Cyber Terms to Know.

Access Control Mechanism

A process or technology that regulates who can view or use resources in a computing environment. In cybersecurity, this ensures only authorised staff can access sensitive systems, reducing insider risk. For example, multi-factor authentication in a SOC limits who can log into critical platforms.

Advanced Persistent Threat (APT)

An APT is a prolonged and targeted cyber-attack where an adversary gains access to a network and remains undetected for an extended period. These campaigns often aim at stealing data or intelligence. For instance, financial institutions are frequent APT targets because attackers can quietly exfiltrate client data over months.

Adversary

In cybersecurity, an adversary is any individual, group, or nation-state engaged in malicious activities against digital systems. They may employ tactics ranging from phishing to ransomware. A threat actor deploying ransomware into healthcare networks is a clear example of an adversary at work.

Amazon Web Services (AWS)

AWS is a leading cloud service provider offering computing, storage, and security tools on demand. Many organisations rely on AWS for scalability, but it also expands the attack surface. For example, misconfigured AWS S3 buckets have exposed sensitive customer records to cybercriminals.

Antivirus

Antivirus software is designed to detect, prevent, and remove malicious software from computers and networks. While essential, it is only one layer of defence. For example, antivirus can block common trojans, but it won’t stop a sophisticated zero-day attack without wider detection measures.

Asset

An asset is anything of value to an organisation, including hardware, software, data, and intellectual property. In cybersecurity, protecting assets means identifying and prioritising them for defence. For example, a bank’s customer transaction data is a high-value asset that must be shielded from breaches.

Attack

An attack is any attempt to breach a system’s security, whether through exploitation of vulnerabilities, malware, or social engineering. Attacks can be opportunistic or highly targeted. For instance, a brute force attack on weak admin passwords is a common way adversaries gain entry.

Attack Signature

An attack signature is a unique pattern or behaviour used to identify specific malicious activity. Security tools use these to detect known threats. For example, a SIEM system might flag a repeated failed login attempt signature as a brute force indicator.

Authentication

Authentication is the process of verifying the identity of a user or system before granting access. Strong authentication reduces the risk of breaches caused by stolen credentials. For instance, two-factor authentication helps ensure that a compromised password alone cannot unlock sensitive systems.

Backdoor

A backdoor is a hidden method of bypassing normal authentication to gain unauthorised access to a system. Attackers often install backdoors to maintain persistent control. For example, a compromised server may host a backdoor that allows hackers to re-enter even after patches are applied.

Blue Team / Red Team / White Team

These terms describe roles in cybersecurity exercises. Red Teams simulate attackers by probing for vulnerabilities, Blue Teams defend systems in real time, and White Teams oversee and evaluate the process. For example, a bank may run a Red Team attack against its SOC, with the Blue Team defending and the White Team assessing results to strengthen resilience.

Botnet

A botnet is a network of compromised devices controlled remotely by an attacker, often used to launch large-scale attacks. Each infected machine (“bot”) operates without the owner’s knowledge. For instance, botnets are commonly used to carry out Distributed Denial of Service (DDoS) attacks against corporate websites.

Brute Force Attack

This is a trial-and-error method of cracking passwords or encryption keys by trying all possible combinations until the correct one is found. While basic, brute force attacks remain effective against weak or reused passwords. For example, attackers may target a company’s admin account with automated brute force tools.

Bugs

A bug is a flaw or error in software code that can cause unexpected behaviour or vulnerabilities. Some bugs are harmless, while others create serious security risks. For example, a coding bug in a web application might allow attackers to inject malicious code.

Cipher Block Chaining (CBC)

CBC is a mode of operation for block ciphers where each block of plaintext is XORed with the previous ciphertext block before being encrypted. This increases security compared to encrypting blocks individually. For example, CBC has historically been used in securing file transfers, though flaws can arise if not implemented correctly.

