Security teams around the world work in English: alerts, vulnerability advisories, incident reports, audit findings and penetration test reports all rely on the same shared vocabulary. Knowing these terms helps security professionals read advisories and threat reports quickly, write clear incident notes and explain risks to managers, auditors and international colleagues.
100 terms
10 topics
40 core terms
200 example sentences
Read, understand, keep going
No account needed. Read the meaning, see where the term is used, then study the examples. Click any word in the lesson for help. You can also select a word and press Alt + Enter.
Threats and Attacks
threat
noun
Meaning
Anything that could cause harm to a system or to data, such as an attacker, a piece of malware, a careless employee or even a flood in the server room.
Where you use it
Used constantly in risk discussions, threat reports and briefings. Security people talk about threats to an organisation, emerging threats and the threat landscape. A threat is the possible source of harm; a vulnerability is the weakness it could use.
Examples
Insider threats are harder to detect because the person already has legitimate access.
The quarterly report summarises the main threats to our payment systems.
Usage note
Threat, vulnerability and risk are not synonyms. Roughly: risk = how likely a threat is to use a vulnerability × how bad the impact would be.
Common phrases
insider threat · emerging threat · threat landscape · threat model · pose a threat
A trick in which attackers send fake emails, messages or websites that look trustworthy, hoping people will click a link, open a file or reveal their passwords.
Where you use it
Probably the word employees hear most in security training. Teams talk about phishing emails, phishing campaigns and phishing simulations. Targeted phishing is called spear phishing; phishing by text message is smishing and by phone call is vishing.
Examples
Several staff reported the phishing email before anyone entered their password.
Our last phishing simulation had a click rate of eight percent.
Usage note
Spelled with 'ph' but pronounced exactly like 'fishing'.
A piece of code or a technique that takes advantage of a vulnerability to make a system do something it was not designed to do.
Where you use it
Also a verb: attackers exploit a vulnerability, and the act is called exploitation. Advisories say whether a vulnerability is 'actively exploited' or has a 'public exploit', and either fact raises its patch priority.
Examples
A public exploit for this flaw was released two days after the advisory.
The attackers exploited an unpatched VPN appliance to get in.
Usage note
The stress changes with the part of speech: the noun is EX-ploit, the verb is ex-PLOIT.
Common phrases
public exploit · actively exploited · exploit a vulnerability · exploit code · exploit chain
To get unauthorised access to or control of a system, account or network, so that it can no longer be trusted.
Where you use it
Very common in incident language, usually in the passive or as an adjective: 'the account was compromised', 'a compromised host'. As a noun it means the successful attack itself, as in 'signs of compromise' or 'business email compromise (BEC)'.
Examples
We believe the attacker compromised a contractor's account first.
Two compromised hosts were isolated from the network.
Usage note
False friend: in everyday English 'compromise' means an agreement in which both sides give something up. In security it means that a system has been taken over.
Manipulating people, rather than breaking technology, to make them reveal information, give access or take an action that helps an attacker.
Where you use it
The umbrella term for phishing, pretexting (inventing a believable story), fake help-desk calls and tailgating into buildings. Used in awareness training and in pentest scopes, where a social engineering test must be explicitly approved.
Examples
The caller used social engineering, pretending to be from IT and asking for a reset code.
Social engineering is out of scope for this year's test.
Common phrases
social engineering attack · social engineering test · pretexting · tailgating
Distributed denial of service: an attack that floods a website or network with traffic from many machines at once so that real users cannot reach it.
Where you use it
Usually pronounced 'dee-doss'. The single-source version is a DoS attack. Companies buy DDoS protection or mitigation from their internet provider or a cloud service; the traffic often comes from a botnet.
Examples
The online banking site was down for an hour because of a DDoS attack.
Our DDoS protection absorbed the traffic before it reached the data centre.
All the points where an attacker could try to get into a system or organisation or take data out, such as open ports, web apps, user accounts and suppliers.
Where you use it
Teams talk about reducing or shrinking the attack surface, for example by switching off unused services. 'External attack surface' means everything visible from the internet; tools that track it are called attack surface management (ASM) tools.
Examples
Every new cloud service we add increases our attack surface.
Turning off the old FTP server was an easy way to reduce the attack surface.
Common phrases
reduce the attack surface · external attack surface · attack surface management · expand the attack surface
An attack that tries a huge number of passwords or keys one after another, usually automatically, until the right one is found.
Where you use it
Usually seen in logs as many failed logins from one source. Related forms are password spraying (one common password tried against many accounts) and credential stuffing (reusing leaked username and password pairs). Account lockout and MFA are typical defences.
Examples
The SIEM flagged a brute-force attack against the VPN login page.
Account lockout stopped the brute-force attack after five failed attempts.
Gaining higher access rights than one was given, for example moving from a normal user account to administrator, usually by abusing a flaw or misconfiguration.
Where you use it
Common in pentest reports and incident timelines. 'Vertical' escalation means gaining higher rights; 'horizontal' escalation means reaching another user's rights at the same level. Often shortened to 'privesc'. Least privilege and regular patching limit the risk.
Examples
The vulnerability allows local privilege escalation on unpatched Windows hosts.
The timeline shows privilege escalation about an hour after the first login.
The way attackers move from the first compromised machine to other systems inside the same network, looking for valuable data or higher privileges.
