Cybersecurity Questions, Answered
138 direct answers to the security questions people ask most, for individuals, families, small businesses and teams adopting AI. Each answer cites official guidance where it relies on facts and links to a deeper guide, tool or glossary definition.
Phishing & Scams
All Phishing & Scams questionsHow can I tell if an email is a phishing attempt?
Treat any message as suspicious when it creates urgency, asks you to sign in, pay or open an attachment, and comes from an address or link that does not match the organization it claims to be. Phishing works on pressure, so a demand to act right now is itself a warning sign.
Full answer and next stepsWhat should I do if I clicked a phishing link?
Close the page, do not enter anything else, and change the password of any account you typed into the page, starting with email. If you downloaded a file, disconnect the device from the internet and run a full security scan before using it for anything sensitive.
Full answer and next stepsWhere do I report a phishing email or scam text?
Use the "Report phishing" or "Report junk" option in your email or messaging app, then report it to your national authority. In the United States, forward scam texts to 7726 and report fraud at ReportFraud.ftc.gov; in the United Kingdom, forward emails to report@phishing.gov.uk and texts to 7726.
Full answer and next stepsHow do I know if a package delivery text is a scam?
A delivery text is likely a scam if you did not expect a package, it asks for a small "redelivery" or customs fee, or the link goes to a domain that is not the courier’s official site. Real couriers rarely ask for payment by text link.
Full answer and next stepsWhat is smishing and how is it different from phishing?
Smishing is phishing sent by SMS or messaging apps instead of email. The goal is the same, stealing passwords, money or personal data, but texts feel more personal and urgent, and phones make it harder to inspect a link before tapping it.
Full answer and next stepsHow do I protect myself from phone call scams (vishing)?
Hang up on any unexpected caller who asks for passwords, one-time codes, remote access to your computer or an urgent payment, then call the organization back on a number you look up yourself. Caller ID can be faked, so a familiar name on screen proves nothing.
Full answer and next stepsAre QR codes safe to scan?
A QR code is just a link, so it is as safe as the website it opens. Check the address your camera shows before opening it, and be cautious with codes on stickers placed over parking meters or posters, or codes sent by email asking you to sign in.
Full answer and next stepsHow can I check whether a website is legitimate before buying or signing in?
Confirm the exact domain spelling, reach the site by typing the address or using a saved bookmark, and look for independent reviews of the shop outside the site itself. The padlock icon only means the connection is encrypted; scam sites have padlocks too.
Full answer and next stepsWhat is business email compromise (BEC)?
Business email compromise is a scam where a criminal impersonates or takes over a trusted email account, such as a CEO, supplier or lawyer, to trick staff into paying a fake invoice or changing bank details. It often contains no malware or link, so filters can miss it.
Full answer and next stepsWhat should I do if I sent money to a scammer?
Contact the bank, card issuer or payment service you used immediately and ask them to stop or reverse the payment, then report the scam to the police or your national fraud service. Speed matters, because funds are often moved within hours.
Full answer and next stepsHow can you tell if a QR code is a scam?
You can tell a QR code is a scam by checking the physical label for tampering, previewing the destination URL before opening it, and evaluating what the webpage asks you to do. Fraudulent QR codes often hide behind physical stickers pasted over legitimate codes, route through shortened or misspelled links, and lead to phishing forms that demand urgent payments or login credentials.
Full answer and next stepsHow do I report an Apple gift card scam?
To report an Apple gift card scam, file a report with the Federal Trade Commission at ReportFraud.ftc.gov and contact Apple using verified details from their official website. If the scam arrived by text message, forward it to 7726 or use the junk reporting option in your messaging app. For deceptive emails, use your provider's spam reporting button. Check what to do if you sent money to a scammer if you suffered a financial loss.
Full answer and next stepsWhat should you do if a scam number calls you?
Hang up immediately and do not engage with the caller. Never share sensitive information, such as passwords, account numbers, or Social Security numbers. If the caller claimed to represent a bank, utility, or government agency, verify the claim independently. Look up the organization's verified contact information on its official website and contact them directly.
Full answer and next stepsHow do you stop scam calls on an iPhone?
You can stop scam calls on an iPhone by enabling the built-in Silence Unknown Callers feature, blocking specific nuisance numbers, and using call-filtering tools from your wireless carrier or third-party apps. Silence Unknown Callers automatically mutes calls from numbers not found in your contacts, messages, or recent outgoing calls, routing them directly to voicemail. Carrier tools and filtering apps inspect incoming numbers against fraud databases to block recognized spam before your phone rings.
Full answer and next stepsWhat should you do after clicking a phishing link?
Disconnect your device from the internet immediately if you downloaded a file or suspect malware. If you submitted passwords or sensitive information on the page, change your account credentials right away from a separate, secure device and enable multi-factor authentication. Run a full scan using updated antivirus software. If you entered payment information, contact your bank immediately to flag fraudulent charges and monitor your statements.
Full answer and next stepsPasswords & Account Security
All Passwords & Account Security questionsWhat makes a strong password?
Length and uniqueness matter most. A long passphrase of several random words, used for only one account, is stronger and easier to remember than a short password full of symbols. NIST’s digital identity guidelines favor length over complexity rules.
