Every time I onboard someone new to a security team, the same thing happens: they’re technically capable, sometimes more capable than I was at their stage, but the vocabulary trips them up in meetings. Nobody hands you a glossary on day one, so you end up nodding along to acronyms until you can quietly Google them later. This is the glossary I wish someone had given me — organized by domain, with enough context that you understand not just what each term means, but why it matters.
Why Vocabulary Matters in Cybersecurity
Precise terminology isn’t pedantry — in incident response, the difference between “vulnerability,” “exploit,” and “breach” changes the entire response plan. Misusing terms in a report or postmortem can misdirect remediation effort or misrepresent risk to leadership. Getting this vocabulary right is a foundational, not cosmetic, skill.
Core Threat and Attack Terminology
| # | Term | Definition |
|---|---|---|
| 1 | Malware | Malicious software designed to damage, disrupt, or gain unauthorized access to systems |
| 2 | Ransomware | Malware that encrypts data and demands payment for decryption |
| 3 | Phishing | Social engineering attack using deceptive communication to steal credentials or deliver malware |
| 4 | Spear Phishing | Highly targeted phishing aimed at a specific individual or organization |
| 5 | Zero-Day | A vulnerability unknown to the vendor, with no available patch |
| 6 | Exploit | Code or technique that takes advantage of a vulnerability |
| 7 | Vulnerability | A weakness that could be exploited to compromise a system |
| 8 | Botnet | A network of compromised devices controlled remotely, often for DDoS or spam |
| 9 | DDoS | Distributed Denial of Service — overwhelming a system with traffic to disrupt availability |
| 10 | Man-in-the-Middle (MitM) | An attack intercepting communication between two parties |
| 11 | SQL Injection | Injecting malicious SQL to manipulate a database via an application |
| 12 | Cross-Site Scripting (XSS) | Injecting malicious scripts into web content viewed by other users |
| 13 | Cross-Site Request Forgery (CSRF) | Tricking an authenticated user into executing unwanted actions |
| 14 | Privilege Escalation | Gaining higher-level access than originally authorized |
| 15 | Lateral Movement | An attacker moving through a network after initial compromise |
| 16 | Advanced Persistent Threat (APT) | A prolonged, targeted intrusion campaign, often state-sponsored |
| 17 | Social Engineering | Manipulating people into divulging information or performing actions |
| 18 | Rootkit | Malware designed to maintain hidden, privileged access to a system |
| 19 | Keylogger | Software or hardware that records keystrokes to capture credentials |
| 20 | Supply Chain Attack | Compromising a trusted third-party vendor or software update to reach the real target |
Defensive and Control Terminology
| # | Term | Definition |
|---|---|---|
| 21 | Firewall | A system controlling network traffic based on defined rules |
| 22 | IDS / IPS | Intrusion Detection/Prevention System — monitors and optionally blocks malicious network activity |
| 23 | SIEM | Security Information and Event Management — centralized log collection, correlation, and alerting |
| 24 | EDR | Endpoint Detection and Response — monitoring and response tooling for endpoint devices |
| 25 | XDR | Extended Detection and Response — correlates data across endpoints, network, and cloud |
| 26 | MFA | Multi-Factor Authentication — requiring two or more independent verification factors |
| 27 | Zero Trust | A security model assuming no implicit trust, verifying every access request regardless of origin |
| 28 | Least Privilege | Granting only the minimum access necessary to perform a function |
| 29 | Patch Management | The process of identifying, testing, and deploying software updates |
| 30 | Encryption | Transforming data into unreadable form without the correct key |
| 31 | Hashing | A one-way transformation used to verify integrity, commonly for password storage |
| 32 | PKI | Public Key Infrastructure — the system managing digital certificates and public-key encryption |
| 33 | VPN | Virtual Private Network — encrypted tunnel for secure remote connectivity |
| 34 | DLP | Data Loss Prevention — controls preventing unauthorized data exfiltration |
| 35 | WAF | Web Application Firewall — filters and monitors HTTP traffic to/from a web application |
| 36 | Sandboxing | Isolating code execution to observe behavior without risking the host system |
| 37 | Honeypot | A decoy system designed to attract and analyze attacker behavior |
| 38 | Segmentation | Dividing a network into isolated zones to limit lateral movement |
| 39 | Backup and Recovery | Processes ensuring data can be restored after loss or compromise |
| 40 | Patch/Vulnerability Scanner | Tooling that identifies known vulnerabilities across systems |
Governance, Risk, and Compliance Terminology
| # | Term | Definition |
|---|---|---|
| 41 | Risk Assessment | The process of identifying and evaluating risk to organizational assets |
| 42 | Risk Appetite | The level of risk an organization is willing to accept |
| 43 | CIA Triad | Confidentiality, Integrity, Availability — the foundational security model |
| 44 | GDPR | General Data Protection Regulation — EU data privacy law |
| 45 | HIPAA | Health Insurance Portability and Accountability Act — US healthcare data regulation |
| 46 | PCI DSS | Payment Card Industry Data Security Standard |