Where you use it
A key phase in incident analysis and in frameworks such as MITRE ATT&CK. Defenders try to detect and limit lateral movement with segmentation, EDR and monitoring of admin logins. Reports say that attackers 'moved laterally'.
Examples
We saw lateral movement from the HR laptop to two file servers.
Segmentation made lateral movement much harder for the attackers.
Common phrases
detect lateral movement · move laterally · limit lateral movement · MITRE ATT&CK
A vulnerability in which input sent to an application is treated as part of a database query, so that an attacker can read or change data they should not reach.
Where you use it
Often written SQLi. One of the classic web vulnerabilities in the 'Injection' category of the OWASP Top 10. Developers prevent it with parameterised queries (prepared statements) and input validation; pentest reports usually rate it high.
Examples
The search form was vulnerable to SQL injection, so we switched to parameterised queries.
The WAF blocked several SQL injection attempts against the login page.
A web vulnerability in which an application includes untrusted input in a page without proper encoding, so that a harmful script runs in other users' browsers.
Where you use it
Abbreviated XSS, not CSS, which is the styling language. Types include stored, reflected and DOM-based XSS. Output encoding and a Content Security Policy (CSP) are the standard defences, and reports often rate stored XSS higher than reflected XSS.
Examples
The comment field had a stored cross-site scripting flaw.
Encoding the output fixed the cross-site scripting issue on the profile page.
An attack in which someone secretly places themselves between two communicating parties so that they can read or change the traffic passing between them.
Where you use it
Often shortened to MITM. Typical settings are public Wi-Fi and unencrypted connections; TLS with proper certificate checks is the main protection. Many organisations now prefer the neutral terms 'on-path attack' or 'adversary-in-the-middle' (AitM).
Examples
Without certificate validation, the mobile app was open to a man-in-the-middle attack.
HSTS helps protect users from man-in-the-middle attacks on the login page.
A person or group responsible for a cyberattack or threat, such as a criminal gang, a state-backed group, a hacktivist or a malicious insider.
Where you use it
The neutral, professional word used in reports instead of 'hacker'. Threat intelligence firms track groups and give them names; well-resourced, long-term groups are called APTs (advanced persistent threats). Reports describe a threat actor's motives, tools and techniques.
Examples
The threat actor behind the campaign appears to be financially motivated.
We have no evidence linking this incident to a known threat actor.
Common phrases
financially motivated · state-sponsored group · APT group · attribute an attack
Faking an identity or source, such as an email sender, a phone number, a website or an IP address, so that a message or connection seems to come from someone trusted.
Where you use it
Used with many objects: email spoofing, caller ID spoofing, domain spoofing, ARP spoofing. The verb is 'spoof', and a spoofed email is one with a forged sender. Email protections such as SPF, DKIM and DMARC are designed against sender spoofing.
Examples
The invoice email used spoofing to look as if it came from our CEO.
Since we enforced DMARC, spoofing of our domain has dropped sharply.
Short for 'malicious software': any program written to damage systems, steal data, spy on users or take control of a device without permission.
Where you use it
The general umbrella word: viruses, worms, trojans, ransomware and spyware are all types of malware. Analysts talk about malware samples, malware families and malware analysis. It is uncountable, so say 'a piece of malware'.
Examples
The malware was hidden inside a fake invoice attachment.
We sent the malware sample to the analysis team.
Usage note
Malware is uncountable in English. Turkish speakers often write 'a malware' or 'malwares'; use 'a piece of malware', 'malware samples' or 'malware families' instead.
Malware that encrypts a victim's files or systems and demands a payment, usually in cryptocurrency, in exchange for the key to unlock them.
Where you use it
Common in news, board meetings and incident reports. People speak of a ransomware attack, a ransom note and a ransom demand. Many groups now also steal data before encrypting it and threaten to publish it, which is called double extortion.
Examples
The ransomware encrypted the file servers overnight, but the backups were offline and safe.
Our tabletop exercise this year is based on a ransomware scenario.
Common phrases
ransomware attack · ransomware group · ransom note · double extortion · recover from ransomware
A type of malware that attaches itself to a file or program and spreads to other files when that program is run.
Where you use it
Outside the profession, 'virus' is used for any kind of malware, as in 'my computer has a virus'. Professionals use it more precisely and prefer 'malware' as the general word. Antivirus products keep the old name even though they detect all types.
Examples
The user thought it was a virus, but it turned out to be adware.
The virus spread through infected files on a shared USB drive.
Security software that scans files and devices to detect, block and remove malware, using known signatures and suspicious behaviour.
Where you use it
Often shortened to AV. People update antivirus signatures, run an antivirus scan or say that a file was 'flagged by antivirus'. In companies, classic antivirus is increasingly replaced or extended by EDR tools.
Examples
The attachment was flagged by antivirus and moved to quarantine.
Make sure the antivirus signatures are up to date on the build servers.
Malware disguised as a useful or harmless program, such as a free tool or a document, that secretly performs harmful actions once it is run.
Where you use it
Short for 'Trojan horse', from the Greek legend. Unlike a worm, it does not spread by itself; the user has to run it. A remote access trojan (RAT) gives the attacker control of the machine, and banking trojans steal online banking details.
Examples
The cracked software from the forum turned out to contain a trojan.
Analysis shows the trojan was sending screenshots to a remote server.
Malware that copies itself and spreads from one computer to another across a network without any action from the user.
