Security Glossary
The security world loves its jargon. Here's what the terms actually mean for your business: 53 definitions written for owners and managers, not engineers.
The rules that decide who can open which files, apps, and systems in your business. Good access control follows a simple idea: people should only have access to what their job actually requires, so one stolen login or one disgruntled employee can only reach so much.
Traditional software that scans computers for known malicious programs and blocks them. It still has a place, but modern attacks often slip past it, which is why businesses now layer newer protection (see EDR) on top of, or instead of, plain antivirus.
A separate, safe copy of your data that you can restore if the original is lost, deleted, or locked up by ransomware. A backup only counts if it's automatic, stored somewhere an attacker can't reach, and tested by actually restoring files from it now and then.
Backup & Disaster Recovery servicesA scam where a criminal either breaks into a real business email account or convincingly impersonates one, then uses it to redirect payments or steal information. A typical example: an email that looks like it's from your CEO or a vendor asking to change bank details for an invoice. BEC steals more money from small businesses than almost any other attack.
A network of hacked computers and devices that criminals control remotely, usually without the owners ever noticing. Botnets are rented out to send spam, spread malware, and knock websites offline. Unpatched devices, including office equipment like routers and cameras, are prime recruits.
Computing services (file storage, email, software, servers) that run in a provider's data centers and reach you over the internet, instead of on equipment in your office. Microsoft 365 is the everyday example. The cloud is not automatically secure or insecure; it depends entirely on how it's set up.
Cloud & Infrastructure servicesCybersecurity Maturity Model Certification, the US Department of Defense standard for companies in its supply chain. If your business sells to the DoD, or to a company that does, you will likely need to meet a CMMC level to keep those contracts.
Compliance & vCISO servicesMeeting the security and privacy rules that apply to your business, whether they come from law (HIPAA), industry (PCI DSS), or customers (security questionnaires, SOC 2 requests). Compliance is mostly about having sensible controls in place and being able to prove it with documentation.
Compliance & vCISO servicesAn attack where criminals take millions of email-and-password combinations leaked from past breaches and automatically try them on other sites. It works because people reuse passwords. If your password for one leaked site matches your email password, attackers walk right in.
Check a password against known breachesInsurance that helps cover the costs of a cyber incident: recovery, legal fees, notification, and sometimes ransom payments. Insurers now require proof of basics like MFA, backups, and endpoint protection before they'll write or renew a policy, and claims can be denied if you claimed protections you didn't have.
A part of the internet reachable only with special software, where stolen data, passwords, and hacking services are commonly bought and sold. When a company is breached, its customer logins often end up for sale here, which is why leaked passwords keep getting abused years later.
Any incident where information your business holds (customer records, employee data, financial details) is accessed or taken by someone who shouldn't have it. Most states, including the Carolinas, have laws requiring you to notify affected people, which is one reason breaches get expensive fast.
An attack that floods a website or online service with junk traffic from thousands of machines until real customers can't get through. The goal is disruption or extortion rather than theft. Reputable hosting providers absorb most of this for you, which is one reason where you host matters.
An email setting that adds an invisible digital signature to messages sent from your domain, letting receiving mail systems verify the message really came from you and wasn't altered. One of the three settings (with SPF and DMARC) that stop criminals from sending fake email as your company.
Check your domain with the Email Security CheckerThe email setting that tells the world's mail systems what to do with messages that claim to be from your domain but fail verification: let them through, quarantine them, or reject them. Without DMARC set to enforce, anyone can send email that appears to come from your company. It's free to fix and most small businesses haven't.
Check your domain with the Email Security CheckerThe internet's phone book: it translates names like yourcompany.com into the numeric addresses computers actually use. Your DNS records also control where your email goes and prove which servers may send mail for you, so who manages your DNS quietly matters a lot.
Any period your systems are unavailable and your team can't work normally. The cost is bigger than it feels: idle payroll, lost sales, and unhappy customers add up by the hour. Most downtime comes from preventable causes like failed hardware, botched updates, and cyberattacks.
Estimate yours with the Downtime Cost CalculatorModern protection software for computers and servers that goes beyond antivirus: it watches for suspicious behavior, not just known bad files, and can automatically isolate an infected machine from the network to stop an attack from spreading. Because it acts on its own, EDR can contain a threat at 3 a.m. before a human ever looks at it.
Cybersecurity & Threat ManagementScrambling data so it's unreadable without the right key. Laptops should be encrypted so a stolen bag isn't a data breach, and sensitive information should be encrypted both where it's stored and while it travels. Most modern systems can do this well; it just has to be turned on and managed.
