Cyber Security Glossary: Plain English Terms for UK Businesses
Cyber security terms explained without the waffle
Cyber security can feel harder than it needs to because the language gets in the way. This glossary explains common terms in plain English, so you can understand what suppliers, insurers, auditors and IT teams are talking about and what it means for your organisation.
For business owners
Useful when a client, insurer or supplier asks about MFA, backups, EDR, patching or security awareness training.
For schools and care providers
Helpful when technical terms appear in audits, risk registers, cyber insurance forms or governance discussions.
For anyone who wants less jargon
No scare tactics. No overcomplicated explanations. Just clear meanings and practical links where useful.
Account Takeover
When someone gets into a real account without permission. It often starts with a stolen password, phishing email, weak MFA or reused login.
View Huntress ITDR →Access Control
Rules that decide who can access a system, account, file or application. Good access control makes sure people only have the access they genuinely need.
Admin Account
An account with higher permissions than a normal account. Admin accounts should be limited, monitored and protected with strong MFA.
Advanced Persistent Threat (APT)
A targeted, long-running attack carried out by a skilled group. APTs are usually aimed at specific organisations, sectors or high-value data.
Adware
Software that displays unwanted adverts, pop-ups or browser redirects. Some adware is just annoying; some can also track behaviour or weaken security.
Allow List
A list of approved apps, websites, senders or devices. Anything not on the list may be blocked or treated as suspicious.
Antivirus Software
Software that helps detect and block known malware, including viruses, worms, trojans and some ransomware. Modern protection often goes beyond traditional antivirus.
View Heimdal Next-Generation Antivirus →Authentication
The process of proving who you are when you log in. This could use a password, app approval, passkey, biometrics or another verification method.
Attack Surface
All the places an attacker could try to get in. This can include devices, cloud accounts, email, websites, remote access tools and suppliers.
Backdoor
A hidden way into a system that bypasses normal login or security checks. Attackers use backdoors to regain access later.
Backup
A separate copy of your data that can be restored if files are deleted, encrypted, damaged or lost. Backups are only useful if they are tested.
View cloud backup support →Backup Testing
Checking that backups can actually be restored. This is the part many organisations miss until they really need the backup to work.
View backup and recovery support →Behavioural Analytics
Technology that looks for behaviour that does not fit the normal pattern, such as impossible travel logins, unusual file access or strange device activity.
Biometrics
Using physical characteristics, such as a fingerprint, face scan or voice pattern, to help verify someone’s identity.
Botnet
A group of compromised devices controlled by an attacker. Botnets are often used to send spam, steal data or overwhelm websites with traffic.
Brute Force Attack
An attack where criminals try many password combinations until one works. Strong passwords, MFA and lockout rules reduce the risk.
Business Email Compromise (BEC)
A fraud attack where criminals use email to trick someone into sending money, changing bank details or sharing sensitive information. It often starts with a compromised mailbox.
View email security support →Business Continuity
The plan for keeping an organisation running during disruption. This could include cyber incidents, outages, supplier failures and data loss.
Canary Files
Decoy files placed in a system to trigger an alert if someone opens, changes or moves them without permission.
Cloud Security
The controls used to protect cloud apps, accounts and data. This includes MFA, permissions, email security, monitoring and backup.
View Microsoft 365 security support →Conditional Access
Rules that decide when a login is allowed, blocked or challenged. These rules might look at the user, device, location, risk level or app being accessed.
View Microsoft 365 security support →Credential Stuffing
When criminals use leaked username and password combinations from one service to try logging in somewhere else.
Cyber Essentials
A UK certification scheme that checks basic cyber security controls, including firewalls, secure settings, access control, malware protection and patching.
Get Cyber Essentials support →Cryptography
The method of protecting information using mathematical techniques, usually by scrambling data so only authorised people or systems can read it.
Data Breach
An incident where personal, sensitive or confidential information is accessed, disclosed, stolen or exposed without authorisation.
Data Loss Prevention (DLP)
Tools and rules designed to stop sensitive data leaving the organisation through email, file sharing, uploads or other channels.
Defence in Depth
Using several layers of protection rather than relying on one product. If one layer fails, another layer may still reduce the damage.