Where you use it
Known for spreading very fast, often through an unpatched network service. A vulnerability is called 'wormable' when malware could use it to spread this way, which makes patching urgent.
Examples
The worm spread to hundreds of machines through an old file-sharing service.
The vendor rated the flaw as wormable, so we patched it the same day.
Malware that secretly watches what a user does and collects information such as browsing habits, messages, passwords or location.
Where you use it
Used both for simple programs that track browsing and for advanced commercial tools that target mobile phones. Like malware, it is uncountable: 'a piece of spyware'. Related words are adware and stalkerware.
Examples
The mobile team found spyware on two executives' phones during the review.
This browser extension behaves like spyware: it sends every visited URL to a third party.
Software or a small hardware device that secretly records every key a user presses, often to capture passwords and private messages.
Where you use it
Often part of a trojan or spyware rather than a separate program. Hardware keyloggers are small plugs between a keyboard and a computer, so physical checks matter in shared offices. The activity is called keylogging or keystroke logging.
Examples
The trojan included a keylogger that captured the user's banking password.
During the office check we found a hardware keylogger on a reception PC.
A network of many infected computers or devices, called bots, that an attacker controls remotely and uses together, for example to send spam or run DDoS attacks.
Where you use it
The bots receive orders from a command-and-control (C2) server. Many modern botnets are made of insecure IoT devices such as cameras and routers. Security news often reports botnet takedowns by police and companies.
Examples
The DDoS traffic came from a botnet of hacked security cameras.
Two of our servers were talking to a known botnet C2 address.
A hidden way into a system that bypasses normal authentication, either left by developers or installed by attackers so they can return later.
Where you use it
Used as a noun ('a backdoor') and sometimes as a verb ('backdoored software'). Incident reports say attackers 'planted' a backdoor for persistence; supply-chain attacks may hide one inside a trusted update. Policy debates about 'encryption backdoors' also use the word.
Examples
The attackers left a backdoor on the web server so that they could return later.
We rebuilt the server from scratch because we could not rule out a backdoor.
Common phrases
plant a backdoor · remove a backdoor · backdoored update · persistent access
The part of malware or an attack that carries out the actual harmful action, such as encrypting files or opening remote access, after the initial delivery.
Where you use it
Analysts describe how a payload was delivered (by email, a download or an exploit) and what it did. In networking and APIs, 'payload' simply means the data carried in a message, so the context matters.
Examples
The macro in the document downloaded the final payload from a remote server.
The sandbox report shows that the payload was a remote access trojan.
An isolated, controlled environment where suspicious files or programs can be run safely to see what they do, without any risk to real systems.
Where you use it
Email gateways and malware analysts 'detonate' attachments in a sandbox and read the sandbox report. The word is also used for browser and app sandboxes that limit what code can do. Some malware checks whether it is in a sandbox and hides its behaviour.
Examples
We ran the attachment in a sandbox, and it tried to contact three unknown domains.
The email gateway holds attachments until the sandbox analysis is finished.
Common phrases
sandbox analysis · detonate in a sandbox · sandbox report · sandbox evasion
The process of checking that a user, device or system really is who or what it claims to be, for example with a password, a code or a fingerprint.
Where you use it
A core word in identity and access discussions. A user authenticates, a login fails authentication, or a system uses certificate-based authentication. In technical writing it is often shortened to 'authN', especially next to 'authZ' for authorization.
Examples
The API rejects any request that fails authentication.
We are moving the admin portal to certificate-based authentication.
Usage note
Authentication answers 'Who are you?'; authorization answers 'What are you allowed to do?'. Mixing them up is a common interview mistake.
A secret string of characters that a person types to prove their identity and log in to an account, device or system.
Where you use it
An everyday word in security policies and help-desk work. Passwords are set, changed, reset and rotated, and policies define their length and complexity. Current guidance, such as NIST's, favours long passphrases over frequent forced changes.
Examples
Your password has expired, so you'll need to reset it before you can log in.
The audit found shared admin passwords stored in a spreadsheet.
Usage note
Everyday Turkish uses 'şifre' for password, but security texts prefer 'parola', because 'şifre' also means a cipher or encryption.
A login method that asks for two or more different kinds of proof, such as a password plus a code from a phone, before granting access.
Where you use it
Almost always called MFA in speech; 2FA (two-factor authentication) is the two-factor version. Teams enable, enforce or roll out MFA. The factors are usually described as something you know, something you have and something you are.
Examples
We enforced multi-factor authentication for all remote access last month.
The stolen password was useless because the account had multi-factor authentication.
The rules and technical measures that decide who or what can use a system, view data or enter a place, and what they are allowed to do there.
Where you use it
Covers both digital and physical security, since badge readers are access control too. Auditors check access control lists, user access reviews and how leavers' accounts are removed. Common models are role-based (RBAC) and attribute-based (ABAC) access control.
Examples
Weak access control let any logged-in user download other customers' invoices.
We review access control for the finance share every quarter.
Common phrases
access control list · physical access control · broken access control · access review
The process of deciding what an authenticated user or system is allowed to do, such as which files they can read or which actions they can perform.
Where you use it
Always comes after authentication. Developers and auditors talk about authorization checks, permissions and roles; a missing check is an authorization flaw. Often written 'authZ'. British texts may spell it 'authorisation'.
Examples
The API checks authorization on every request, not just at login.
