Cybersecurity Glossary: Your Complete Reference 2026

15 Essential Terms You Must Master

The most critical definitions to protect your enterprise in 2026

Phishing

Social engineering attacks that deceive users into revealing credentials or installing malware. Initiates 91% of successful breaches.

Ransomware

Malware that encrypts files and demands payment for decryption. Can paralyze entire organizations within hours.

Zero Trust

Security model that verifies every user and device continuously, regardless of location. No implicit trust, ever.

Firewall

Network security system that monitors and controls incoming/outgoing traffic based on predefined rules.

Malware

Any software designed to harm, exploit, or gain unauthorized access to systems. Umbrella term for viruses, trojans, ransomware, etc.

Vulnerability

A weakness in software, hardware, or processes that attackers can exploit to gain access or cause harm.

Advanced Persistent Threat (APT)

Sophisticated, targeted attacks by organized groups. Often nation-state backed, designed for long-term network access.

Multi-Factor Authentication (MFA)

Verification using 2+ methods (password + SMS, biometric, etc.). Dramatically increases account security.

Encryption

Converting data into code that can only be read with the correct key. Protects data at rest and in transit.

VPN (Virtual Private Network)

Encrypted tunnel for internet traffic, hiding user identity and location. Protects data from interception on public networks.

DDoS Attack

Distributed Denial of Service: overwhelming a system with traffic to make it unavailable to legitimate users.

Backup

Complete data copy stored separately. Your final safety net against ransomware, disasters, and data loss.

Incident Response

Planned procedures to detect, contain, and recover from security breaches. Speed matters—preparation prevents chaos.

Exploit

Code or technique that takes advantage of a vulnerability. Attackers use exploits; defenders patch vulnerabilities.

Cybersecurity

Practice of protecting systems, networks, and data from digital attacks. It's both technology and human behavior.

Why These Terms Matter

Understanding terminology is understanding your risks

Make Better Decisions

Directors and managers who speak the language of security evaluate solutions faster, allocate budgets smarter, and prioritize threats correctly.

Evaluate Solutions

When you understand terms like Zero Trust, MFA, and encryption, you can assess whether security vendors actually solve your problems.

Respond to Incidents

During a breach, confusion in terminology costs time. Shared understanding lets your team respond with precision and speed.

Complete A–Z Cybersecurity Glossary

100+ essential terms for 2026

A

Account Takeover (ATO) — Unauthorized access to user accounts, often via phishing or credential stuffing.
Advanced Persistent Threat (APT) — Long-term, targeted attacks by sophisticated groups seeking persistent network access.
API Security — Protection of application programming interfaces from unauthorized access and attacks.
Attack Surface — All possible points where an attacker could exploit your systems and networks.
Authentication — Process of verifying user identity before granting access to systems or data.
Authorization — Process of determining what authenticated users are allowed to access.

B

Backdoor — Hidden access point in software that allows unauthorized entry, bypassing normal authentication.
Backup — Complete copy of data stored separately. Essential protection against ransomware and disasters.
Botnet — Network of compromised devices controlled by attackers to launch attacks or send spam.
Breach — Unauthorized access to systems or data, resulting in potential exposure of sensitive information.
Business Continuity — Plans and procedures to maintain operations during and after security incidents or disasters.
Brute Force Attack — Method of trying many password combinations until finding the correct one.

C

Certificate Authority (CA) — Organization that issues and verifies digital certificates for secure communication.
Cipher — Algorithm used to encrypt and decrypt data.
Compliance — Meeting regulatory requirements (GDPR, HIPAA, ISO 27001, etc.).
Confidentiality — Ensuring information is only accessible to authorized individuals.
Credential Stuffing — Attacking accounts using passwords obtained from other breaches.
Cryptography — Science of securing communication through encryption and codes.
Cyber Attack — Deliberate attempt to compromise systems, networks, or data.

D

Data Exfiltration — Unauthorized extraction of sensitive data from systems.
DDoS Attack — Distributed Denial of Service: overwhelming systems with traffic to cause unavailability.
Defense in Depth — Strategy using multiple layers of security controls to protect systems.
Denial of Service (DoS) — Attack that prevents legitimate users from accessing systems or services.
Digital Forensics — Investigation of security incidents through analysis of digital evidence.
Disaster Recovery — Plans to restore systems and data after catastrophic failures.

