Why This Glossary Exists
Cybersecurity conversations are full of acronyms and technical shorthand that can leave everyday users feeling locked out. Terms like VPN, zero-day, and MFA appear constantly in news alerts, app notifications, and IT warnings — yet they're rarely explained in plain language. This reference is designed to change that.
Whether you're setting up a new device, reading a data breach notice, or just trying to understand what your antivirus software is telling you, knowing these terms helps you make smarter, more confident decisions. For a broader foundation, see our introduction to digital safety, which covers the core habits every user should build.
Malware
Short for 'malicious software,' malware is any program designed to damage, disrupt, or gain unauthorized access to a device or network. It includes viruses, ransomware, spyware, and trojans.
Phishing
A social engineering attack in which a scammer impersonates a trusted entity — a bank, employer, or government agency — to trick you into revealing passwords, account numbers, or other sensitive data. It most commonly arrives via email but also occurs through texts (smishing) and calls (vishing).
VPN (Virtual Private Network)
A service that encrypts your internet connection and routes it through a server in another location, masking your IP address and making your browsing harder to intercept. Widely used on public Wi-Fi to add a layer of privacy.
MFA / Two-Factor Authentication
Multi-Factor Authentication (MFA) — sometimes called Two-Factor Authentication (2FA) — requires you to verify your identity using two or more independent methods, such as a password plus a code sent to your phone. It significantly reduces the risk of account takeover even if a password is stolen.
Encryption
The process of scrambling data so it can only be read by someone with the correct decryption key. End-to-end encryption means only the sender and intended recipient can read the message — not even the service provider.
Zero-Day Vulnerability
A security flaw in software that is unknown to the vendor and therefore has no patch available. Attackers who discover zero-days can exploit them before a fix is released, making them especially dangerous.
Ransomware
A type of malware that locks or encrypts your files and demands payment — typically in cryptocurrency — in exchange for restoring access. Both individuals and large organizations can be targeted.
Firewall
A security system — either hardware, software, or both — that monitors and filters incoming and outgoing network traffic based on defined rules. It acts as a barrier between trusted internal networks and untrusted external ones.
Data Breach
An incident in which unauthorized individuals gain access to confidential information, such as usernames, passwords, financial records, or Social Security numbers. Breaches may affect millions of users and are often disclosed publicly by law.
Credential Stuffing
An automated attack in which stolen username-password pairs from one breach are tried en masse against other websites and apps. It exploits the common habit of reusing the same password across multiple accounts.
Patch / Security Update
A software update released by a vendor to fix known vulnerabilities or bugs. Applying patches promptly is one of the most effective ways to reduce your exposure to known threats.
Social Engineering
Manipulating people — rather than exploiting software — into taking actions that compromise security, such as revealing passwords or clicking malicious links. Phishing is the most common form, but it also includes pretexting and baiting.
Key Terms at a Glance
The quick-reference card below summarizes the most frequently encountered cybersecurity concepts, giving you a fast way to cross-check a term before diving into the full definitions above.
| Most Common Attack Type | Phishing (Verizon Data Breach Investigations Report, recurring findings) |
| Strongest Basic Defense | Multi-Factor Authentication (MFA) (CISA (Cybersecurity and Infrastructure Security Agency)) |
| Password Reuse Risk | Enables credential stuffing attacks (General cybersecurity guidance) |
| Zero-Day Patch Window | No patch available at time of discovery (Industry standard definition) |
| Encryption Standard | AES-256 widely used for data at rest (NIST cybersecurity framework) |
| Ransomware Payment Advice | FBI advises against paying ransoms (Federal Bureau of Investigation (FBI)) |
Security language doesn't stay static. As threats evolve, so does the vocabulary. For instance, phishing — once limited to email — now extends to text messages (called smishing) and voice calls (called vishing). Understanding how these terms branch helps you recognize a wider range of threats. Our companion article on how phishing messages are crafted explains the psychological tactics behind these attacks in detail.
80%+
Of breaches involve stolen credentials
According to the Verizon Data Breach Investigations Report, the majority of hacking-related breaches involve compromised usernames and passwords.
99%
Of account takeovers blocked by MFA
Microsoft's security research has indicated that enabling multi-factor authentication blocks the vast majority of automated account-compromise attempts.
3.4B
Phishing emails sent daily (est.)
Industry security researchers estimate billions of phishing emails are sent globally each day, making it the most prevalent cyber threat vector.
If you find glossaries like this useful for navigating complex topics, the same approach applies in other areas of life. For example, decoding insurance documents becomes much easier with resources like the health insurance glossary or the auto insurance term reference. And if your home network setup has you puzzled, the home network glossary covers terms like SSID, NAT, and bandwidth in the same plain-English style.
This Is General Information, Not Security Advice
This glossary is designed to help you understand terminology, not to replace guidance from a qualified IT or cybersecurity professional. Every individual and organization has a unique threat landscape. If you've experienced a security incident — such as a data breach or malware infection — contact your organization's IT team or a qualified security professional promptly.
The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.