Full answer and next stepsAre password managers safe to use?
For most people, yes. A reputable password manager encrypts your vault with your master password and lets you use a unique, strong password everywhere, which removes the much larger risk of password reuse. Protect the vault with a long master passphrase and multi-factor authentication.
Full answer and next stepsShould I change my passwords regularly?
Not on a fixed schedule. Current NIST guidance advises against forcing periodic password changes and recommends changing a password when there is evidence it was compromised, for example after a breach notice or suspicious sign-in.
Full answer and next stepsWhat is multi-factor authentication and do I need it?
Multi-factor authentication (MFA) asks for a second proof of identity, such as an app prompt, a code or a security key, in addition to your password. You need it on your email, bank, social media and work accounts, because it blocks most attacks that rely on a stolen password.
Full answer and next stepsIs SMS two-factor authentication safe?
SMS codes are much safer than a password alone, but they are the weakest common form of MFA. Codes can be stolen through SIM swapping, fake login pages that relay the code in real time, or malware on the phone. Use an authenticator app, passkey or security key where the service offers one.
Full answer and next stepsWhat is a passkey and is it better than a password?
A passkey is a sign-in credential based on public-key cryptography that is stored on your device or in your password manager and unlocked with your fingerprint, face or device PIN. It is generally stronger than a password because it cannot be reused, guessed or typed into a fake site.
Full answer and next stepsHow do I check if my email or password was in a data breach?
Search your email address on a breach notification service such as Have I Been Pwned, and check whether your password manager offers breach alerts. If an address appears in a breach, change that service’s password and any account where you reused it, and turn on multi-factor authentication.
Full answer and next stepsWhat should I do if my email account is hacked?
Reset the password from a clean device, sign out all other sessions, turn on multi-factor authentication, and check that the recovery phone, recovery email and forwarding rules have not been changed. Then warn your contacts, because attackers often use a hacked account to scam them.
Full answer and next stepsWhat is credential stuffing?
Credential stuffing is an automated attack where criminals take usernames and passwords leaked from one site and try them on many other sites. It succeeds whenever people reuse passwords, which is why a unique password for every account is so important.
Full answer and next stepsWhat should I do after my data is exposed in a breach?
Change the affected password and any reuse of it, turn on multi-factor authentication, and watch for phishing that uses the leaked details. If government ID numbers or financial data were exposed, consider a credit freeze and monitor your bank statements.
Full answer and next stepsHow does an authenticator app compare to a password?
A password is a secret string of characters you memorize, representing something you know. An authenticator app is software on your device that produces temporary, changing numeric codes, representing something you have. While a password serves as a primary credential that remains static until you change it, an authenticator app acts as a secondary verification factor to block unauthorized access even if your password leaks.
Full answer and next stepsIs an authenticator app better than SMS for two-factor authentication?
Yes, an authenticator app is significantly more secure than SMS for two-factor authentication. SMS verification codes travel over cellular networks where attackers can intercept them through techniques like SIM swapping. An authenticator app generates one-time passcodes locally on your device without relying on mobile carriers. This prevents phone-based interception and provides stronger defense for your accounts.
Full answer and next stepsWhat are the differences between using an authenticator app and a security key for two‑factor authentication?
An authenticator app creates time‑based one‑time passwords on your phone, while a security key is a separate hardware token that performs a cryptographic challenge‑response without exposing a secret. The key requires physical presence and resists phishing, whereas the app relies on the device’s security and manual code entry.
Full answer and next stepsWhat is the difference between an authenticator app and a passkey?
An authenticator app provides a second verification factor alongside a password, as outlined by CISA. In contrast, passkeys provide passwordless authentication based on FIDO Alliance guidance. Authenticator app codes can be phished if a user enters them on a fraudulent site, whereas passkeys are designed to be phishing-resistant.
Full answer and next stepsCan password managers be hacked?
Yes, password managers can be targeted and compromised by cyber criminals. Even when you use a complex password or a password manager, CISA warns that malicious actors still have ways to harvest or get past single passwords. Layering your protection with multi-factor authentication stops attackers from gaining access if your password is compromised.
Full answer and next stepsCan passkeys be hacked?
Passkeys provide strong defense against common account takeover methods, but your accounts can still be compromised if underlying devices or recovery channels are breached. As guidance from CISA highlights, multi-factor authentication and phishing-resistant authenticators significantly reduce the likelihood of account compromise compared to passwords alone. However, an unauthorized user can still gain access if they compromise your unlocked device or breach linked recovery services.
Full answer and next stepsDoes an authenticator app transfer to a new phone?
An authenticator app does not always transfer automatically to a new phone. Whether your accounts move over depends on the specific app and its backup settings. Because an authentication application acts as something you have, you must follow the vendor's setup process to connect your new device. You should always verify that your codes work on the new phone before deleting the app or erasing your old device.
Full answer and next stepsCan two-factor authentication be turned off?
Yes, you can turn off two-factor authentication on most personal accounts, but doing so leaves your account vulnerable. Disabling it strips away an essential defensive layer, leaving only your password to stop unauthorized logins. If an attacker guesses or steals your password, they gain immediate access. In workplace environments or regulated services, administrators often enforce multi-factor authentication, meaning you cannot disable it yourself.