E

Encryption — Converting data to code readable only with correct key. Protects data at rest and in transit.
End-to-End Encryption (E2E) — Only sender and receiver can read messages; provider cannot access content.
Endpoint — Any device connected to network (computers, phones, servers, IoT devices).
Exploit — Code or technique used to attack a vulnerability. The bridge between vulnerability and attack.
Exposure — Unprotected data or system accessible to attackers.

F

Firewall — Network security system controlling incoming/outgoing traffic based on predefined rules.
Forensics — Investigation and analysis of security incidents using digital evidence.
Framework — Set of guidelines and best practices (NIST, ISO 27001, CIS) for implementing security.
Full Disk Encryption (FDE) — Encrypting entire storage device so data is unreadable without correct key.

G

Geofencing — Security control restricting access based on geographic location.
Governance — Framework of policies and procedures for managing security risks.
Green Team — Security team defending against Red Team (attackers) in exercises.

H

Hacker — Person who gains unauthorized access to systems. Can be malicious (attacker) or ethical (security researcher).
Hash — One-way function converting data into fixed-length string. Detects tampering.
HIPAA — Health Insurance Portability and Accountability Act. Regulation for protecting healthcare data.
Host-Based Intrusion Detection (HIDS) — Software monitoring individual devices for suspicious activity.
Honeypot — Decoy system designed to attract attackers and log their activities.

I

Identification — Process of claiming an identity in a system (username).
Identity and Access Management (IAM) — Systems controlling who accesses what resources.
Incident — Violation of security policy or unwanted security event.
Incident Response — Planned procedures to detect, contain, and recover from security breaches.
Integrity — Ensuring data hasn't been altered without authorization.
Intrusion Detection System (IDS) — Network monitoring system identifying suspicious activity and attacks.
Intrusion Prevention System (IPS) — System similar to IDS but actively blocks detected attacks.
IoT Security — Securing Internet of Things devices connected to networks.

J

JSON Web Token (JWT) — Secure token format used for transmitting information between systems.

K

Key Exchange — Process of securely sharing encryption keys between parties.
Key Management — Processes for storing, distributing, and rotating encryption keys securely.
Keylogger — Software or hardware capturing keystrokes. Can be used for attacks or legitimate monitoring.

L

Lateral Movement — Attacker moving through network after initial access, accessing additional systems.
Least Privilege — Principle of giving users/systems only minimum access needed to function.
Log Monitoring — Analyzing system logs to detect suspicious activities and threats.

M

Malware — Any software designed to harm, exploit, or gain unauthorized access. Umbrella term.
Man-in-the-Middle (MITM) — Attack intercepting communication between two parties.
Mandatory Access Control (MAC) — System where administrator controls all access permissions.
Mobile Device Management (MDM) — Managing security on phones and tablets.
Multi-Factor Authentication (MFA) — Verification using 2+ methods (password + SMS, biometric, etc.).

N

Network Segmentation — Dividing network into isolated sections to limit breach impact.
Network Security — Protecting networks from unauthorized access and attacks.
Non-Repudiation — Preventing someone from denying they performed an action.
NIST Cybersecurity Framework — Guidelines for managing cybersecurity risks (U.S. standard).

O

OAuth — Open standard allowing users to authenticate without sharing passwords.
Onion Routing — Technology (Tor) anonymizing internet traffic through multiple layers.
OSINT (Open Source Intelligence) — Gathering intelligence from publicly available sources.
Overflow Attack — Exploiting programs by sending more data than the buffer can hold.

P

Patch — Software update fixing vulnerabilities and security issues.
Patch Management — Process of regularly applying security updates to systems.
Penetration Testing — Authorized security testing where experts attempt to breach systems.
Phishing — Social engineering attacks deceiving users into revealing credentials or installing malware.
Privilege Escalation — Exploiting vulnerabilities to gain higher-level access.
Public Key Infrastructure (PKI) — System managing digital certificates and encryption keys.

Q

Quarantine — Isolating suspected malicious files or systems to prevent spread.
Quishing — Phishing attacks using QR codes to direct victims to malicious sites.