Computer Network Defence (CND)

CND refers to the actions taken to protect, monitor, analyse, and defend computer networks from intrusions and disruptions. It is a proactive approach to safeguarding digital infrastructure. For instance, a CND strategy may include intrusion detection systems, patch management, and incident response planning.

Cyber Essentials

Cyber Essentials is a UK government-backed certification that helps organisations demonstrate basic cybersecurity readiness. It focuses on fundamental defences such as firewalls, access controls, and malware protection. For example, many UK public sector contracts require suppliers to be Cyber Essentials certified.

Data Encryption Standard (DES)

DES is a once-popular encryption algorithm that is now considered outdated and insecure due to its short key length. Despite being superseded by AES, it played a pivotal role in the development of modern cryptography. For example, attackers today can crack DES-encrypted data with brute force, making it unsuitable for protecting sensitive assets.

Data Loss Prevention (DLP)

DLP refers to technologies and strategies that prevent unauthorised sharing or leakage of sensitive information. It is critical for compliance and safeguarding intellectual property. For example, DLP tools can block employees from emailing confidential client files outside the organisation.

Data Quality (DQ)

DQ refers to the accuracy, consistency, and reliability of data within an organisation. Poor-quality data undermines decision-making and can mask cybersecurity threats. For example, inaccurate asset data in a SIEM may prevent security teams from detecting attacks against vulnerable systems.

Denial of Service (DoS)

A DoS attack floods a system, service, or network with excessive traffic to make it unavailable to users. Unlike DDoS, a DoS usually originates from a single source. For example, a retail site might be targeted with a DoS attack during a seasonal sale to disrupt customer purchases.

Distributed Denial of Service (DDoS)

DDoS is a coordinated attack that overwhelms a target with traffic from multiple compromised systems, often botnets. This scale makes it harder to defend against than a standard DoS. For example, financial institutions have been frequent targets of DDoS campaigns aimed at crippling online banking services.

Domain Controller (DC)

A DC is a server that manages security authentication requests, such as user logins, in a Windows Active Directory environment. It is a vital asset in network infrastructure. For instance, attackers often target domain controllers to gain broad access across corporate networks.

Domain Name System (DNS)

DNS translates human-readable website names into machine-readable IP addresses, making the internet usable. Because of its central role, DNS is a frequent attack target. For example, DNS hijacking can redirect users to fraudulent websites to steal login credentials.

Downloader

A downloader is a type of malicious program that installs additional malware onto an infected system. It typically acts as a first-stage payload. For instance, a phishing email may deliver a downloader that silently installs ransomware on a company laptop.

Drive-by Download

A drive-by download occurs when malicious software is installed on a device without the user’s knowledge, often just by visiting a compromised website. It requires no direct action from the victim, making it highly dangerous. For example, an employee browsing a hacked news site could unknowingly trigger a drive-by download that installs spyware.

Dynamic Host Configuration Protocol (DHCP)

DHCP is a network protocol that automatically assigns IP addresses to devices on a network. While essential for managing devices, it can be exploited if misconfigured. For example, attackers can use “rogue DHCP servers” to redirect users to malicious gateways.

Endpoint

An endpoint is any device that connects to a network, including laptops, desktops, mobiles, and IoT devices. Endpoints are prime targets for attackers because they often provide a direct entry into corporate systems. For example, phishing emails commonly trick users into downloading malware onto endpoints.

Endpoint Detection & Response (EDR)

EDR solutions continuously monitor endpoints for suspicious activity, detect threats, and provide response options. They extend protection beyond traditional antivirus. For instance, an EDR platform can identify and isolate a compromised laptop to prevent a ransomware outbreak across the business.

Enhanced User Monitoring (EUM)

EUM involves tracking user behaviour to identify unusual or risky activity across systems and applications. It helps detect insider threats or compromised accounts. For example, an EUM system might alert security teams if a user suddenly attempts to download sensitive files at midnight.

Error Correction Code (ECC)

ECC is a method of detecting and correcting data errors during transmission or storage. It ensures data reliability, particularly in memory modules and communication systems. For example, ECC memory is used in servers to prevent corrupted data from undermining security logs.