Full answer and next stepsPhone & Device Security
All Phone & Device Security questionsHow do I know if my phone has been hacked?
Common signs include apps you did not install, sudden battery drain or data use, pop-ups, settings that change on their own, unknown device administrator profiles, and accounts sending messages you did not write. One sign alone is often harmless; several together deserve a closer look.
Full answer and next stepsHow do I remove malware from my phone?
Update the phone, uninstall unknown or suspicious apps, remove any unrecognized device management profiles or admin permissions, and run the platform’s built-in protection scan. If the problem persists, back up personal files and factory reset the phone.
Full answer and next stepsCan someone hack my phone just by calling or texting me?
For ordinary users this is very rare. Attacks that need no click do exist, but they are expensive and usually aimed at specific high-risk people. The realistic danger from calls and texts is being persuaded to tap a link, install an app or share a code.
Full answer and next stepsWhy are software updates so important for security?
Updates fix security flaws that attackers already know about. Once a fix is published, criminals can study it to attack devices that have not updated, so delaying updates leaves a known, documented hole open.
Full answer and next stepsDo I still need antivirus software?
Modern Windows, macOS, Android and iOS include built-in malware protection that is enough for most home users when combined with automatic updates and careful downloading. Extra antivirus can help in some cases, but it does not replace updates, backups and MFA.
Full answer and next stepsIs it safe to use public Wi-Fi?
Public Wi-Fi is reasonably safe for browsing websites that use HTTPS, which encrypts the content of your connection. The bigger risks are fake hotspots with convincing names and sign-in pages that ask for personal details. Use your mobile data or a trusted VPN for banking and work.
Full answer and next stepsShould I cover my laptop webcam?
A cover is a cheap, harmless precaution, but webcam spying is uncommon and usually requires malware already on the device. Keeping the system updated, avoiding untrusted downloads and reviewing which apps have camera permission address the real cause.
Full answer and next stepsHow do I secure my home Wi-Fi router?
Change the default admin password, use WPA3 or at least WPA2 encryption with a long Wi-Fi password, keep the router’s firmware updated, and turn off remote administration and WPS if you do not use them. Replace routers that no longer receive updates.
Full answer and next stepsAre smart home devices a security risk?
They can be, mostly because some receive few security updates and ship with weak defaults. Buy from manufacturers that publish a support period, change default passwords, update firmware, and put smart devices on a separate guest network so a compromised device cannot reach your laptop.
Full answer and next stepsWhat should I do if my phone is lost or stolen?
Use Find My (Apple) or Find My Device (Google) from another device to locate, lock or erase the phone, call your carrier to suspend the SIM, and change the passwords of key accounts, starting with email. Report the theft to the police if you need a reference for insurance.
Full answer and next stepsWhat is the difference between an antivirus and a virus?
A virus is malicious software designed to infect devices, corrupt files, and spread across systems. An antivirus is defensive security software designed to detect, block, and remove viruses and other forms of malware. While a virus acts as the digital threat, an antivirus acts as your primary layer of software defense to protect your computer or phone from harm.
Full answer and next stepsHow does antivirus security compare to network firewall security?
Antivirus software protects endpoints by scanning files and memory to detect and quarantine malware. A network firewall protects the perimeter by inspecting data packets and filtering unauthorized network traffic between systems. Antivirus operates inside the operating system to neutralize malicious programs that arrive on a device. A network firewall acts as a boundary filter to block unwanted inbound and outbound connections before they reach internal endpoints. Together, they create layered defense.
Full answer and next stepsHow does an antivirus differ from a firewall?
An antivirus inspects, detects, and removes malicious software on your device, while a firewall monitors and filters incoming and outgoing network traffic. Antivirus focuses on malicious files, scripts, and code execution. A firewall acts as a digital barrier that blocks unauthorized network connections between your device and the internet. Both tools complement each other in a layered defense strategy.
Full answer and next stepsWhat is the difference between antivirus software and a VPN?
Antivirus software protects your device against malicious code, whereas a virtual private network (VPN) protects your internet traffic and data in transit. Antivirus detects, quarantines, and removes malware such as ransomware and spyware already on or entering your system. In contrast, a VPN creates an encrypted tunnel between your device and a remote server, masking your network address and shielding your browsing activity on untrusted networks.
Full answer and next stepsWhat is the difference between Windows Defender and third-party antivirus?
Windows Defender is a built-in antivirus solution provided directly by Microsoft, while third-party antivirus refers to standalone security software from independent vendors. Defender runs natively inside Windows without subscription fees or additional installations. Third-party antivirus programs often offer supplementary features, such as custom firewalls or specialized scanning engines. For most everyday users, Defender provides solid baseline protection, whereas commercial solutions cater to specific enterprise management needs.
Full answer and next stepsWhat is the difference between antivirus and malware protection?
Antivirus is a specific form of malware protection. Historically, antivirus programs targeted traditional computer viruses using signature matching. Malware protection is a broader category covering all malicious code, including ransomware, spyware, Trojans, and worms. Modern security tools combine both functions, but dedicated malware protection emphasizes behavioral analysis to catch new, evasive threats that signature-based antivirus scanners miss.
