Cyber security jargon in plain English: the basics every beginner needs
Cyber security has its own vocabulary, and it can make the industry feel harder to get into than it is. Most of the words describe ideas you already understand from everyday life: locks, alarms, keys and the people who check them.
Here are the core terms, grouped into; what we protect, what can go wrong, how we protect it and who does the work.
What we’re protecting
- Asset: anything of value to an organisation that needs protecting, such as laptops, servers, data and accounts.
- Network: devices connected so they can share information, from home Wi-Fi to a global company’s systems.
- Endpoint: any device connected to a network, such as a laptop, phone or server.
What can go wrong
- Threat: anything that could cause harm, such as a criminal group, a careless insider or even a flood.
- Vulnerability: a weakness that could be used to cause harm, such as unpatched software or a weak password.
- Risk: how likely harm is, combined with how much damage it would do.
- Exploit: code or a technique that takes advantage of a vulnerability to get into a system.
- Malware: software designed to cause harm, including viruses, ransomware and spyware.
- Ransomware: malware that locks or scrambles files and demands payment to release them.
- Phishing: messages designed to trick people into clicking a link, opening a file or handing over details.
- Social engineering: manipulating people, rather than technology, to get access or information. A phone call from someone pretending to be IT is a classic example.
A simple way to remember the first three: the burglar is the threat, the open window is the vulnerability, and the risk is how likely a break-in is and what you’d lose.
Phishing is common. In the government’s Cyber Security Breaches Survey 2025/26, 38% of UK businesses said they had experienced it in the previous 12 months.
How we protect against it
- Patch: an update that fixes a bug or security weakness.
- Firewall: a filter that checks network traffic and blocks anything that breaks its rules.
- Authentication: confirming someone is who they say they are.
- Authorisation: deciding what a confirmed user is allowed to do. Getting into the building is authentication; being allowed into certain rooms is authorisation.
- MFA: multi-factor authentication. Needing two or more proofs to log in, such as a password plus a code on your phone.
- Encryption: scrambling data so only someone with the right key can read it.
- Least privilege: giving people only the access they need to do their job.
- Backup: a separate copy of data you can restore if the original is lost or locked.
Who does the work
- SOC: security operations centre. The team that monitors an organisation’s systems for threats and responds, often in shifts around the clock.
- SIEM: a tool that gathers logs from across an organisation and flags suspicious patterns. Splunk is a widely used example.
- Triage: sorting alerts by urgency so the serious ones are looked at first. Most SOC analysts start at Tier 1, doing exactly this.
The UK baseline: Cyber Essentials
Cyber Essentials is a UK government-backed certification scheme developed by the National Cyber Security Centre (NCSC). It sets a baseline of protection against common internet-based attacks, built on five technical controls:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
Only 5% of UK businesses held Cyber Essentials certification in the latest Breaches Survey, up from 3% the year before. Understanding the five controls is a good first step into the governance side of cyber security.
Next step:
Get our free Cyber Security Jargon Buster, with 64 terms in plain English, or try our free phishing challenge to put your new vocabulary to work.