Espionage

Espionage in cybersecurity refers to the theft of confidential or sensitive information for competitive or political advantage. It is often carried out by nation-states or advanced threat actors. For instance, cyber espionage campaigns have targeted defence contractors to steal classified designs.

Extended Detection & Response (XDR)

XDR integrates detection and response across multiple security layers — endpoints, networks, and cloud services — into one unified platform. It improves visibility and speeds up response. For example, XDR can correlate an email phishing attempt with lateral movement on the network to stop an attack in progress.

File Transfer Protocol (FTP)

FTP is a standard protocol used to transfer files between systems over a network. Although widely used, unencrypted FTP is insecure. For example, attackers can intercept credentials during FTP sessions unless secure alternatives like SFTP are used.

General Data Protection Regulation (GDPR)

GDPR is an EU regulation that governs the collection, storage, and use of personal data. Non-compliance can result in heavy fines. For instance, a business failing to secure customer records could face penalties under GDPR if a breach occurs.

Governance, Risk Management and Compliance (GRC)

GRC is a framework for aligning security, risk, and compliance activities with business objectives. It ensures organisations operate responsibly and within regulatory requirements. For example, implementing GRC helps financial firms manage cybersecurity risks while meeting FCA guidelines.

Hashing

Hashing converts data into a fixed-length value (hash) that uniquely represents the original input. It is widely used in password storage and data integrity checks. For example, hashed passwords in a database mean that even if attackers steal them, they cannot easily recover the original values.

Honeypot (Honeynet)

A honeypot is a decoy system or environment designed to lure attackers and study their methods without risking real assets. A honeynet extends this concept to a network of decoys. For example, security teams use honeypots to observe ransomware behaviours before they spread.

Identity Access Management (IAM)

IAM is the framework of policies and technologies that manage digital identities and control access to resources. Strong IAM reduces insider risks and prevents unauthorised entry. For instance, IAM ensures only finance staff can access payroll systems.

Incident Response Plan

An incident response plan is a documented strategy for identifying, managing, and recovering from cyber incidents. It provides clear steps for containment, communication, and remediation. For example, a company with a rehearsed incident response plan can reduce downtime and costs during a ransomware attack.

Indicators of Compromise (IOC)

IOCs are pieces of forensic evidence that suggest a system has been breached or is under attack. They include things like unusual IP addresses, file hashes, or suspicious domain names. For example, spotting an IOC in SIEM logs may reveal that ransomware has begun spreading inside the network.

Industrial Control System (ICS)

ICS refers to hardware and software that control industrial processes such as power plants, manufacturing lines, or transport systems. These systems are critical infrastructure and prime targets for nation-state attackers. For instance, the Stuxnet worm exploited vulnerabilities in ICS to damage nuclear facilities.

Information Theft

Information theft is the unauthorised acquisition of sensitive or valuable data, often for financial gain or competitive advantage. It can involve customer details, trade secrets, or intellectual property. For example, cybercriminals stealing credit card numbers from an online retailer is a classic case of information theft.

Information-stealer

An information-stealer is a type of malware designed to collect data from infected systems, such as browser history, saved passwords, or crypto wallets. Attackers often sell the stolen data on underground markets. For example, infostealer malware might exfiltrate corporate login credentials to enable further breaches.

International Domain Names (IDN)

IDNs allow domain names to use characters from non-Latin alphabets, such as Arabic, Chinese, or Cyrillic. While useful, they can also be exploited in phishing attacks. For example, attackers may register an IDN that visually mimics a legitimate domain to trick users into visiting fake sites.

International Organization for Standardization (ISO)

ISO develops international standards across industries, including cybersecurity. These standards help organisations align with best practices and build trust. For example, ISO 27001 provides a globally recognised framework for managing information security.

Intrusion Detection System (IDS)

An IDS monitors network or system activity for suspicious behaviour or known attack patterns. It alerts security teams to potential intrusions but does not actively block them. For instance, an IDS might detect repeated failed login attempts as a brute force attack.