Full answer and next stepsWhat is the difference between an antivirus and a firewall?
An antivirus scans, detects, and removes malicious code from your device, while a firewall monitors and filters incoming and outgoing network traffic. Antivirus acts as internal inspection on your storage and running processes. A firewall acts as a barrier at the network perimeter, blocking unauthorized connections before data reaches your applications. Both work together to provide layered protection.
Full answer and next stepsCan an iPhone be used as a security camera?
Yes, you can repurpose an iPhone as a home security camera using third-party camera apps or smart home software. An iPhone provides high-definition video, motion sensors, and wireless connectivity. However, using an iPhone as a continuous security camera requires careful attention to software updates, device power, battery swelling risks, and account security to prevent unauthorized access to your video feed.
Full answer and next stepsCan antivirus detect a Trojan?
Yes, modern antivirus software can detect Trojans. Antivirus programs scan incoming files, running processes, and disk contents to identify known Trojan signatures and malicious behaviors. Because Trojans disguise themselves as harmless software to trick you into running them, security software actively blocks unauthorized modifications and isolates suspicious files before they can compromise your system.
Full answer and next stepsPrivacy & Safe Browsing
All Privacy & Safe Browsing questionsDo I need a VPN?
A VPN is useful on untrusted networks such as public Wi-Fi, and for hiding your browsing from the local network or internet provider. It does not make you anonymous, stop phishing or remove malware, and it shifts trust to the VPN provider, so choose one carefully.
Full answer and next stepsDoes incognito or private browsing mode hide what I do online?
No. Private mode only stops your browser from saving history, cookies and form data on that device after you close the window. Your internet provider, employer or school network, and the websites you visit can still see your activity.
Full answer and next stepsDoes the padlock (HTTPS) mean a website is safe?
No. The padlock means the connection between your browser and the site is encrypted, so others on the network cannot read it. It says nothing about who runs the site; scam and phishing sites use HTTPS too, because certificates are free and automatic.
Full answer and next stepsHow do I reduce my digital footprint and protect my privacy online?
Review the privacy settings of your social accounts, limit what you post publicly (address, travel plans, birth date), delete accounts you no longer use, and give apps only the permissions they need. Less public information makes targeted scams and account recovery attacks harder.
Full answer and next stepsIs it safe to save passwords in my web browser?
For most people, a modern browser’s password manager is far safer than reusing passwords. It encrypts saved passwords and fills them only on the matching site, which also helps against phishing. Protect it by locking your device and turning on MFA for the browser account that syncs them.
Full answer and next stepsWhat is identity theft and how do I protect myself?
Identity theft is when someone uses your personal information, such as your name, ID number or bank details, to open accounts, borrow money or commit fraud in your name. Protect yourself by limiting what you share, using MFA, freezing your credit where available, and checking statements regularly.
Full answer and next stepsWhat does end-to-end encryption mean for my messages?
End-to-end encryption means only the people in the conversation can read the messages; the service provider carries them but cannot decrypt them. It protects messages in transit and on the provider’s servers, but not on a device that is unlocked, compromised or backed up without encryption.
Full answer and next stepsHow can parents help children stay safe online?
Use the parental controls built into phones, consoles and app stores, keep devices in shared spaces for younger children, and talk openly about scams, strangers and sharing photos. Children who know they will not be punished are more likely to tell you when something goes wrong.
Full answer and next stepsSmall Business Security
All Small Business Security questionsWhere should a small business start with cybersecurity?
Start with the controls that stop the most common attacks: multi-factor authentication on email and finance accounts, automatic updates, tested offline backups, a password manager for staff, and a simple rule for verifying payment changes by phone. These cost little and cover most real incidents.
Full answer and next stepsHow much should a small business spend on cybersecurity?
There is no reliable universal percentage. Base the budget on what you need to protect and what an outage would cost you: start with free or already-paid controls (MFA, updates, built-in security features of your email and devices), then spend on backups, endpoint protection and training.
Full answer and next stepsAre small businesses really targeted by hackers?
Yes. Many attacks are automated and opportunistic, scanning the internet for weak passwords, unpatched systems and staff who will click a link, regardless of company size. Small businesses are also targeted for invoice fraud and as a route into larger customers and suppliers.
Full answer and next stepsHow do I train employees on cybersecurity without boring them?
Keep training short, frequent and specific to the work people do: how to spot invoice fraud for finance, how to report a suspicious email for everyone. Make reporting easy and thank people who report, including when they report their own mistake.
Full answer and next stepsWhat security policies does a small business need?
Most small businesses need a short acceptable use policy, a password and MFA policy, a backup policy, an incident response plan, a policy on approving payments, and, increasingly, an AI use policy. Each can be one page if it is clear about who does what.
Full answer and next stepsWhat is cyber insurance and does a small business need it?
Cyber insurance helps cover costs after an incident, such as investigation, recovery, legal advice, notification and sometimes business interruption. Whether you need it depends on your risk and contracts. Insurers usually require baseline controls such as MFA and backups before they will offer cover.
Full answer and next stepsHow do I secure Microsoft 365 or Google Workspace for a small business?
Require MFA for every user, use separate admin accounts with phishing-resistant MFA, turn off legacy sign-in methods, enable audit logging and alerts for suspicious sign-ins and forwarding rules, and configure SPF, DKIM and DMARC for your domain.