Any device that connects to your business systems: desktops, laptops, servers, phones, tablets. Security people talk about endpoints constantly because each one is a possible way in. Protecting the endpoints, not just the office network, is the foundation of modern security.
A gatekeeper between your network and the internet that blocks traffic you didn't ask for. Every business has one (it's usually built into the router), but an unmanaged firewall with default settings offers far less protection than people assume. It needs configuring, updating, and monitoring like anything else.
The US law that sets privacy and security rules for patient health information. It applies to healthcare providers and to businesses that handle health data on their behalf, including their IT providers. HIPAA violations carry real fines, and regulators expect documented safeguards, not good intentions.
IT for Healthcare practicesThe plan for what happens the moment something goes wrong: who gets called, which systems get isolated, how you keep operating, and who tells customers or regulators if needed. Businesses with a rehearsed plan recover in days; businesses that improvise recover in weeks.
Risk that comes from inside the business: a careless employee clicking the wrong link, a departing one taking client files, or accounts that were never shut off after someone left. Off-boarding checklists and sensible access control handle most of it. It's rarely malicious, but it's always worth planning for.
Tricking an AI chatbot or assistant into ignoring its rules, using cleverly-worded prompts rather than any traditional hacking. A jailbroken AI can be talked into leaking data it was told to protect or saying things that embarrass the company running it. If you've built a customer-facing AI, this is one of the first things worth testing.
AI Penetration Testing & AnalysisThe kind of AI behind tools like ChatGPT and Claude: software trained on enormous amounts of text that can understand and generate language. Businesses now build LLMs into chatbots, assistants, and internal tools. Powerful, but they introduce new risks (see Prompt Injection) that traditional security tools don't cover.
AI Development & IntegrationA web address registered to imitate yours: think rnycompany.com instead of mycompany.com, or the same name with a different ending. Criminals use them to send convincing fake emails to your customers and staff. You can't stop registrations, but you can find out what's out there and warn your team.
Run the Domain Lookalike CheckerThe umbrella term for malicious software: viruses, ransomware, spyware, keyloggers, and everything in between. It usually arrives through email attachments, bad links, infected downloads, or unpatched software, which is why email protection and updates prevent most infections before protection software even matters.
A service where a security provider runs detection tooling (like EDR) across your systems and handles what it finds: investigating alerts, containing threats, and cleaning up. You get the outcome of a security operation without building one. Automated containment works around the clock; human follow-up happens during business hours.
Cybersecurity & Threat ManagementRequiring a second proof of identity beyond the password, usually a code or prompt on your phone. Even if a criminal steals a password, they hit a wall. Turning MFA on for email, banking, and admin accounts is the single highest-value security step a small business can take, and it costs nothing.
A company that acts as an outsourced IT department for a flat monthly fee: monitoring, maintenance, help desk, security, and planning, all handled proactively. The alternative is break-fix, where you call someone only when things break. We're an MSP, and we offer both models.
Managed IT vs. break-fix, compared honestlyThe National Institute of Standards and Technology Cybersecurity Framework: a widely-respected, free blueprint for organizing a security program, built around five plain verbs: identify, protect, detect, respond, recover. Many industries and insurers treat it as the reference point for "reasonable security."
Compliance & vCISO servicesA password made of several random words, like "coral-swan-tuba-eleven". Longer than a traditional password but far easier to remember, and much harder for computers to crack than something like P@ssw0rd1. Ideal for the handful of passwords you must actually memorize, like your computer login and password manager.
Generate one with the Password Strength TesterAn app that generates and stores a unique, strong password for every account, locked behind one master passphrase. It removes the root cause of most account takeovers: password reuse. Business versions add secure sharing and let you cut off access when someone leaves.
Installing the updates that software makers release, which fix security holes as well as bugs. Most successful attacks exploit holes that had a fix available for months. Reliable, verified patching across every device is boring, relentless work, and it prevents more breaches than any shiny product.
Managed IT ServicesThe security standard for any business that takes card payments, set by the card industry. Requirements scale with how you handle cards, but every merchant has some obligations. Falling short can mean fines and higher processing fees, especially after a card-data incident.
Compliance & vCISO servicesHiring security experts to attack your systems the way a real criminal would, with permission, and report what they found before someone hostile finds it first. Different from an automated vulnerability scan: a pen test involves humans creatively chaining weaknesses together, and the report tells you what's actually exploitable.