ISO 27001

ISO 27001 is a standard for managing information security, providing a structured approach to risk management, policies, and controls. Achieving certification demonstrates strong cyber governance. For example, clients often require ISO 27001 compliance before engaging with service providers.

IT Service Management (ITSM)

ITSM refers to the processes and policies that manage how IT services are delivered and supported. Cybersecurity must be embedded in ITSM to ensure resilience. For example, a well-structured ITSM framework ensures critical patches are rolled out quickly across an enterprise.

Keylogger

A keylogger is malicious software or hardware that records a user’s keystrokes. Attackers use it to steal sensitive information such as login credentials. For example, a compromised laptop with a keylogger can expose bank details entered into online systems.

Loader

A loader is malware that installs additional malicious payloads onto a victim’s system. It often acts as a first step in more complex attacks. For example, a loader may drop ransomware after being delivered through a phishing email.

Maladvertising

Maladvertising is the use of online advertisements to spread malware. Attackers inject malicious code into ad networks, which then serve infected ads to legitimate sites. For example, a user clicking on a normal-looking banner could unknowingly trigger a malware download.

Malware

Malware is a broad term for any malicious software designed to disrupt, damage, or gain unauthorised access to systems. It includes viruses, worms, trojans, and ransomware. For example, malware deployed via phishing emails remains one of the leading causes of corporate breaches.

Managed Detection & Response (MDR)

MDR combines advanced threat detection with human-led investigation and rapid response. It goes beyond simple monitoring by offering actionable defence in real time. For example, Talion’s MDR helps clients spot and stop ransomware before it impacts operations.

Managed Security Service Provider (MSSP)

An MSSP delivers outsourced security monitoring and management for organisations. While many operate as “black boxes”, transparency and collaboration differentiate the best providers. For example, Talion’s MSSP approach ensures clients see exactly what analysts see, removing blind spots.

Man-in-the-Middle Attack (MitM)

A MitM attack occurs when an adversary secretly intercepts and potentially alters communications between two parties. It allows attackers to steal data, inject malware, or impersonate users. For example, unsecured public Wi-Fi is often exploited for MitM attacks against unsuspecting business travellers.

Mitigation

Mitigation refers to the actions taken to reduce the severity or impact of a cyber threat. It does not eliminate risk but lowers exposure and strengthens resilience. For example, patching known vulnerabilities is a form of mitigation that reduces the attack surface.

National Cyber Security Centre (NCSC)

The NCSC is the UK’s authority for providing advice, guidance, and support on cybersecurity. It helps organisations strengthen defences against threats. For example, many UK businesses rely on NCSC advisories to respond quickly to emerging vulnerabilities.

Network Detection & Response (NDR)

NDR solutions focus on detecting malicious activity across network traffic and providing response capabilities. They complement endpoint-focused tools. For instance, NDR can uncover lateral movement of attackers who have bypassed traditional defences.

NIST Cybersecurity Standard (NIST)

NIST provides a framework of best practices for managing cybersecurity risk, widely adopted across industries. It is especially influential in the United States. For example, aligning to the NIST Cybersecurity Framework helps enterprises benchmark their security posture.

Tactics, Techniques, and Procedures (TTPs)

TTPs describe the behaviours and methods used by threat actors during attacks. Understanding them helps defenders predict and disrupt adversary activity. For example, identifying ransomware TTPs such as privilege escalation allows SOC teams to respond faster.

The Onion Router (TOR)

TOR is software that anonymises internet traffic by routing it through multiple servers, making tracking difficult. While it has legitimate uses, it is also exploited by criminals. For instance, many ransomware operators use TOR to host dark web payment sites.

Threat Actor

A threat actor is an individual or group responsible for malicious cyber activity. They may be motivated by profit, espionage, activism, or sabotage. For example, nation-state threat actors often target energy grids to disrupt critical infrastructure.