Full answer and next stepsHow do I securely offboard an employee who leaves?
On their last day, disable their accounts, revoke access to shared drives and SaaS tools, collect company devices, change any shared passwords they knew, and transfer ownership of their files and mailbox. A written checklist makes sure nothing is forgotten.
Full answer and next stepsHow do I check a software vendor’s security before signing a contract?
Ask for evidence rather than promises: a recent SOC 2 report or ISO 27001 certificate, how they handle and where they store your data, whether they support SSO and MFA, how they notify customers of breaches, and what happens to your data when the contract ends.
Full answer and next stepsWhen should a small business bring in a cybersecurity consultant?
Bring in outside help when you need an independent risk assessment, are preparing for a customer security questionnaire or certification such as SOC 2 or ISO 27001, are adopting AI tools that touch customer data, or have had an incident. A good consultant leaves you with a prioritized plan your team can run.
Full answer and next stepsRansomware & Incident Response
All Ransomware & Incident Response questionsWhat is ransomware and how does it get in?
Ransomware is malware that encrypts or steals an organization’s data and demands payment to restore or not publish it. It usually gets in through phishing, stolen passwords for remote access, or unpatched internet-facing systems, and attackers often spend days inside before launching it.
Full answer and next stepsHow can a small business prevent ransomware?
Require MFA on email and every remote access path, patch internet-facing systems quickly (especially those in CISA’s Known Exploited Vulnerabilities catalog), limit admin rights, keep offline or immutable backups, and use endpoint protection that alerts someone who will act.
Full answer and next stepsShould you pay a ransomware ransom?
Law enforcement agencies, including the FBI and CISA, advise against paying. Payment does not guarantee working decryption or deletion of stolen data, it funds further attacks, and in some cases paying sanctioned groups is illegal. Report the attack and get professional incident response help.
Full answer and next stepsWhat should I do first if ransomware hits my business?
Isolate affected devices from the network (unplug or disable Wi-Fi) without powering them off, protect your backups by disconnecting them, contact your incident response provider or insurer, and report to law enforcement. Do not wipe systems before evidence is collected.
Full answer and next stepsWhat should a small business incident response plan include?
At minimum: who leads during an incident and how to reach them, who to call outside (IT provider, insurer, lawyer, police), how to isolate systems, where backups are and how to restore them, and who must be notified and by when. Keep it short and printable.
Full answer and next stepsWhat is the 3-2-1 backup rule?
Keep three copies of important data, on two different types of storage, with one copy off-site. Against ransomware, also make sure at least one copy is offline or immutable, so an attacker with access to your network cannot delete or encrypt it.
Full answer and next stepsHow quickly must a business report a data breach?
It depends on the law and sector. Under the EU GDPR, organizations must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach that poses a risk to individuals. Other countries, states and industries set their own deadlines.
Full answer and next stepsWhat is an indicator of compromise (IOC)?
An indicator of compromise is a piece of evidence that suggests a system was attacked, such as a malicious IP address, domain, file hash or unusual process. Defenders share IOCs so others can search their own logs and block known threats.
Full answer and next stepsWhat does a security operations center (SOC) do?
A SOC monitors an organization’s systems for signs of attack, triages alerts, investigates suspicious activity and coordinates the response. Analysts work from logs and tools such as a SIEM and EDR, deciding which alerts are real and what to do about them.
Full answer and next stepsWhat is a cybersecurity tabletop exercise?
A tabletop exercise is a discussion-based rehearsal where the team walks through a realistic incident scenario, such as ransomware or a fake invoice payment, and talks through who does what. It tests the plan and contacts without touching real systems.
Full answer and next stepsCan ransomware affect OneDrive?
Yes, ransomware can affect data in cloud storage services like OneDrive if files connected to an infected system become encrypted. When ransomware executes, it scrambles files across reachable systems, rendering data unusable. Because connected file stores can reflect these modifications, guidance from CISA recommends maintaining offline, encrypted backups rather than relying solely on continuously connected cloud storage.
Full answer and next stepsEmail & Website Security
All Email & Website Security questionsWhat are SPF, DKIM and DMARC?
They are DNS records that help receiving mail servers decide whether email claiming to come from your domain is genuine. SPF lists servers allowed to send for you, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when checks fail and sends you reports.
Full answer and next stepsHow do I stop someone from spoofing my email domain?
Publish SPF and DKIM for every service that sends your email, then publish a DMARC record and move it in stages to p=reject once reports show legitimate mail passes. Domains that never send email should publish a strict SPF and DMARC reject policy too.
Full answer and next stepsHow do I read email headers to check if a message is fake?
Open the full message source and look at the Authentication-Results line for SPF, DKIM and DMARC results, compare the From, Reply-To and Return-Path addresses, and read the Received lines from bottom to top to see where the message really came from.
Full answer and next stepsWhat are HTTP security headers and which ones should my website have?
Security headers are instructions a website sends to the browser to turn on protections. Most sites should set Strict-Transport-Security (HSTS), a Content-Security-Policy, X-Content-Type-Options: nosniff, a Referrer-Policy and frame protection through CSP frame-ancestors or X-Frame-Options.
