Cybersecurity without the jargon.

Electronic social engineering designed to make a recipient disclose information, open a file, install software, or approve an operation.

Example: an account-lockout message leads to a page that imitates the legitimate login panel.

Protection: open the service independently, verify the request through another channel, and use phishing-resistant MFA.

An attack tailored to a specific person, organization, or industry using genuine contextual information.

Example: a fabricated request to accounting refers to a real supplier and a current project.

Protection: independently confirm financial changes and make suspicious messages easy to report.

A form of spear phishing aimed at executives, owners, directors, or people with extensive privileges.

Example: a CEO receives a convincing legal notice containing a link designed to compromise a Microsoft 365 account.

Protection: strong authentication, additional transaction approval, and role-specific training.

A text message that urges the recipient to open a link, disclose information, or contact fraudulent support.

Example: a message about a small parcel surcharge leads to a fake payment gateway.

Protection: do not use the link in the message; open the provider's official service independently.

Manipulation conducted through a phone call or voice message.

Example: someone claiming to represent a bank demands installation of remote-access software to “protect the funds.”

Protection: end the call and independently dial the institution's official number.

Malicious code that attaches itself to a file or program and replicates when that host is executed.

Example: an infected document modifies additional files belonging to the user.

Protection: updates, controlled execution, EDR or antimalware, and limited privileges.

A malicious program that pretends to be legitimate or useful. Unlike a virus, it does not have to infect additional files by itself.

Example: a fake application installer also launches a password-stealing tool.

Protection: install software from verified sources and check file signatures and reputation.

Malware capable of spreading between systems on its own, often through networks and vulnerable services.

Example: a worm exploits the same flaw on successive unpatched hosts.

Protection: rapid patching, segmentation, and removal of unnecessary services.

Malware that blocks access to data or systems, often combined with information theft and a threat to publish it.

Example: after moving laterally, an attacker encrypts servers and removes accessible online backups.

Protection: segmentation, resilient backups, MFA, EDR, and a rehearsed incident procedure.

A set of techniques or code used to conceal processes, files, or attacker access, often at a highly privileged system layer.

Example: a malicious driver hides a process and its network connection.

Protection: Secure Boot, driver controls, EDR, and restoration from a trusted image after confirmation.

A mechanism that bypasses normal authentication or provides covert access to a system.

Example: an additional administrative account created after compromise.

Protection: change control, monitoring of accounts and services, and persistence analysis.

A group of infected devices controlled together by an operator of criminal infrastructure.

Example: thousands of compromised routers send traffic to one service simultaneously.

Protection: replace default credentials, update firmware, and monitor communications.

A weakness in software, configuration, process, or design that can be exploited to compromise security.

Example: missing authorization checks let one user read another user's document.

Protection: secure design, testing, patch management, and layered controls that limit impact.

A method of making a vulnerable system behave in an unintended way.

Example: a specially crafted request causes a server to execute a command.

Protection: remove the vulnerability, control exposure, and add mechanisms that obstruct exploitation.

The part of an attack that produces the intended effect after the attacker gains the ability to act.

Example: an exploit opens the path, while the payload creates a remote session or downloads another module.

Protection: block the vector, control applications, use EDR, and limit process privileges.

A vulnerability exploited before an effective patch is available or before defenders know enough to deploy protection.

Example: a newly discovered flaw in a VPN gateway is actively exploited before a patch is released.

Protection: segmentation, least privilege, behavioral monitoring, and the ability to reduce exposure quickly.

A standard identifier for a publicly disclosed vulnerability, allowing different sources to refer to the same issue.

Example: a vendor and a scanner use a CVE number to identify a specific flaw.

Protection: the identifier alone does not determine organizational risk; verify the version, exposure, and actual impact.

A system for describing the technical characteristics and severity of a vulnerability. It supports comparison but does not replace business context.

Example: a high score may not mean highest priority when the vulnerable component cannot be reached.

Protection: combine CVSS with exposure, asset value, active exploitation, and existing controls.

An attempt to disrupt a service by exhausting resources or exploiting a flaw, usually from a limited number of sources.

Example: a stream of expensive requests overloads one application process.

Protection: rate limits, queues, resource isolation, monitoring, and resilient architecture.

A distributed DoS launched simultaneously from many devices or networks, making simple blocking of one source ineffective.

Example: a botnet generates more traffic than the organization's connection can carry.

Protection: carrier or CDN mitigation, upstream filtering, an escalation plan, and tested failover architecture.

An attacker positions themselves between communicating parties to observe or modify the traffic.

Example: a rogue Wi-Fi access point attempts to intercept user traffic.