Threat Coverage Model or Modelling (TCM)

TCM involves mapping defences against known threats to identify coverage gaps. It ensures organisations understand what threats they can detect and respond to. For example, a TCM exercise may reveal blind spots in cloud security monitoring.

Threat Hunting

Threat hunting is the proactive search for hidden adversaries within an organisation’s systems. Unlike automated alerts, it relies on human expertise and hypothesis-driven investigation. For example, hunters may uncover dormant malware that bypassed traditional defences.

Trojan Horse

A Trojan horse is malicious software disguised as legitimate to trick users into installing it. Once active, it can steal data, install backdoors, or deploy further payloads. For example, attackers often disguise Trojans as software updates to infiltrate systems.

Two-Factor Authentication (2FA)

2FA adds an extra layer of security by requiring two types of verification before granting access, usually something you know (password) and something you have (device or token). It dramatically reduces account compromise. For example, even if an attacker steals a password, without the second factor they cannot log in.

Sabotage

In cybersecurity, sabotage refers to deliberate actions designed to damage or disrupt systems, often by insiders or adversaries. Unlike espionage, the goal is harm rather than theft. For example, a disgruntled employee deleting critical files is a case of cyber sabotage.

Scareware

Scareware tricks users into believing their device is infected, pushing them to install fake security software or hand over payment. While not always directly harmful, it manipulates victims into self-inflicted compromise. For instance, fake antivirus pop-ups are a common scareware tactic.

Secure Shell (SSH)

SSH is a cryptographic network protocol used to securely access remote systems. While secure when configured correctly, stolen SSH keys are highly valuable to attackers. For example, cybercriminals use compromised SSH access to move laterally through enterprise environments.

Security Information & Event Monitoring (SIEM)

SIEM platforms collect, analyse, and correlate security data from across an organisation’s systems to identify threats. They provide central visibility and alerting. For example, a SIEM can flag repeated failed logins across multiple servers as an indicator of brute force activity.

Security Monitoring

Security monitoring is the continuous observation of systems, networks, and user activity to detect suspicious behaviour. It is essential for early threat detection. For instance, monitoring may reveal unusual outbound traffic that suggests data exfiltration.

Security Operations Centre (SOC)

A SOC is a dedicated team and facility where security professionals monitor, detect, and respond to cyber threats around the clock. It is the frontline of digital defence. For example, Talion’s SOC analysts collaborate with client teams to respond to incidents in real time.

Security Policy

A security policy is a formal set of rules and procedures that guide how an organisation protects its information and systems. It defines acceptable use and responsibilities. For example, a password policy requiring complex credentials helps reduce the risk of brute force attacks.

Security Posture

Security posture describes the overall strength of an organisation’s cybersecurity strategy, including defences, processes, and culture. A strong posture reduces exposure to attacks. For example, regular penetration testing and employee awareness training both strengthen security posture.

Service Orchestration, Automation & Response (SOAR)

SOAR platforms integrate security tools and automate workflows to accelerate incident response. They help teams handle alerts at scale. For example, SOAR can automatically isolate an infected endpoint the moment malware is detected.

Social Engineering

Social engineering exploits human trust to gain unauthorised access to systems or information. It often uses manipulation, deception, or urgency. For example, attackers may impersonate IT support staff to trick employees into sharing passwords.

Spam-bots

Spam-bots are automated programs that send large volumes of unsolicited emails, often carrying phishing links or malware. They can overwhelm inboxes and spread attacks. For example, spam-bots may deliver fake invoices containing ransomware attachments.

Spear Phishing

Spear phishing is a targeted form of phishing where attackers tailor messages to a specific individual or organisation. It is far more convincing than generic campaigns. For instance, a CFO may receive a spear phishing email that perfectly mimics a supplier’s style, requesting a fraudulent payment.

Orchestration & Collaboration Platform (OCP)

An OCP integrates security operations and communication channels so teams can collaborate effectively during incidents. It bridges the gap between tools and people. For example, an OCP can centralise alerts from SIEM and EDR so analysts and client teams act in unison.

