking and specialize from there.
Do I still need antivirus?
Yes, in the form your operating system already includes, kept up to date. On a business network the modern version is endpoint detection and response, which watches for attacker behavior rather than only known malware.
What does a cyber security company actually do?
Most sell monitoring: they watch your devices and accounts around the clock and respond when something is wrong. Others do projects, such as testing your defenses, helping you meet a compliance standard, or responding to an incident that has already happened.
How much does cyber security cost for a small business?
Managed monitoring is usually priced per device or per user per month and often lands in the low thousands of dollars a year for a company of around fifty people. A penetration test is a scoped project from a few thousand dollars upward. The single cheapest control, multi-factor authentication, is free.
Can I do cyber security myself?
As an individual, yes, completely. The six habits on this page are the program. As a business, you can enforce the habits yourself, but somebody has to be watching for intrusions at three in the morning, and that is the part most companies hire.
On this page
- What Is Cyber Security?
- What Cyber Security Protects
- Who Carries Out Cyber Attacks and Why
- How Most Cyber Attacks Happen
- Types of Cyber Security
- How to Protect Yourself From Cyber Attacks
- Cyber Security for Individuals, Small Businesses and Security Teams
- How Much a Data Breach Costs
- Cyber Security Terms Explained
- Is Cyber Security a Good Career?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.