Full answer and next stepsHow can I check if my website is secure?
Start with a passive check of HTTPS, security headers, TLS configuration and email DNS records, then keep the CMS, plugins and server software updated, remove unused plugins and admin accounts, and protect admin logins with MFA. For apps that handle sensitive data, commission an authorized penetration test.
Full answer and next stepsWhat is a DDoS attack and how do I protect a website from one?
A distributed denial-of-service (DDoS) attack floods a website or network with traffic from many sources to make it unavailable. Small sites are best protected by putting them behind a CDN or DDoS protection service, adding rate limits, and caching as much as possible.
Full answer and next stepsHow do I secure a WordPress website?
Keep WordPress core, themes and plugins updated, delete plugins and themes you do not use, protect admin accounts with strong unique passwords and MFA, limit login attempts, take regular off-site backups, and use HTTPS with security headers.
Full answer and next stepsWhat is the OWASP Top 10?
The OWASP Top 10 is a widely used awareness list of the most critical web application security risks, such as broken access control, injection and security misconfiguration, published by the Open Worldwide Application Security Project. Teams use it to prioritize secure coding and testing.
Full answer and next stepsIs a free SSL/TLS certificate good enough for a business website?
Yes, for encryption. A free certificate from a trusted authority such as Let’s Encrypt provides the same strength of encryption as a paid domain-validated certificate. Paid options mainly add support, warranties or organization validation, which browsers no longer display prominently.
Full answer and next stepsWhat is a Content Security Policy (CSP)?
A Content Security Policy is an HTTP header that tells the browser which sources of scripts, styles, images and frames a page may load. A well-built CSP greatly reduces the impact of cross-site scripting by blocking scripts the site did not approve.
Full answer and next stepsAre SPF records public?
Yes, Sender Policy Framework (SPF) records are completely public. SPF records are published as text (TXT) records in your domain's public Domain Name System (DNS). Receiving mail servers must query your DNS records freely to confirm whether an incoming message originated from an authorized sending server or IP address. Because public DNS records are accessible to anyone on the internet, anyone can inspect your SPF configuration.
Full answer and next stepsAre HTTP headers secure when using HTTPS?
Yes, HTTP headers are encrypted in HTTPS. Transport Layer Security (TLS) encrypts the entire HTTP exchange between your browser and the web server. This protection covers request headers, response headers, cookies, and message bodies against interception and tampering by attackers on the network. However, network observers can still see the server IP address and domain name during the initial connection setup.
Full answer and next stepsAI Security
All AI Security questionsWhat is prompt injection?
Prompt injection is an attack where text supplied to an AI model, directly by a user or hidden in a web page, email or document the model reads, overrides the instructions the developer intended. It is listed first in the OWASP Top 10 for LLM Applications.
Full answer and next stepsIs it safe to put company data into ChatGPT or other AI chatbots?
Only if your organization has approved the tool and its data terms for that kind of data. Consumer AI accounts may keep conversations and, depending on settings and terms, use them to improve models. Business plans often offer stronger data controls, but you need to check the provider’s current terms.
Full answer and next stepsWhat is an AI acceptable use policy and what should it cover?
An AI acceptable use policy tells staff which AI tools they may use, for what, and with which data. It should cover approved tools, prohibited data, human review of AI output, disclosure to customers where relevant, who approves new tools, and how to report problems.
Full answer and next stepsHow do I secure an AI chatbot on my website?
Give the chatbot access only to the data and actions it truly needs, keep secrets out of the system prompt, filter and validate its output before it reaches other systems, rate-limit usage, log conversations for abuse review, and require human approval for anything that changes data or spends money.
Full answer and next stepsWhat is the OWASP Top 10 for LLM Applications?
It is an OWASP project that lists the most important security risks for applications built on large language models, including prompt injection, sensitive information disclosure, supply chain risks, data and model poisoning, improper output handling and excessive agency.
Full answer and next stepsWhat is data poisoning in AI?
Data poisoning is when an attacker manipulates the data used to train, fine-tune or ground an AI model, so the model learns harmful behavior, hidden backdoors or wrong answers. It also applies to retrieval systems that pull documents into a model’s context at run time.
Full answer and next stepsWhat is shadow AI and why is it a risk?
Shadow AI is the use of AI tools by staff without the organization’s knowledge or approval. The risk is that company or customer data ends up in services nobody has reviewed for security, privacy or contract terms, and that AI output is used in decisions without checks.
Full answer and next stepsWhat is the NIST AI Risk Management Framework (AI RMF)?
The NIST AI RMF is voluntary guidance for managing risks from AI systems throughout their life cycle. It is organized into four functions, Govern, Map, Measure and Manage, and NIST also publishes a Generative AI Profile that applies it to generative AI risks.
Full answer and next stepsWhat is ISO/IEC 42001?
ISO/IEC 42001 is an international standard that specifies requirements for an AI management system: the policies, roles, risk assessments and controls an organization uses to develop or use AI responsibly. Organizations can be certified against it, much as with ISO/IEC 27001 for information security.
Full answer and next stepsWhat is the EU AI Act and does it apply to my business?