Password Attacks

Password attacks involve attempts to steal or crack login credentials through methods such as brute force, dictionary attacks, or credential stuffing. Weak or reused passwords are the easiest targets. For example, attackers often exploit stolen password lists to break into corporate accounts.

Payload

In cybersecurity, a payload is the part of malicious software that performs the harmful action once delivered. Payloads can steal data, encrypt files, or install backdoors. For example, the payload of ransomware encrypts critical business data and demands payment.

Penetration Testing

Penetration testing is a simulated cyberattack conducted to identify vulnerabilities before adversaries exploit them. It provides actionable insight into real-world risk. For example, pen testers may uncover weak web application defences that could allow SQL injection.

Phishing

Phishing is a cyberattack where attackers impersonate trusted sources in emails, texts, or websites to trick users into sharing sensitive information. It remains one of the most common attack vectors. For example, employees clicking a phishing link could hand over credentials that open the door to further compromise.

Pretty Good Privacy (PGP)

PGP is an encryption programme used to secure emails and files, combining hashing, data compression, and public key cryptography. It protects communications from interception. For example, journalists often use PGP to exchange sensitive information securely.

Ransomware

Ransomware is malicious software that encrypts an organisation’s data and demands payment for its release. It is one of the most damaging and costly forms of cybercrime. For example, hospitals have been forced to halt operations after ransomware locked patient records.

Remote Access Trojan (RAT)

A RAT is malware that provides attackers with remote control over an infected system. It allows surveillance, data theft, and the installation of additional malware. For instance, a RAT infection could let an adversary switch on a laptop’s webcam without the user knowing.

Rogue Software

Rogue software pretends to be legitimate security or utility software but is actually malicious. It often manipulates users into installing it through scare tactics. For example, fake antivirus tools that demand payment to “remove threats” are a common form of rogue software.

Rootkit

A rootkit is a collection of software tools that enable attackers to maintain hidden access to a system. They are difficult to detect because they operate at a deep system level. For example, a rootkit could disguise itself inside an operating system to conceal malware activity.

User and Entity Behaviour Analytics (UEBA)

UEBA uses machine learning to analyse patterns of user and system behaviour, helping to spot anomalies that may signal an insider threat or compromised account. For instance, UEBA might detect an employee downloading gigabytes of sensitive files outside normal working hours.

Virtual Private Network (VPN)

A VPN creates an encrypted tunnel between a user and a network, ensuring privacy and secure data transmission. It is widely used by remote workers. For example, employees connecting to corporate systems via VPN reduce the risk of interception on public Wi-Fi.

Vulnerability

A vulnerability is a flaw or weakness in a system that can be exploited by attackers. They can exist in software, hardware, or processes. For example, an unpatched operating system vulnerability may allow remote code execution by adversaries.

Vulnerability Management Service (VMS)

VMS is the continuous process of identifying, prioritising, and remediating vulnerabilities across an organisation’s systems. It ensures weaknesses are addressed before attackers can exploit them. For instance, Talion’s VMS helps clients manage patch cycles and reduce risk exposure.

Water-holing (Watering Hole Attack)

In a watering hole attack, adversaries compromise websites frequently visited by a target group and use them to deliver malware. This tactic relies on trust in familiar sites. For example, attackers may infect an industry forum to deliver malware to visiting employees from a specific company.

Whaling

Whaling is a highly targeted phishing attack aimed at senior executives or high-value individuals. Because of their access, compromising them has outsized impact. For example, a CEO tricked into approving a fraudulent wire transfer is a victim of whaling.

Worm

A worm is self-replicating malware that spreads across networks without user interaction. Unlike viruses, it does not need to attach to other programmes. For instance, the WannaCry worm rapidly spread through unpatched Windows systems worldwide.

Zero-day

A zero-day vulnerability is an undiscovered or unpatched flaw exploited by attackers before the vendor releases a fix. Zero-day attacks are extremely dangerous due to the lack of defences. For example, zero-day browser exploits have been used to infiltrate government networks.