View our layers of security approach →Denial-of-Service (DoS) Attack
An attack that tries to make a website, service or network unavailable by overwhelming it with traffic or requests.
Device Management
The process of controlling, updating and securing laptops, desktops, mobiles and tablets used for work.
Distributed Denial-of-Service (DDoS) Attack
A denial-of-service attack launched from many devices at once, making it harder to block or control.
Domain Spoofing
When attackers make an email look like it came from a trusted domain. This is often used in phishing and invoice fraud.
View email security support →Email Authentication
Controls such as SPF, DKIM and DMARC that help prove whether an email was really sent by an authorised sender.
View email security support →Endpoint Detection and Response (EDR)
Technology that watches devices for suspicious behaviour and helps detect, investigate and respond to attacks that basic antivirus may miss.
View Huntress EDR →Encryption
The process of making data unreadable without the right key. It helps protect information on devices, in backups and while being sent online.
Exfiltration
When data is stolen, copied or moved out of an organisation without permission.
Firewall
A security control that monitors traffic going in and out of a network or device, then allows or blocks it based on rules.
Honeypot
A decoy system designed to attract attackers, helping security teams learn how they behave without exposing important systems.
Human Risk Management
A way of reducing cyber risk linked to people, pressure, habits and email behaviour. It often includes training, phishing simulations and useful reporting.
View uSecure human risk management →Immutable Backup
A backup that cannot easily be changed or deleted for a set period. This helps protect recovery points if ransomware or an attacker tries to destroy backups.
View immutable backup support →Incident Response
The planned process for dealing with a cyber incident: detect it, contain it, investigate it, recover safely and learn from it.
Insider Threat
A risk caused by someone inside or close to the organisation misusing access, either deliberately or by mistake.
Intrusion Detection System (IDS)
A system that monitors activity and raises alerts when it spots traffic or behaviour that looks suspicious.
Intrusion Prevention System (IPS)
A system that can detect suspicious activity and also take action to block or prevent it.
ITDR
Identity Threat Detection and Response. It helps spot suspicious activity around accounts, logins and Microsoft 365 identities.
View Huntress ITDR →Least Privilege
Giving people the lowest level of access they need to do their job. It reduces the damage if an account is misused or compromised.
Lateral Movement
When an attacker gets into one system or account and then moves across the network or cloud environment to reach more valuable data.
Login Alert
A warning that a sign-in has happened, often from a new device, unusual location or strange time.
View identity monitoring support →Malware
Malicious software designed to damage systems, steal data, spy on activity, disrupt operations or give attackers access.
MDR
Managed Detection and Response. A service where specialists monitor for threats, investigate alerts and help respond when something looks wrong.
Managed Security Awareness Training
Ongoing cyber training that helps staff recognise phishing, social engineering and risky behaviour without turning it into a once-a-year tick-box exercise.
View managed security awareness training →Microsoft 365 Backup
A separate backup of Microsoft 365 data, including email, OneDrive, SharePoint and Teams. Microsoft protects the platform, but organisations still need to protect their data.
View Microsoft 365 backup →Microsoft 365 Security
The settings, monitoring and protection around Microsoft 365 accounts, email, OneDrive, SharePoint and Teams.
View Microsoft 365 security support →Multi-Factor Authentication (MFA)
A login method that asks for more than just a password. This might include an app prompt, code, security key or biometric check.
See why insurers ask about MFA →MXDR
Managed Extended Detection and Response. A managed service that combines monitoring across different security signals with investigation and response support.
View Heimdal MXDR →OAuth Abuse
OAuth abuse is when an attacker misuses a legitimate authorisation process to gain access to an account, app or cloud service. In Microsoft 365 attacks, this can happen when someone is tricked into approving access through a real Microsoft sign-in flow or connected app permission. The page may look genuine because it is genuine, but the access being granted is not safe.
Password Manager
A tool that stores strong, unique passwords so people do not have to reuse weak passwords or write them down.
View Keeper Password Manager →Patch Management
The process of finding, testing and installing updates that fix security weaknesses in operating systems, apps and other software.
View patch management support →Phishing
A scam that uses emails, messages or fake websites to trick people into sharing passwords, opening files, approving payments or giving away sensitive information.