This finding is an authorization issue: users can edit records they should only be able to view.
Usage note
In business English 'authorization' can also mean official permission, for example the written authorization a company signs before a penetration test.
The details that prove who a user is and let them log in, most often a username and password, but also keys, tokens and certificates.
Where you use it
Usually plural. People speak of stolen, leaked, compromised or hard-coded credentials and of credential theft. After an incident, teams reset or rotate credentials. Many breaches start with valid credentials rather than with an exploit.
Examples
The attacker logged in with valid credentials taken from a phishing page.
We found database credentials hard-coded in the source code.
Usage note
In everyday English 'credentials' also means qualifications, as in 'her academic credentials'. In security it almost always means login details.
A login system that lets a user sign in once with one set of credentials and then use many different applications without logging in again.
Where you use it
Called SSO, letter by letter. Companies connect apps to an identity provider (IdP) such as Microsoft Entra ID or Okta using protocols like SAML or OpenID Connect. SSO is convenient and centralises control, but it makes the IdP account very valuable to attackers.
Examples
The new HR app supports single sign-on, so staff can use their normal company login.
Every SaaS tool must be connected to single sign-on before it goes live.
A way of managing permissions in which rights are given to roles, such as 'accountant' or 'admin', and users get access by being assigned to a role.
Where you use it
Called RBAC, pronounced 'ar-back'. It makes access reviews easier because auditors check roles instead of individual permissions. A frequent problem is 'role creep', when users collect roles over time and keep access they no longer need.
Examples
With role-based access control, new nurses get the right permissions on day one.
We are redesigning the role-based access control model for the cloud accounts.
Common phrases
RBAC model · assign a role · role creep · role-based permissions
The principle that every user, program or system should get only the minimum access it needs to do its job, and nothing more.
Where you use it
Usually heard as 'the principle of least privilege' (PoLP) in policies, audit findings and cloud design reviews. A typical finding reads: 'Service accounts do not follow least privilege.' It limits how far an attacker can get with one compromised account.
Examples
Following least privilege, the backup account can read files but not delete them.
Developers had full admin rights in production, which breaks least privilege.
Common phrases
principle of least privilege · enforce least privilege · least-privilege access · excessive privileges
The process of turning readable data into a scrambled form that only someone with the right key can turn back into its original form.
Where you use it
Used for data in two states: 'encryption at rest' protects stored data and 'encryption in transit' protects data moving across a network. You encrypt data, enable encryption and use strong encryption. Auditors often ask which algorithm and key length a system uses.
Examples
All customer data is protected with encryption at rest and in transit.
The laptop was stolen, but full-disk encryption was enabled, so the data is safe.
Usage note
Encoding (for example Base64) is not encryption: anyone can reverse encoding without a key.
Common phrases
encryption at rest · encryption in transit · full-disk encryption · strong encryption · enable encryption
To turn encrypted data back into its original, readable form, normally by using the correct key.
Where you use it
The opposite of encrypt; the noun is decryption. Common in ransomware cases (a decryptor tool or decryption key), in TLS inspection, where a firewall decrypts traffic to check it, and in key management discussions.
Examples
Without the private key, nobody can decrypt these files.
The proxy decrypts outbound traffic so that the DLP tool can inspect it.
Usage note
Do not confuse decrypt with 'crack': to crack means to break encryption or a password without having the key.
A secret value, usually a long string of bits, that an encryption algorithm uses to lock and unlock data. Without it, the encrypted data cannot be read.
Where you use it
Teams generate, store, rotate and revoke keys, often in a key management service (KMS) or a hardware security module (HSM). Key length is given in bits, as in AES-256. Losing a key can mean losing the data.
Examples
The encryption keys are stored in an HSM, not on the application server.
We rotate the database encryption key every twelve months.
Common phrases
rotate a key · key management · private key · key length · revoke a key
A fixed-length value calculated from data by a one-way function. The same input always gives the same hash, but the original data cannot be rebuilt from it.
Where you use it
Also a verb: passwords are hashed, not encrypted. Analysts share file hashes (MD5, SHA-1, SHA-256) to identify malware and compare hashes to prove that evidence has not changed. MD5 and SHA-1 are no longer considered safe for security purposes.
Examples
Can you send me the SHA-256 hash of the suspicious file?
User passwords are hashed with a salt before they are stored.
Usage note
Hashing is not encryption: encrypted data can be turned back with a key, while a hash is designed to be one-way.
Common phrases
file hash · password hash · hash function · hash value · salted hash
An electronic document that links a public key to an identity, such as a website or a person, and is signed by a trusted certificate authority.
Where you use it
Mostly called just a 'certificate' or 'cert'. Websites use TLS certificates for HTTPS; teams issue, install, renew and revoke them. An expired certificate is a classic cause of outages and browser warnings.
Examples
The site is showing a warning because its digital certificate expired last night.
We use a script to renew our digital certificates automatically every 60 days.
Usage note
People still say 'SSL certificate', even though these certificates are used with TLS today.
Transport Layer Security: the standard protocol that encrypts data travelling between two systems, such as a browser and a website, and checks the server's identity.
Where you use it
Said letter by letter. TLS is the security layer behind the 'S' in HTTPS and the successor of the older SSL protocol; TLS 1.2 and 1.3 are the versions in normal use. Audits check that old versions are disabled and weak cipher suites removed.
Examples
All internal services must use TLS 1.2 or higher.
