Cybersecurity Glossary

57 security, AI security and compliance terms defined in plain English, each linked to the questions and guides where it matters.

A

Account takeover: Account takeover is when a criminal gains control of someone else’s online account, usually with a stolen or reused password, a phished one-time code or a hijacked session.

B

Backup (3-2-1 rule): A backup is a separate copy of data that can be restored after deletion, failure or attack. The 3-2-1 rule means three copies, on two types of storage, with one off-site.
Business email compromise: Business email compromise (BEC) is fraud in which a criminal impersonates or takes over a trusted email account to trick an organization into sending money or sensitive data.

C

CIS Controls: The CIS Critical Security Controls are a prioritized set of security safeguards from the Center for Internet Security, grouped into Implementation Groups, with IG1 as a baseline for small organizations.
Content Security Policy: Content Security Policy (CSP) is an HTTP response header that tells the browser which sources a page may load scripts, styles, images and frames from.
Credential stuffing: Credential stuffing is an automated attack that tries usernames and passwords leaked from one service against many other services, succeeding wherever people reused passwords.
CVE: A CVE ID is a unique public identifier, such as CVE-2024-12345, for a disclosed security vulnerability, assigned through the CVE Program.
CVSS: CVSS is a standard maintained by FIRST for rating the technical severity of a vulnerability on a scale from 0 to 10.

D

Data poisoning: Data poisoning is the manipulation of data used to train, fine-tune or ground an AI model so that it behaves in a way the attacker wants.
DDoS attack: A distributed denial-of-service (DDoS) attack overwhelms a website, server or network with traffic from many sources so that legitimate users cannot reach it.
DKIM: DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify it came from an authorized sender for the domain and was not altered in transit.
DMARC: DMARC is a DNS policy that tells receiving mail servers what to do with email that fails SPF and DKIM alignment for your domain, and where to send reports about it.

E

EDR (endpoint detection and response): Endpoint detection and response (EDR) software records activity on laptops and servers, detects suspicious behavior and lets responders investigate and contain threats remotely.
Encryption: Encryption transforms readable data into ciphertext that can only be turned back into readable form with the correct key.
End-to-end encryption: End-to-end encryption (E2EE) means data is encrypted on the sender’s device and can only be decrypted on the recipient’s device, so the service in between cannot read it.
EPSS: EPSS, maintained by FIRST, estimates the probability that a published vulnerability will be exploited in the wild within the next 30 days.
EU AI Act: The EU AI Act is a European Union regulation that sets risk-based rules for AI systems, from prohibited practices to requirements for high-risk systems and transparency duties.

F

Firewall: A firewall controls network traffic between zones, such as the internet and an internal network, allowing or blocking connections according to rules.

G

GDPR: The General Data Protection Regulation (GDPR) is the European Union’s law on the processing of personal data, including security and breach notification duties.
GRC (governance, risk and compliance): GRC is the discipline that aligns security with business goals through governance (direction and accountability), risk management (prioritizing threats) and compliance (meeting laws, contracts and standards).

H

HTTPS and TLS: HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.

I

Identity theft: Identity theft is the use of someone’s personal information, such as their name, ID number or financial details, to commit fraud in their name.
Incident response: Incident response is the organized process of preparing for, detecting, containing, eradicating and recovering from security incidents, then learning from them.
Indicator of compromise: An indicator of compromise (IOC) is observable evidence that a system may have been attacked, such as a malicious IP address, domain, URL or file hash.
ISO/IEC 27001: ISO/IEC 27001 is the international standard for an information security management system (ISMS), against which organizations can be independently certified.
ISO/IEC 42001: ISO/IEC 42001 is the international standard that specifies requirements for an artificial intelligence management system (AIMS).

K

Known Exploited Vulnerabilities (KEV): CISA’s Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with reliable evidence that attackers are exploiting them.

L

Least privilege: Least privilege means giving each user, service or AI agent only the access it needs to do its job, and no more, for only as long as it needs it.

M

Malware: Malware is any software designed to harm, spy on or gain unauthorized control of a device, network or account.
MITRE ATLAS: MITRE ATLAS is a public knowledge base of adversary tactics and techniques against AI-enabled systems, modeled on MITRE ATT&CK.
MITRE ATT&CK: MITRE ATT&CK is a free knowledge base of real-world adversary tactics and techniques used to plan detections and structure investigations.
Multi-factor authentication: Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.

N

NIST AI RMF: The NIST AI Risk Management Framework is voluntary guidance for managing AI risks, organized into four functions: Govern, Map, Measure and Manage.
NIST Cybersecurity Framework: The NIST Cybersecurity Framework (CSF) 2.0 is voluntary guidance for managing cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

O

OWASP Top 10: The OWASP Top 10 is an awareness list of the most critical security risks to web applications, published by the Open Worldwide Application Security Project.

P

Passkey: A passkey is a phishing-resistant sign-in credential based on public-key cryptography, stored on a device or in a password manager and unlocked with a biometric or device PIN.
Password manager: A password manager is an app that generates, stores and fills unique passwords and passkeys, protected by one strong master password and usually MFA.
Patch management: Patch management is the process of finding, prioritizing, testing and installing software updates that fix security flaws.
PCI DSS: PCI DSS is the security standard for organizations that store, process or transmit payment card data, managed by the PCI Security Standards Council.
Penetration testing: Penetration testing is an authorized, simulated attack on a system to find and demonstrate exploitable weaknesses before real attackers do.
Phishing: Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.
Prompt injection: Prompt injection is an attack on AI applications in which crafted input, typed directly or hidden in content the model reads, overrides the developer’s instructions.

R

Ransomware: Ransomware is malware that encrypts or steals data and demands payment to restore access or prevent publication.
Risk assessment: A cybersecurity risk assessment identifies assets, threats and weaknesses, estimates likelihood and impact, and prioritizes how to treat each risk.
Risk register: A risk register is a maintained list of risks with their likelihood, impact, owner, controls, treatment plan and review date.

S

Shadow AI: Shadow AI is the use of AI tools inside an organization without approval or oversight from IT, security or compliance.
SIEM: A SIEM (security information and event management) system collects logs from across an organization, correlates them and raises alerts for analysts to investigate.
SIM swapping: SIM swapping is fraud where a criminal convinces or bribes a mobile carrier to move a victim’s phone number to a SIM the criminal controls, to receive their calls and SMS codes.
Smishing: Smishing is phishing delivered by SMS or messaging apps, often posing as couriers, banks, toll agencies or government services.
SOC (security operations center): A security operations center (SOC) is the team, in-house or outsourced, that monitors systems for threats, triages alerts and leads the technical response to incidents.
SOC 2: SOC 2 is an attestation report from an independent CPA firm on a service organization’s controls relevant to security, availability, processing integrity, confidentiality and privacy.
Social engineering: Social engineering is the manipulation of people, rather than technology, to gain access, information or money.
SPF: SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for a domain.

V

Vishing: Vishing is voice phishing: scam phone calls or voicemails that impersonate banks, government agencies, IT support or family members to steal money, codes or access.
VPN: A VPN (virtual private network) creates an encrypted tunnel between your device and a VPN server, hiding your traffic from the local network and internet provider.

Z

Zero trust: Zero trust is a security model that grants access per request based on verified identity, device health and context, rather than trusting anything inside a network perimeter.
Zero-day: A zero-day is a vulnerability that is exploited or known to attackers before the vendor has a fix available.