Protection: correct TLS, certificate validation, secure Wi-Fi, and a VPN on risky networks.

An IDS detects suspicious activity, while an IPS can additionally attempt to block it in the traffic path.

Example: the system alerts on a network request that matches an exploitation pattern.

Protection: current rules, correct placement, and an alert-handling process matter as much as the appliance itself.

A vulnerability that allows code to be introduced and executed in another user's browser within the context of a trusted website.

Example: a comment contains a script that runs when someone opens the panel.

Protection: context-aware output encoding, validation, CSP, and secure cookies.

An unsafe combination of user-controlled data and a database query that lets the data change the query's meaning.

Example: a search parameter alters a condition and exposes another user's records.

Protection: parameterized queries, minimal database privileges, and access-control testing.

A vulnerability that allows an attacker to make a server send a request to a chosen or indirectly controlled destination.

Example: an image-fetching feature reaches an internal service that is not visible from the Internet.

Protection: destination allowlists, a safe resolver, internal-address blocking, and egress controls.

The ability to execute code or commands remotely on a vulnerable system.

Example: crafted input causes a server process to run an operating-system command.

Protection: remove the vulnerability, isolate the process, minimize privileges, and restrict outbound communication.

Using a stolen or predictable session token to act as an authenticated user.

Example: an attacker uses a stolen cookie without knowing the victim's password.

Protection: short-lived sessions, secure cookies, token rotation, anomaly detection, and session revocation.

Authentication requiring factors from different categories, such as knowledge, possession, or an inherence factor.

Example: a password plus a hardware key that verifies the legitimate domain.

Protection: prefer phishing-resistant factors; a push notification can still be approved under pressure.

A sign-in mechanism based on public-key cryptography and a credential bound to the correct service.

Example: a user confirms sign-in using device biometrics without typing a password into the website.

Protection: configure secure account recovery; a weak recovery path can bypass strong authentication.

Systematically trying many possible passwords or keys until the correct one is found.

Example: automation tests successive combinations against one account.

Protection: long unique passwords, MFA, rate limiting, delays, and monitoring.

Automated testing of username-password pairs obtained from earlier breaches against other services.

Example: a password leaked by an online shop also works for the user's corporate email.

Protection: unique passwords stored in a manager, MFA, and detection of unusual sign-in attempts.

Obtaining more privileges than were intended for an account or process.

Example: a standard user exploits a flaw to perform an administrator-only function.

Protection: least privilege, role separation, and regular authorization testing.

An observable artifact that may indicate a compromise, such as a file hash, domain, IP address, or registry key.

Example: a process connects to a domain associated with a known malware campaign.

Protection: an IOC needs context and a validity period; one match does not always confirm an incident.

A way of describing an adversary's objectives, techniques, and practical behavior.

Example: a group gains access through phishing, steals a session token, and creates a rule that hides email.

Protection: behavioral detection often lasts longer than blocking individual domains or hashes.

A tool that collects endpoint telemetry, detects suspicious behavior, and supports response actions.

Example: EDR links a document launch to an unusual child process and network connection.

Protection: it requires correct configuration, sufficient retention, and a team able to handle alerts.

A platform that collects and correlates events from many systems for monitoring, detection, and analysis.

Example: it correlates a sign-in from a new country, a mailbox-rule change, and a large file download.

Protection: source quality, time synchronization, and response procedures matter more than log volume alone.

A function or team that monitors security, analyzes alerts, and coordinates incident response.

Example: an analyst connects an EDR alert with identity logs and escalates a confirmed incident.

Protection: a SOC needs clear responsibilities, reliable data, and rehearsed procedures.

Introducing a malicious component or change into a trusted delivery process, such as a library, repository, image, update, or build environment.

Example: a package with a name similar to a popular library executes additional malicious code.

Protection: dependency control, signatures, SBOM, restricted pipeline privileges, and behavioral monitoring of delivered code.

An approach that grants no automatic trust merely because a user or device is located “inside” the network.

Example: access depends on identity, device posture, resource sensitivity, and risk for the specific session.

Protection: strong identity, least privilege, segmentation, and continuous signal evaluation.

An attacker's movement from the initially compromised asset to additional systems and accounts.

Example: after compromising a workstation, the attacker uses stored credentials to reach a file server.

Protection: segmentation, separate administrative accounts, MFA, and detection of unusual relationships between hosts.

The unauthorized transfer of data outside a controlled environment.

Example: an archive of documents is sent through a legitimate cloud service used as an outbound channel.

Protection: data classification, least access, DLP, egress controls, and anomaly monitoring.