The EU AI Act is a European Union regulation that sets rules for AI systems based on risk: some practices are prohibited, high-risk systems face strict requirements, some systems carry transparency duties, and most others have few obligations. It can apply to organizations outside the EU that place AI systems on the EU market or whose AI output is used in the EU.
Full answer and next stepsAre AI agents safe to use at work?
They can be, with guardrails. AI agents take actions such as sending email, editing files or calling APIs, so the main risks are excessive permissions and prompt injection. Give agents the least access needed, log their actions, and require human approval for anything irreversible.
Full answer and next stepsWhat is AI red teaming?
AI red teaming is structured, authorized testing of an AI system by people trying to make it fail: bypassing its safety rules, extracting sensitive data, triggering harmful output or abusing its tools. The findings feed fixes and ongoing monitoring before and after launch.
Full answer and next stepsWhat is the difference between AI security and cloud security?
Cloud security protects digital infrastructure, including servers, networks, storage, and cloud access controls. AI security focuses on protecting machine learning models, training data, prompts, and autonomous agent workflows. While cloud security secures the environment where models and applications run, AI security defends against threats unique to machine learning, such as prompt injection and data poisoning. You need both to protect modern AI workloads.
Full answer and next stepsCan you create your own AI agents?
Yes, you can create AI agents by connecting large language models to external tools, APIs, and data sources. These systems use model reasoning to execute multi-step workflows autonomously. Anyone with basic software development skills or access to agentic orchestration platforms can build them. However, giving autonomous software the ability to take real-world actions introduces significant operational and cybersecurity risks that require strict guardrails.
Full answer and next stepsGRC & Compliance
All GRC & Compliance questionsWhat is GRC in cybersecurity?
GRC stands for governance, risk and compliance. Governance sets direction, roles and policies; risk management identifies and prioritizes what could go wrong; compliance shows that the organization meets laws, contracts and standards. Together they connect security work to business decisions.
Full answer and next stepsWhat is the NIST Cybersecurity Framework (CSF) 2.0?
NIST CSF 2.0 is voluntary guidance for managing cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0 added the Govern function and broadened the framework to organizations of every size and sector.
Full answer and next stepsWhat is ISO 27001 certification?
ISO/IEC 27001 is an international standard for an information security management system (ISMS). Certification means an accredited certification body has audited the organization’s ISMS, including risk assessment, policies and selected controls, and found it meets the standard.
Full answer and next stepsWhat is SOC 2 and who needs it?
SOC 2 is an attestation report, issued by an independent CPA firm under AICPA standards, on how a service organization protects customer data against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. SaaS and service companies usually pursue it because customers ask for it.
Full answer and next stepsWhat is the difference between ISO 27001 and SOC 2?
ISO 27001 is an international certification of your information security management system, recognized worldwide. SOC 2 is an attestation report from a CPA firm on specific controls, most common in North America. Both show customers you take security seriously, and their controls overlap heavily.
Full answer and next stepsShould I use ISO 27001 or the NIST Cybersecurity Framework?
They serve different purposes and work well together. NIST CSF is free, voluntary guidance for organizing and improving a security program. ISO 27001 is a certifiable standard that proves to outsiders that you run a managed program. Many organizations use CSF to plan and ISO 27001 to certify.
Full answer and next stepsWhat is a cybersecurity risk assessment?
A risk assessment identifies what you need to protect, the threats and weaknesses that could affect it, how likely and how damaging each scenario is, and which risks to treat first. The result is a prioritized list of risks with owners and planned actions.
Full answer and next stepsWhat is a risk register?
A risk register is a living list of identified risks, each with a description, likelihood, impact, owner, current controls, planned treatment and review date. It turns a one-time risk assessment into an ongoing management tool.
Full answer and next stepsWhat are the CIS Controls?
The CIS Critical Security Controls are a prioritized set of security safeguards published by the Center for Internet Security. They are grouped into Implementation Groups, and IG1 is described by CIS as essential cyber hygiene, a practical baseline for small organizations.
Full answer and next stepsDoes GDPR apply to businesses outside the EU?
It can. The GDPR applies to organizations established in the EU, and also to organizations elsewhere that offer goods or services to people in the EU or monitor their behavior there. If you sell to or track visitors in the EU, read the regulation’s territorial scope carefully or get legal advice.
Full answer and next stepsWhat is PCI DSS and does my small business need to comply?
PCI DSS is the Payment Card Industry Data Security Standard, which applies to organizations that store, process or transmit payment card data. Most small merchants comply through their payment provider’s requirements, often with a self-assessment questionnaire, and reduce scope by never storing card data themselves.
Full answer and next stepsHow do I answer a customer security questionnaire?
Answer honestly and consistently, backed by evidence you can share: policies, a SOC 2 report or ISO certificate if you have one, and descriptions of controls such as MFA, encryption, backups and incident response. Keep a library of approved answers so each new questionnaire is faster.
Full answer and next stepsWhat is the difference between an acceptable use policy and a fair use policy?
An acceptable use policy governs employee behavior on an organization's systems, while a fair use policy regulates consumption of shared resources like bandwidth and storage to prevent abuse. Acceptable use policies focus on security, legal compliance, and conduct. Fair use policies focus on resource allocation and system performance, primarily used by service providers to manage shared or unlimited service tiers.