R

Ransomware — Malware encrypting files and demanding payment for decryption.
Recovery Point Objective (RPO) — Maximum acceptable data loss measured in time.
Recovery Time Objective (RTO) — Maximum acceptable time to restore systems after failure.
Red Team — Security professionals authorized to attack systems to find weaknesses.
Reverse Engineering — Analyzing software to understand how it works, often to find vulnerabilities.
Risk Assessment — Process of identifying and evaluating security risks.
Risk Management — Strategies to reduce and manage security risks.

S

Sandbox — Isolated environment for safely testing untrusted software.
Secure Shell (SSH) — Encrypted protocol for secure remote system access.
Security Awareness Training — Educating employees about security threats and best practices.
Security Information and Event Management (SIEM) — Platform aggregating and analyzing security logs.
Security Incident — Breach or violation of security policy.
Smishing — Phishing attacks via SMS text messages.
Social Engineering — Manipulating people into revealing confidential information.
Software-as-a-Service (SaaS) Security — Securing cloud-based applications.
SSL/TLS — Protocols encrypting data in transit between systems and websites.

T

Threat — Potential cause of security breach (attacker, malware, natural disaster).
Threat Intelligence — Information about cyber threats used to improve defenses.
Threat Model — Analysis identifying potential threats to a system.
Token — Credential proving identity or permission to access resources.
Trojan (Trojan Horse) — Malware disguised as legitimate software.
Tunnel — Encrypted connection through network for secure communication.
Two-Factor Authentication (2FA) — MFA using exactly two verification methods.

U

User Access Control (UAC) — System prompting for permission before allowing privileged actions.
User Behavior Analytics (UBA) — Technology detecting suspicious user activity patterns.

V

Virus — Malware that replicates itself by attaching to host programs.
Virtual Private Network (VPN) — Encrypted tunnel hiding user identity and protecting data on public networks.
Vulnerability — Weakness in software, hardware, or processes exploitable by attackers.
Vulnerability Assessment — Systematic scanning to identify weaknesses in systems.
Vulnerability Management — Process of finding, evaluating, and patching vulnerabilities.
Vishing — Voice phishing: phone calls deceiving victims into revealing information.

W

Web Application Firewall (WAF) — Firewall protecting web applications from attacks.
White Hat — Ethical hacker using skills to improve security (opposite of Black Hat attacker).
Whitelisting — Allowing only pre-approved software or IP addresses (more secure than blacklisting).
Worm — Self-replicating malware spreading across networks without requiring user interaction.

X

XML External Entity (XXE) Attack — Exploiting XML processing to access unauthorized data.

Y

Zero-Day Vulnerability — Unknown vulnerability before vendor releases patch.

Z

Zero Trust — Security model verifying every user and device continuously. Never trust implicitly.
Zero Trust Architecture — Complete implementation of Zero Trust principles across all systems.
Zip Bomb — Compressed file designed to crash systems when decompressed.

GuardianHubX Solutions

Transform your security knowledge into protection

Know your organization's cybersecurity status

Free report Complete the questionnaire in under 2 minutes

Take the test

Ready to improve your digital security?

Contact us for a personalized demo or to resolve any questions about Cybersecurity Glossary: Your Complete Reference 2026.

Get in touch with us

Sending

Get in Touch

info@guardianhubx.com

+34 93 415 31 15

Frequently Asked Questions

Mastering these terms enables you to make informed security decisions, understand audit reports, evaluate solutions, and communicate risks to your team. You can’t protect what you don’t understand.

If there’s just one: Phishing. It initiates 91% of all successful attacks. It’s the most common entry point for ransomware, malware, and targeted attacks. Understanding it means understanding where most breaches begin.

Zero Trust is a security model that assumes all connections are untrusted until proven otherwise. Instead of creating a protected perimeter, it requires continuous authentication and verification of every user and device, even within the network.

Malware is the general term for any malicious software. A virus is a specific type that needs a host program to spread. Ransomware is malware that encrypts files and demands payment. All are malware, but not all malware is a virus or ransomware.

Antivirus prevents some attacks, but not all. If you suffer ransomware, a targeted attack, or data loss, backup is your final safety net. Without backup, you lose information permanently.

Cybersecurity Glossary: The Language of Digital Protection

You can't protect what you don't understand