| 47 | SOC 2 | Service Organization Control 2 — an audit standard for service providers’ security controls |
| 48 | ISO/IEC 27001 | International standard for information security management systems |
| 49 | NIST CSF | NIST Cybersecurity Framework — voluntary risk-based security guidance |
| 50 | Audit Trail | A chronological record of system activity used for accountability and investigation |
Identity and Access Terminology
| # | Term | Definition |
|---|---|---|
| 51 | IAM | Identity and Access Management |
| 52 | RBAC | Role-Based Access Control |
| 53 | SSO | Single Sign-On |
| 54 | Privileged Access Management (PAM) | Controls specifically governing elevated/administrative accounts |
| 55 | Federation | Trust relationship allowing identity verification across organizational boundaries |
Incident Response and Forensics Terminology
| # | Term | Definition |
|---|---|---|
| 56 | Incident Response (IR) | The structured process of detecting, containing, and recovering from a security incident |
| 57 | Chain of Custody | Documentation proving evidence integrity throughout an investigation |
| 58 | IOC | Indicator of Compromise — forensic evidence suggesting a system has been breached |
| 59 | TTPs | Tactics, Techniques, and Procedures — how a threat actor operates, per frameworks like MITRE ATT&CK |
| 60 | Root Cause Analysis | Determining the underlying cause of an incident to prevent recurrence |
| 61 | Digital Forensics | The scientific process of collecting and analyzing digital evidence |
Emerging and Advanced Terminology
| # | Term | Definition |
|---|---|---|
| 62 | Threat Intelligence | Contextual information about existing or emerging threats used to inform defense |
| 63 | Attack Surface | The total sum of points where an attacker could attempt entry |
| 64 | Red Team / Blue Team / Purple Team | Offensive testers / defenders / collaborative combined exercises |
| 65 | Bug Bounty | A program rewarding external researchers for responsibly disclosed vulnerabilities |
| 66 | Shift Left (Security) | Integrating security earlier in the software development lifecycle |
| 67 | Cyber Kill Chain | A model describing the stages of a cyberattack, from reconnaissance to objectives |
How These Terms Relate
flowchart TD
A[Threats & Attack Techniques] --> B[Vulnerabilities Exploited]
B --> C[Defensive Controls Applied]
C --> D[Governance & Compliance Frameworks Guide Controls]
D --> E[Identity & Access Management Enforces Policy]
E --> F[Incident Response When Controls Fail]
F --> G[Threat Intelligence Feeds Back Into Defense]
G --> A
Real-World Application
I once watched a postmortem meeting nearly go off the rails because “breach” and “incident” were used interchangeably by different stakeholders — legal treated any use of “breach” as triggering regulatory notification obligations, while the technical team meant it casually to describe any anomalous access attempt, successful or not. After that meeting, we standardized internal vocabulary against NIST definitions specifically to avoid mischaracterizing events with legal and regulatory consequences. That’s the practical stakes behind what looks like a simple glossary exercise.
Common Mistakes
- Using “hacker” and “threat actor” interchangeably with terms like “vulnerability” or “exploit,” blurring distinct concepts.
- Confusing a vulnerability (a weakness) with an exploit (the method used to take advantage of it).
- Treating “incident” and “breach” as synonyms when regulatory definitions often distinguish them.
- Misapplying compliance terms (e.g., calling any security review a “SOC 2 audit” when it isn’t one).
Best Practices
- Standardize terminology across technical, legal, and executive teams to avoid miscommunication during incidents.
- Reference authoritative glossaries (NIST, MITRE, ISO) rather than informal definitions when precision matters.
- Revisit and train on updated terminology as the field evolves — terms like XDR and Zero Trust didn’t exist in common usage a decade ago.
FAQs
What’s the difference between a vulnerability and an exploit? A vulnerability is the weakness itself; an exploit is the code or technique that takes advantage of that weakness.
Are “hacker” and “threat actor” the same thing? “Threat actor” is the more precise professional term, referring to any individual or group conducting malicious activity, without the ambiguous cultural connotations “hacker” carries.
What’s the best authoritative source for cybersecurity definitions? NIST’s Computer Security Resource Center glossary and MITRE’s ATT&CK framework are widely regarded as authoritative, standardized references.
Do these terms apply the same way across industries? Core technical terms are consistent, but compliance-related terms (HIPAA, PCI DSS) are industry-specific and should be applied only where legally relevant.
Summary and Recommendations
Precise cybersecurity vocabulary isn’t academic — it directly affects how incidents are classified, escalated, and legally interpreted. Anchor your team’s terminology to authoritative sources like NIST and MITRE, and revisit it regularly as the field’s language continues to evolve.
References:
- NIST Computer Security Resource Center Glossary: https://csrc.nist.gov/glossary
- MITRE ATT&CK: https://attack.mitre.org/
- ISO/IEC 27000 series: https://www.iso.org/standard/27001
- SANS Glossary of Security Terms: https://www.sans.org/security-resources/glossary-of-terms/