Glossary
Cybersecurity glossary
Plain-English definitions of 46 essential malware, phishing, and security terms — written for non-specialists.
A
- Adware
- Software that automatically displays or downloads advertising material, often without the user's clear consent. Adware is sometimes bundled with free programs and can degrade performance or track browsing habits.
- Antivirus
- A program that detects, prevents, and removes malicious software. Modern antivirus tools combine signature-based detection (matching known malware) with heuristic and behavioural analysis (detecting suspicious patterns).
- APT (Advanced Persistent Threat)
- A sophisticated, often nation-state-sponsored attacker who maintains long-term, stealthy access to a target network — typically to exfiltrate data over months or years.
B
- Backdoor
- A hidden method of bypassing normal authentication to gain remote access to a system. Backdoors may be intentionally installed by attackers or accidentally left in software by developers.
- Botnet
- A network of internet-connected devices infected with malware and remotely controlled by an attacker. Botnets are commonly used for DDoS attacks, spam delivery, and credential stuffing.
- Brute-force attack
- An attack that tries every possible password or key until the correct one is found. Defended by rate-limiting, account lockouts, and using long, unique passwords.
C
- C2 (Command and Control)
- The infrastructure attackers use to send commands to compromised devices and receive stolen data. Blocking C2 traffic is a key defensive goal.
- CVE (Common Vulnerabilities and Exposures)
- A public catalogue of disclosed security vulnerabilities, each with a unique identifier like CVE-2025-12345. Patching CVEs in your stack is a baseline security practice.
D
- DDoS (Distributed Denial of Service)
- An attack that overwhelms a server or service with traffic from many sources, making it unavailable to legitimate users.
- Doxxing
- The act of publicly revealing private personal information about an individual — typically gathered through OSINT — usually as harassment or coercion.
- Dropper
- A small malicious program whose sole purpose is to install ("drop") additional malware onto the victim's system. Droppers are often disguised as innocent files.
E
- EDR (Endpoint Detection and Response)
- A class of security tools that continuously monitor endpoints (laptops, servers) for suspicious behaviour and enable rapid investigation and remediation.
- EICAR test file
- A harmless 68-byte file used by the security industry to test antivirus engines. Any properly functioning scanner detects it as a virus, even though it cannot cause damage.
- Encryption
- The process of scrambling data with a key so that only someone with the matching key can read it. Encryption protects data in transit (HTTPS) and at rest (full-disk encryption).
- Exploit
- Code or a technique that takes advantage of a vulnerability to perform an unauthorised action — for example, executing arbitrary code on a target.
F
- Firewall
- A network security device or software that filters incoming and outgoing traffic according to defined rules. A firewall is your first line of defence against unsolicited connections.
H
- Hash
- A fixed-length fingerprint computed from arbitrary input data. Cryptographic hashes (SHA-256) are used to verify file integrity and identify known files (malware or otherwise) without storing the file itself.
- Heuristic detection
- An antivirus technique that flags files based on suspicious behaviour or code patterns rather than exact signature matches — useful for catching previously unknown malware variants.
- Honeypot
- A decoy system deliberately exposed to attackers to study their techniques and gather intelligence without putting real assets at risk.
I
- IOC (Indicator of Compromise)
- Evidence that a system has been breached — for example, a malicious file hash, a known-bad IP address, or an unusual registry key.
K
- Keylogger
- A program (or hardware device) that records every keystroke, typically to capture passwords, credit card numbers, and private messages.
M
- Malware
- An umbrella term for any malicious software, including viruses, worms, trojans, ransomware, spyware, and adware.
- MFA (Multi-Factor Authentication)
- An authentication method requiring two or more independent factors — something you know (password), something you have (phone/key), or something you are (biometric).
- MITM (Man-in-the-Middle)
- An attack where the attacker secretly relays and potentially alters communications between two parties who believe they are talking directly to each other.
O
- OSINT (Open-Source Intelligence)
- Intelligence gathered from publicly available sources — social media, public records, leaked databases — often used as the first stage of a targeted attack.
P
- Patch
- A software update that fixes bugs or security vulnerabilities. Applying patches promptly is one of the most effective defences against opportunistic attacks.
- Phishing
- A social-engineering attack where an attacker impersonates a trusted party — usually via email — to trick the victim into revealing credentials, transferring money, or running malware.
- PUP / PUA (Potentially Unwanted Program / Application)
- Software that is not strictly malicious but exhibits unwanted behaviour such as bundled adware, browser hijacking, or aggressive notifications.
R
- Ransomware
- Malware that encrypts the victim's files and demands payment for the decryption key. Modern ransomware often also exfiltrates data and threatens public release.
- RAT (Remote Access Trojan)
- A trojan that gives an attacker covert remote control over an infected device, including screen, webcam, files, and keyboard.
- Rootkit
- Malware designed to hide its presence on a system at the operating-system level. Rootkits are notoriously hard to detect and remove because they may compromise the very tools used to inspect them.
S
- Sandbox
- An isolated environment in which untrusted code can run without affecting the host system. Security analysts use sandboxes to safely study suspicious files.
- Signature (antivirus)
- A pattern — such as a sequence of bytes or a code structure — that uniquely identifies a known malware sample. Signature databases are updated continuously by antivirus vendors.
- Smishing
- Phishing delivered via SMS text messages, often disguised as parcel delivery alerts, bank notifications, or account verifications.
- Social engineering
- Manipulating people — rather than exploiting technical flaws — to gain unauthorised access. Phishing, pretexting, and baiting are all forms of social engineering.
- Spyware
- Malware that secretly observes user activity and exfiltrates data — keystrokes, screenshots, browsing history, files — to an attacker.
T
- Trojan
- Malware disguised as a legitimate program. Unlike a virus, a trojan does not spread on its own; it relies on the user to run it.
- Two-Factor Authentication (2FA)
- A subset of MFA that requires exactly two factors. Common implementations include TOTP authenticator apps, SMS codes, and hardware security keys.
V
- Virus
- Malicious code that attaches itself to a legitimate program or file and spreads when that host is executed. The term is often used loosely to refer to any malware.
- Vishing
- Voice-call phishing. Attackers impersonate banks, tax authorities, or IT staff over the phone, often using AI-generated voice cloning to sound convincing.
- Vulnerability
- A weakness in software, hardware, or configuration that can be exploited to compromise security. Vulnerabilities are tracked publicly via CVE identifiers.
W
- WAF (Web Application Firewall)
- A filter that sits in front of a web application and blocks malicious HTTP requests such as SQL injection or cross-site scripting.
- Worm
- Malware that propagates itself across a network without user interaction by exploiting vulnerabilities — historically responsible for the most damaging outbreaks (e.g. Conficker, WannaCry).
X
- XSS (Cross-Site Scripting)
- A web vulnerability where attacker-controlled JavaScript is injected into a page and executed in another user's browser, often used to steal session cookies.
Z
- Zero-day
- A vulnerability that is exploited before the vendor has released a patch — meaning defenders have "zero days" to prepare. Zero-day exploits are valuable on the black market.
- Zombie
- A device that has been compromised and is now controlled remotely as part of a botnet, typically without the owner's awareness.
Want to go deeper?
Each term here is explored in more depth in our security blog — practical guides, real-world examples, and defence checklists.
Read the Blog