What AI penetration testing involvesFraudulent messages designed to trick someone into clicking a bad link, opening an infected file, or handing over credentials or money. Still the number one way businesses get breached, because it targets people rather than technology. Training plus email filtering plus MFA blunts most of it.
Test yourself with the Spot the Phish quizAn attack on AI systems where malicious instructions are hidden inside the text the AI reads (a message, a document, a web page), causing it to do things its builders never intended, like revealing private data or misusing its access. It's the AI equivalent of a con job, and standard security tools don't catch it.
AI Penetration Testing & AnalysisMalware that encrypts your files and demands payment for the key, often after quietly stealing a copy of your data to add extortion pressure. It's the most financially devastating attack a small business can face. The defense is layered: email protection, EDR, patching, and above all backups that ransomware can't reach.
How ransomware hits small businessesThe two numbers that define your backup plan. Recovery Time Objective: how long until you're back up after a disaster. Recovery Point Objective: how much recent work you can afford to lose. Deciding these on purpose, rather than discovering them during a crisis, is the heart of disaster recovery planning.
Backup & Disaster Recovery servicesApps and services your employees adopt without anyone approving or securing them: a free file-sharing account here, a personal AI chatbot there. Each one may hold company data with no oversight, no MFA, and no way to revoke access when someone leaves. The fix is visibility and giving people sanctioned tools that are just as easy.
Phishing that arrives by text message (smishing) or phone call (vishing) instead of email. Fake delivery notices, "fraud alerts" from your bank, or a caller claiming to be IT support asking for your login. Same con, different channel, and increasingly common as email filters improve.
An audit framework used to prove a company handles customer data responsibly. An independent auditor examines your security practices and issues a report that customers can rely on. If bigger clients keep sending you security questionnaires, SOC 2 is often the answer they're fishing for. (Despite the name, it has nothing to do with a staffed "security operations center".)
Compliance & vCISO servicesManipulating people rather than technology: impersonating a boss, a vendor, or IT support to talk someone into breaking normal procedure. Phishing, BEC, and vishing are all forms of it. The defense is cultural: verification habits, like confirming payment changes by a known phone number, beat any product.
An email setting that publishes the list of servers allowed to send mail for your domain, so receiving systems can spot forgeries. One of the three records (with DKIM and DMARC) that protect your company name in email. Takes minutes to check and little more to fix.
Check your domain with the Email Security CheckerFaking a sender's identity: an email that displays your CEO's name, a caller ID showing your bank's number, a website dressed up as a login page. Spoofing is the delivery mechanism for most scams. Email spoofing in particular is preventable with SPF, DKIM, and DMARC configured correctly.
Decode a suspicious email with the Header AnalyzerLetting your team access all their work apps through one central login (usually Microsoft or Google) instead of dozens of separate passwords. Fewer passwords means fewer weak ones, and when someone leaves, shutting off one account shuts off everything. A quiet security upgrade that employees actually like.
Cloud & Infrastructure servicesA part-time, outsourced Chief Information Security Officer: senior security leadership that sets strategy, manages risk, and handles auditors and customer security reviews, at a fraction of the cost of a full-time executive. Right-sized for businesses that need security direction but can't justify a six-figure hire.
Compliance & vCISO servicesAn encrypted tunnel between a device and a network, commonly used so remote workers can reach office systems safely, or to protect traffic on untrusted Wi-Fi. Useful, but not the invisibility cloak ads suggest: a VPN protects data in transit, and does nothing about phishing, malware, or weak passwords.
A weakness in software or configuration that an attacker could exploit: an unpatched program, an exposed login page, a default password. Thousands are discovered every year. What matters is a routine for finding the ones in your systems and fixing the serious ones quickly.
A security approach with a blunt premise: trust nothing automatically, verify everything. Being inside the office network no longer earns automatic access; every user and device proves itself for each system. Less a product than a design philosophy, adopted piece by piece: MFA and SSO are the usual first steps.
A security hole that attackers discover before the software maker knows it exists, leaving "zero days" of warning to prepare a fix. Genuinely unpatchable until the vendor responds, which is why layered defenses matter: EDR and monitoring can catch the behavior of an attack even when the hole itself is unknown.
If a vendor, auditor, or insurance form is throwing terms at you that aren't here, send them our way. Explaining this stuff in plain English is literally our job.
Ask a questionGet short, practical security tips by email, written in the same plain English. No jargon, no spam, unsubscribe anytime.
We only use your email to send the tips. Nothing else, and never shared.
You shouldn't need a glossary to run your business safely. Book a free assessment and we'll take the technical load off your plate.