The scan flagged a server that still accepts TLS 1.0.
A type of cryptography that uses a pair of related keys: a public key that can be shared with anyone and a private key that its owner keeps secret.
Where you use it
Also called asymmetric cryptography, in contrast to symmetric encryption, where one shared key does both jobs. It underpins TLS, digital signatures, SSH keys and certificates. RSA and elliptic-curve cryptography (ECC) are common algorithms.
Examples
Public-key cryptography lets the browser and the server agree on a secret without meeting first.
The team is planning how its public-key cryptography will move to post-quantum algorithms.
Common phrases
public key · private key · key pair · asymmetric encryption · public key infrastructure
Encryption in which only the sender and the intended recipient can read the messages, so even the service provider in the middle cannot see their content.
Where you use it
Often shortened to E2EE. Used mostly for messaging apps, video calls and some file-sharing services. Compare it with encryption in transit, where the provider can still read the data on its own servers.
Examples
Because the chat app uses end-to-end encryption, the provider cannot hand over message content.
The client asked whether our file transfer service offers end-to-end encryption.
Common phrases
end-to-end encrypted · E2EE messaging · end-to-end encryption by default
A cryptographic value attached to a message, document or file that proves who created it and shows that it has not been changed since it was signed.
Where you use it
Created with a private key and checked with the matching public key. Used for code signing, software updates, signed emails and legally recognised e-signatures. Security tools often trust signed files more, which is why stolen code-signing certificates are serious.
Examples
The update was rejected because its digital signature did not match the vendor's key.
All contracts in the portal are approved with a qualified digital signature.
Common phrases
verify a signature · code signing · signed binary · electronic signature
Data after it has been encrypted, which looks like random characters and cannot be understood without the correct key. The readable original is called plaintext.
Where you use it
Mostly used in cryptography courses, standards and technical design documents, and almost always paired with plaintext: encryption turns plaintext into ciphertext, and decryption turns it back. 'Stored in plaintext' is a common, negative audit finding.
Examples
Even if the database is stolen, the card numbers are only ciphertext without the key.
The training tool shows the ciphertext and the plaintext side by side.
Common phrases
plaintext and ciphertext · stored in plaintext · cipher suite · block cipher
A hardware device or piece of software that checks network traffic and allows or blocks it according to a set of security rules.
Where you use it
Network and security teams talk about firewall rules, firewall policies and opening or closing ports on the firewall. Adding a rule usually needs a change request. Products that also inspect applications are called next-generation firewalls (NGFW).
Examples
Can you open port 443 on the firewall for the new web server?
The firewall blocked several connection attempts from an unknown IP range.
Common phrases
firewall rule · firewall policy · next-generation firewall · configure a firewall · behind the firewall
Virtual private network: a technology that creates an encrypted connection over the internet so that remote users or offices can reach a private network safely.
Where you use it
Said letter by letter. Employees connect to the VPN or work 'on VPN'; network teams set up site-to-site VPNs between offices. VPN gateways face the internet, so their vulnerabilities are often targeted and need quick patching.
Examples
You need to connect to the VPN before you can open the internal dashboard.
The site-to-site VPN between Istanbul and Frankfurt went down this morning.
Common phrases
connect to the VPN · VPN gateway · site-to-site VPN · remote-access VPN · VPN client
A tool that monitors network traffic or system activity for signs of attacks or policy violations and raises an alert when it finds them.
Where you use it
Usually called an IDS. An IDS only detects and alerts, while an intrusion prevention system (IPS) can also block traffic. Teams tune IDS rules to reduce false positives. Snort and Suricata are well-known open-source examples.
Examples
The intrusion detection system raised an alert for unusual traffic from a printer.
We placed the intrusion detection system between the DMZ and the internal network.
Dividing a network into separate zones, with controlled traffic between them, so that a problem in one part cannot easily spread to the others.
Where you use it
Done with VLANs, firewalls and access lists. Payment systems, industrial control networks and guest Wi-Fi are typically separated from the corporate network. A finer, per-workload version is called microsegmentation; the opposite is a 'flat network'.
Examples
Good network segmentation stopped the ransomware from reaching the factory floor.
Network segmentation around the card systems keeps our PCI DSS scope small.
Common phrases
segment the network · microsegmentation · flat network · network zone
A security model that trusts no user or device by default, even inside the company network, and checks identity and context for every request.
Where you use it
Summed up as 'never trust, always verify'. It describes a strategy, not a single product: 'zero trust architecture', 'moving to zero trust'. It replaces the older idea of a trusted internal network behind a strong perimeter.
Examples
As part of our zero trust project, the VPN will be replaced by identity-aware access.
Zero trust does not mean we distrust employees; it means every access is checked.
Common phrases
zero trust architecture · zero trust model · zero trust network access · never trust, always verify
A firewall that sits in front of web applications and filters HTTP traffic to block common web attacks such as SQL injection and cross-site scripting.
Where you use it
Called a WAF, pronounced 'waff'. It can be a cloud service, an appliance or a module on the web server. Teams write WAF rules, run them first in detection mode and then switch to blocking mode. A WAF reduces risk but does not replace fixing the code.
Examples
We put the old booking site behind a web application firewall until it can be rewritten.
The web application firewall blocked the request because it looked like SQL injection.
A network port on a device that is accepting connections, which means a service is listening there and can be reached by others.