View security awareness training →Phishing-Resistant MFA
A stronger form of MFA designed to resist common phishing tricks. This often uses passkeys, security keys or device-bound authentication.
Privileged Access
High-level access that can change settings, create users, view sensitive data or control systems. It should be tightly controlled.
Quishing
Phishing that uses QR codes to send people to fake login pages, payment pages or malicious websites.
Ransomware
Malware that locks or encrypts files and demands payment. Good protection, monitoring and tested backups reduce the damage it can cause.
View Heimdal Ransomware Encryption Protection →Recovery Point Objective (RPO)
The maximum amount of recent data an organisation is prepared to lose after an incident, usually expressed as a period of time. An RPO of four hours means recovery should take you back to a point no more than four hours before the disruption.
Recovery Time Objective (RTO)
The target time for restoring a system or service after disruption. It helps determine how quickly recovery needs to happen and what backup, continuity and response arrangements are required.
Remote Access
Accessing systems from outside the office. It needs proper controls, especially MFA, patching and no exposed RDP.
RDP
Remote Desktop Protocol. Useful for remote access, but risky if exposed directly to the internet or used without strong controls.
Risk Assessment
A structured look at what could go wrong, how likely it is, what the impact would be and which fixes matter most.
Secure Configuration
Setting up devices, accounts and software safely rather than leaving default settings in place.
Get Cyber Essentials support →Security Awareness Training
Training that helps staff spot scams, phishing, suspicious links and risky requests without blaming people for being human.
View security awareness training →Security Information and Event Management (SIEM)
A system that collects and analyses logs from different tools and systems to help detect suspicious activity. It is most useful when alerts are reviewed and acted on.
View Huntress SIEM →Security Orchestration, Automation and Response (SOAR)
Technology that helps automate repeated security tasks, connect tools and speed up response workflows.
Shared Responsibility Model
The idea that cloud providers secure the platform, but your organisation is still responsible for accounts, data, permissions, settings and backups.
View Microsoft 365 backup support →Security Operations Centre (SOC)
A team that monitors security alerts, investigates threats and coordinates responses to incidents, often around the clock.
Social Engineering
Using pressure, trust, urgency or deception to trick someone into doing something unsafe, such as sharing a password or approving a payment.
View security awareness training →Spear Phishing
A targeted phishing attack aimed at a specific person, role or organisation. These messages often use believable details to look genuine.
Spyware
Malware that secretly monitors activity, collects information or sends data to someone else without permission.
Service Set Identifier (SSID)
The name used to identify a Wi-Fi network. It is not the Wi-Fi password and, on its own, does not protect the network.
Supplier Questionnaire
A form from a client, insurer or partner asking what cyber security controls you have in place and what evidence you can provide.
See common cyber insurance questions →Threat Intelligence
Information about current threats, attacker behaviour and known indicators that helps security teams detect and respond more effectively.
Token Theft
Token theft is when an attacker steals or abuses a valid sign-in token instead of the password itself. A token can act like a temporary access pass for Microsoft 365, letting the attacker access email, files or cloud services without going through a normal login again. This is why password resets alone may not always be enough after an account compromise; active sessions may also need to be revoked.
Two-Factor Authentication (2FA)
A type of MFA that uses two checks when logging in, such as a password and a code from an app.
Vendor Risk
The risk that comes from relying on third-party suppliers, software providers or cloud services.
Virtual Private Network (VPN)
A secure connection that helps people access private systems over the internet. VPNs still need MFA, patching and good access controls.
Virus
A type of malware that can spread by attaching itself to files or programs, often causing damage or disruption.
Vulnerability
A weakness in software, hardware, configuration or process that could be exploited by an attacker.
Vulnerability Assessment
A review that looks for weaknesses in systems, software, devices and settings so they can be prioritised and fixed.
Whaling
A phishing attack aimed at senior people, such as directors, heads, finance leads or other decision-makers.
Zero-Day Exploit
An attack that uses a vulnerability before the software maker has released a fix. This is one reason monitoring and layered protection matter.
Zero Trust
A security approach based on checking every access request rather than automatically trusting people, devices or locations.
Know the term, but not sure what it means for your business?
That is usually where the useful conversation starts. We can help you work out which controls matter first, what your insurer or client is really asking for, and where the gaps are worth fixing.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.