Full answer and next stepsVulnerabilities & Threats
All Vulnerabilities & Threats questionsWhat is a CVE?
A CVE (Common Vulnerabilities and Exposures) ID is a unique identifier, such as CVE-2024-12345, assigned to a publicly disclosed security vulnerability. It lets vendors, researchers and defenders refer to the same flaw without confusion. The CVE Program is sponsored by CISA and operated with MITRE.
Full answer and next stepsWhat is a zero-day vulnerability?
A zero-day is a vulnerability that attackers know about or exploit before the vendor has released a fix, so defenders have had "zero days" to patch. Once a patch exists, the urgent job is to install it, because attackers quickly target systems that remain unpatched.
Full answer and next stepsWhat is CISA’s Known Exploited Vulnerabilities (KEV) catalog?
The KEV catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. US federal civilian agencies must fix them by set deadlines, and CISA recommends every organization use the catalog to prioritize patching.
Full answer and next stepsWhat does a CVSS score mean?
CVSS (Common Vulnerability Scoring System) rates the technical severity of a vulnerability from 0 to 10, based on factors such as how it is exploited and its impact. It measures severity, not risk: a high score does not mean the flaw is being exploited or that it matters in your environment.
Full answer and next stepsWhat is EPSS and how is it different from CVSS?
EPSS (Exploit Prediction Scoring System), maintained by FIRST, estimates the probability that a vulnerability will be exploited in the wild in the next 30 days. CVSS describes how bad a flaw could be; EPSS estimates how likely it is to be used, which helps prioritize long patch lists.
Full answer and next stepsHow should I prioritize which vulnerabilities to patch first?
Patch known exploited vulnerabilities first, especially on internet-facing systems, then flaws with high exploitation likelihood (EPSS) and high severity (CVSS) on important assets. Severity alone produces too many "critical" items to act on.
Full answer and next stepsWhat is malware and what are the main types?
Malware is software designed to harm or gain unauthorized access to a device or network. Common types include ransomware, information stealers that take passwords and session cookies, trojans disguised as legitimate apps, spyware, and botnet malware that turns devices into tools for other attacks.
Full answer and next stepsWhat is the MITRE ATT&CK framework?
MITRE ATT&CK is a free, public knowledge base of adversary tactics and techniques based on real-world observations, such as phishing for initial access or credential dumping. Defenders use it to plan detections, map coverage gaps and structure investigations.
Full answer and next stepsWhat is zero trust security?
Zero trust is a security approach that does not grant access based on network location. Every request is verified using identity, device health and context, and users get only the access they need. It replaces the idea that anything inside the office network can be trusted.
Full answer and next stepsCybersecurity Careers
All Cybersecurity Careers questionsHow do I start a career in cybersecurity?
Build a foundation in networking, operating systems and how attacks work, choose a direction (for example security operations, GRC or cloud security), practice with hands-on labs, and document what you build in a public portfolio. Many people move into security from IT support, development or compliance roles.
Full answer and next stepsDo you need a degree to work in cybersecurity?
Not always. Many employers accept equivalent experience, certifications and demonstrated skills, though some roles, especially in government and large enterprises, still list a degree. Check the requirements in job postings for the roles you want.
Full answer and next stepsWhat does a GRC analyst do?
A GRC analyst helps an organization manage security risk and prove compliance: running risk assessments, maintaining policies and the risk register, collecting audit evidence for frameworks such as SOC 2 or ISO 27001, reviewing vendors and answering customer security questionnaires.
Full answer and next stepsWhat skills does an AI security specialist need?
A mix of core security skills (threat modeling, application security, cloud and identity) and an understanding of how AI systems work and fail: prompt injection, data leakage, model supply chain, agent permissions, and frameworks such as the OWASP Top 10 for LLM Applications, MITRE ATLAS and the NIST AI RMF.
Full answer and next stepsWhich cybersecurity jobs can be done remotely?
Many can, including SOC analysis, GRC and compliance, cloud security, application security, threat intelligence and consulting, because the work happens in cloud tools and documents. Roles involving physical security, classified systems or on-site hardware usually require presence.
Full answer and next stepsHow do I build a cybersecurity portfolio?
Publish write-ups of hands-on work: lab investigations, detection rules, small tools, policy templates or risk assessments of a fictional company. Explain the problem, your method, what you found and what you would do next. Clear, honest documentation matters more than flashy tools.
Full answer and next stepsAre GRC analysts in demand?
Yes, GRC analysts are in steady demand across both the public and private sectors. As organizations manage operational risk and implement security frameworks, they need professionals who can evaluate controls and coordinate compliance. A GRC analyst links technical security practices to business leadership and governance. Because cybersecurity requires communicators and problem-solvers alongside technical engineers, GRC analysts remain essential for tracking risks, establishing internal policies, and preparing for security audits.
Full answer and next stepsAre entry-level cybersecurity jobs hard to get?
Yes, entry-level cybersecurity jobs can be challenging to secure because most roles require foundational technical knowledge. Many employers treat cybersecurity as a specialization rather than a starting point in technology. Candidates who build demonstrable skills through IT experience, home lab projects, and recognized industry standards stand out in competitive applicant pools.
Full answer and next steps