Where you use it
Found with port scans, for example with Nmap. Each open port is part of the attack surface, so unexpected ones, such as an exposed remote desktop or database port, are common findings. People say a port is open, closed or filtered.
Examples
The external scan found an open port 3389 on a test server.
Please close any open port that the application does not need.
Common phrases
port scan · close a port · listening service · exposed port
A weakness in software, hardware, a configuration or a process that an attacker could use to cause harm or to gain access they should not have.
Where you use it
One of the most frequent words in security work. Vulnerabilities are discovered, reported, rated, patched and tracked. In speech people often shorten it to 'vuln'. A publicly known vulnerability usually gets a CVE ID and a severity score.
Examples
The scanner found three critical vulnerabilities on the public web server.
This vulnerability allows remote code execution, so it has to be patched this week.
Common phrases
critical vulnerability · known vulnerability · discover a vulnerability · patch a vulnerability · vulnerability management
A small update released by a vendor to fix a bug or close a security vulnerability in software, firmware or an operating system.
Where you use it
Also a verb: you patch a server or patch a vulnerability. Teams apply, test and roll out patches, often in a monthly cycle such as Microsoft's Patch Tuesday. 'Unpatched' systems are one of the most common audit findings.
Examples
The vendor released an emergency patch for the VPN appliance yesterday.
We patched the domain controllers over the weekend.
Common phrases
apply a patch · security patch · emergency patch · roll out patches · unpatched system
A vulnerability that is unknown to the vendor or has no patch yet, so defenders have had 'zero days' to fix it when it is first exploited.
Where you use it
Used as a noun ('a zero-day') and as an adjective ('a zero-day vulnerability', 'a zero-day exploit'). Zero-days are rare and valuable, so they make the news, but most real attacks still use known, unpatched vulnerabilities. Also written 0-day.
Examples
The attackers used a zero-day in the mail server, so there was no patch to apply.
The vendor confirmed the zero-day and published a temporary workaround.
Common Vulnerabilities and Exposures: a public catalogue that gives each publicly known vulnerability a unique ID, such as CVE-2021-44228.
Where you use it
Said letter by letter. The ID itself works as a name: 'Are we affected by CVE-2021-44228?' It shows the year and a sequence number. Vendors, scanners and advisories all refer to CVEs, so that everyone talks about the same flaw.
Examples
Can you check whether any of our servers are affected by the new CVE?
The advisory lists four CVEs, two of them rated critical.
Usage note
CVE-2021-44228 is the well-known Log4Shell vulnerability in the Log4j logging library.
Common phrases
CVE ID · assign a CVE · affected by a CVE · CVE entry
An automated check of systems, networks or applications that looks for known weaknesses, missing patches and insecure settings and lists them in a report.
Where you use it
Teams run or schedule vulnerability scans weekly or monthly with tools such as Nessus, Qualys or OpenVAS. A scan is automated and broad; a penetration test is manual and deeper. Authenticated scans log in to hosts and find more.
Examples
The monthly vulnerability scan found 120 hosts missing last month's patches.
Please exclude the production database from tonight's vulnerability scan.
Common phrases
run a vulnerability scan · authenticated scan · scan results · scheduled scan · external scan
The work of fixing a security problem at its source, such as applying a patch, changing a configuration or rewriting vulnerable code.
Where you use it
Used in vulnerability management, audits and pentest reports, which give each finding a remediation recommendation and a deadline. The verb is 'remediate'. Remediation removes the problem, while mitigation only reduces its risk.
Examples
Critical findings have a remediation deadline of 14 days.
Remediation is complete: the library was upgraded and the retest passed.
Common phrases
remediation plan · remediation deadline · track remediation · remediate a finding
To reduce the likelihood or impact of a risk or attack when it cannot be removed completely, for example with a workaround or an extra control.
Where you use it
Used constantly in advisories and risk registers: a vendor 'provides mitigations' until a patch is ready, and a team 'mitigates the risk'. The noun is mitigation; 'DDoS mitigation' means filtering out attack traffic.
Examples
Until the patch is out, we can mitigate the issue by disabling the vulnerable feature.
MFA mitigates the risk of stolen passwords but does not remove it.
Usage note
Do not confuse it with the similar-sounding 'militate' (militate against = make something less likely to happen).
Common phrases
mitigate a risk · mitigating control · risk mitigation · temporary mitigation
The ongoing process of finding, testing, approving and installing software updates across all systems, and tracking which ones are still missing.
Where you use it
Usually owned by IT operations but measured by security through patch compliance rates, patch SLAs (for example 'critical patches within 14 days') and exceptions for systems that cannot be patched. Tools such as Microsoft Intune or WSUS support the process.
Examples
Our patch management process requires critical patches to be installed within 14 days.
The audit found weak patch management on the factory systems.
Common Vulnerability Scoring System: a standard method for rating how severe a vulnerability is, with a score from 0.0 to 10.0.
Where you use it
Scores map to ratings: low (0.1–3.9), medium (4.0–6.9), high (7.0–8.9) and critical (9.0–10.0). People say 'a CVSS score of 9.8'. It is maintained by FIRST; version 4.0 was published in 2023, but many sources still show 3.1 scores.
Examples
The flaw has a CVSS score of 9.8, so it goes to the top of the list.
Our policy uses CVSS ratings to set patch deadlines.
A security weakness caused by settings that are wrong, insecure or left at their defaults, rather than by a bug in the software itself.
Where you use it
Very common in cloud security: a storage bucket left public, an admin panel open to the internet, default passwords never changed. Teams find misconfigurations with configuration scans and cloud security posture management (CSPM) tools.
Examples
The leak was caused by a misconfiguration: the storage bucket was publicly readable.
Most of the cloud findings are misconfigurations, not software vulnerabilities.
The process of making a system more secure by removing unnecessary software and services, changing default settings and applying secure configurations.
Where you use it
The verb is 'harden': you harden a server, a container image or a laptop build. Teams follow hardening guides or benchmarks such as the CIS Benchmarks and check systems against them. A 'hardened image' is a standard, secure template.
Examples
Every new Linux server goes through hardening before it reaches production.
The hardening checklist disables SMBv1 and removes default accounts.
Common phrases
system hardening · harden a server · hardening guide · CIS Benchmarks · hardened image
Reporting a vulnerability privately to the vendor or owner first and giving them reasonable time to fix it before any details are made public.
Where you use it
Today often called coordinated vulnerability disclosure (CVD). Researchers and vendors agree a deadline, often around 90 days. Companies publish a disclosure policy or a security.txt file that explains how to report issues.
Examples
Thanks to responsible disclosure, the patch was ready before the details went public.
Our responsible disclosure policy is linked from the website footer.
A file or record in which a system, application or device automatically writes down events, such as logins, errors and network connections, with the time they happened.
Where you use it
Also a verb: systems log events. Analysts collect, review, correlate and retain logs, and investigations often depend on whether the right logs were kept long enough. Common types are firewall logs, authentication logs and audit logs.
Examples
The authentication logs show 300 failed logins from the same IP in ten minutes.
We only keep firewall logs for 30 days, which is not enough for this investigation.
Security information and event management: a platform that collects logs from many systems, correlates them and raises alerts about possible attacks.
Where you use it
Usually pronounced like 'sim'. The SIEM is the central tool of a SOC: analysts write detection rules, build dashboards and search logs in it. Well-known products include Splunk, Microsoft Sentinel and Elastic Security.
Examples
Make sure the new firewall sends its logs to the SIEM.
I wrote a SIEM rule that fires when an admin logs in from a new country.
Common phrases
SIEM rule · SIEM alert · feed logs into the SIEM · SIEM dashboard
Security operations centre: the team, and often the room, that monitors an organisation's systems around the clock and responds to security alerts.
Where you use it
Pronounced 'sock'. Analysts are often grouped as Tier 1 (triage), Tier 2 (investigation) and Tier 3 (hunting and expert work). Companies may run their own SOC or buy it as a service from an MSSP. American texts spell it 'center'.
Examples
The SOC escalated the alert to the incident response team at 3 a.m.
She started as a Tier 1 SOC analyst and now leads threat hunting.
A notification from a security tool saying that something suspicious or important has happened and may need a person to look at it.
Where you use it
Analysts triage, investigate, close and escalate alerts, and too many low-quality alerts cause 'alert fatigue'. Also a verb: 'the system alerted us'. An alert is not yet an incident; the investigation decides that.
Examples
We got an alert for logins to the same account from two countries within ten minutes.
The team handles about 400 alerts a day, so tuning the rules is a priority.
Common phrases
triage an alert · high-severity alert · alert fatigue · close an alert · raise an alert
An alert or test result that wrongly reports a threat or vulnerability when nothing harmful is actually there.
Where you use it
Very common in SOC and scanning work: analysts mark alerts as false positives and tune rules to reduce them. The opposite problem, a real attack that goes unnoticed, is a false negative and is usually more dangerous.
Examples
It was a false positive: the backup job looked like data exfiltration.
This scanner reports a lot of false positives on our Linux servers.
Common phrases
mark as a false positive · reduce false positives · false positive rate · false negative
The defenders in a security exercise, or more generally the people who protect, monitor and respond, such as SOC analysts and incident responders.
Where you use it
Used both for exercise roles and as a career label: 'blue team skills', 'blue teamer'. After a red team exercise, the blue team reviews what it detected and what it missed and improves its detections.
Examples
The blue team spotted the red team's phishing email within twenty minutes.
Most of our blue team works in the SOC and on detection engineering.
Common phrases
blue team exercise · blue team skills · blue teamer · purple team
Any device that connects to a network and is used by people or runs workloads, such as a laptop, desktop computer, phone or server.
Where you use it
Common in product names and job titles: endpoint protection, endpoint security, endpoint detection and response (EDR). In API work 'endpoint' has a different meaning: a URL that accepts requests.
Examples
Every endpoint must have the EDR agent installed before it joins the network.
Most of our incidents start on user endpoints, not on servers.
Endpoint detection and response: security software on laptops and servers that records activity, detects suspicious behaviour and lets analysts investigate and respond remotely.
Where you use it
Said letter by letter. EDR goes beyond classic antivirus: from one console, analysts can see process trees, isolate a host from the network or stop a process. XDR extends the same idea to email, cloud and identity data.
Examples
We used the EDR console to isolate the laptop within two minutes.
The EDR flagged an unsigned script that tried to disable the security tools.
Collected and analysed information about attackers, their methods and their tools that helps an organisation prepare for and detect attacks.
Where you use it
Often shortened to 'threat intel' or CTI (cyber threat intelligence). Teams consume threat intel feeds, share information through sector groups such as ISACs and use it to write detections. It ranges from technical IOCs to strategic reports for management.
Examples
Threat intelligence shows that this group targets logistics companies in Europe.
We added the new IP addresses from the threat intelligence feed to the blocklist.
Actively searching through systems and logs for signs of attackers who have not yet been detected by automated alerts, often starting from a hypothesis.
Where you use it
Done by experienced analysts, often at Tier 3. A hunt starts from a hypothesis ('an attacker may be using remote management tools'), uses SIEM and EDR data and ideally ends with new detection rules. People say they 'run a hunt'.
Examples
Our weekly threat hunting session found an old admin tool running on a file server.
After the advisory, we started threat hunting for the new IOCs across all endpoints.
Common phrases
threat hunting team · run a hunt · hypothesis-driven hunting · hunting query
An event that threatens or harms the confidentiality, integrity or availability of systems or data, such as a malware infection or an unauthorised login.
Where you use it
Short for 'security incident'. Incidents are reported, triaged, investigated, contained and closed. Teams rate them by severity (P1, P2 and so on) and write an incident report afterwards. Not every alert is an incident; an analyst decides that.
Examples
Please report any suspected incident to the security team immediately.
The incident was closed after we confirmed that no data had left the network.
Usage note
In English an 'event' is anything observable in a log, while an 'incident' is an event that actually threatens or harms security.
Common phrases
security incident · report an incident · incident response · incident report · major incident
A security incident in which personal or confidential data is accessed, stolen, disclosed or lost without authorisation.
Where you use it
A word with legal weight: under laws such as the GDPR and Turkey's KVKK, organisations must notify the regulator, and sometimes the people affected, within set time limits. People say a company 'suffered a data breach' or that data was 'exposed in a breach'.
Examples
The data breach exposed the names and email addresses of 40,000 customers.
Legal wants to know whether this counts as a reportable data breach.
Usage note
'Breach' is also a verb: 'The attackers breached the network.'
Common phrases
suffer a data breach · report a data breach · breach notification · personal data breach · large-scale breach
A copy of data or systems kept separately so that it can be restored if the original is lost, damaged or encrypted by an attacker.
Where you use it
Teams take, test and restore backups. In ransomware planning, people stress offline or immutable backups that attackers cannot change or delete. A restore test proves that a backup can actually be used.
Examples
We restored the database from last night's backup.
Back up the configuration before you upgrade the firewall.
Usage note
Spelling trap: the noun is one word (a backup), but the verb is two words (to back up).
Common phrases
take a backup · restore from backup · offline backup · immutable backup · backup policy
The stage of incident response in which the team stops an attack from spreading or causing more damage, for example by isolating infected machines.
Where you use it
Part of the usual incident response sequence: detection, containment, eradication, recovery. Typical containment actions are isolating hosts, disabling accounts, resetting credentials and blocking IP addresses. The verb is 'contain': 'we contained the incident'.
Examples
Containment came first: we isolated the three infected laptops before starting the investigation.
Short-term containment bought us time to rebuild the server safely.
A piece of technical evidence that suggests a system may have been attacked, such as a malicious IP address, file hash or domain name.
Where you use it
Almost always called an IOC or IoC, said letter by letter. Analysts collect, share and search for IOCs in logs and EDR data. Because attackers can change them easily, IOCs are usually combined with detections based on behaviour.
Examples
We searched all mailboxes for the indicators of compromise listed in the advisory.
No indicator of compromise was found on the remaining servers.
Common phrases
IOC list · share IOCs · search for IOCs · indicators of attack
The collection and analysis of digital evidence, such as disk images, memory and logs, to find out what happened during an incident in a way that can stand up in court.
Where you use it
Often combined with incident response as DFIR. Key ideas are chain of custody, forensic images and preserving evidence before systems are wiped. Investigators take a forensic image and verify it with a hash.
Examples
Don't reboot the server yet; the digital forensics team needs a memory capture first.
The digital forensics report confirmed that the attacker was inside for nine days.
A written, step-by-step guide that tells a security team how to handle a specific type of alert or incident, such as phishing or ransomware.
Where you use it
SOC and incident response teams write, follow and update playbooks. When the steps are automated in a SOAR tool, people may also call them runbooks or workflows. Playbooks are tested in tabletop exercises.
Examples
Follow the phishing playbook: check the headers, block the sender, then search the other mailboxes.
After the incident, we updated the ransomware playbook with the new contact list.
To pass an alert, incident or problem to a more senior person or team because it is serious or beyond your own authority or skills.
Where you use it
A daily word in SOC work: Tier 1 escalates to Tier 2, and major incidents are escalated to management or the CISO. The noun is escalation, as in 'escalation path' or 'escalation matrix'. Do not confuse it with privilege escalation, which is an attack technique.
Examples
If the host is a domain controller, escalate the alert to Tier 2 immediately.
The incident was escalated to the CISO because customer data was involved.
Common phrases
escalate an alert · escalate to management · escalation path · escalation matrix
The plans and processes for restoring IT systems and data after a serious disruption, such as a ransomware attack, a fire or a data-centre failure.
Where you use it
Often shortened to DR, as in 'DR site' or 'DR test'. Two key measures are RTO (how quickly a system must be back) and RPO (how much data loss is acceptable). It is part of the wider business continuity plan.
Examples
We failed over to the disaster recovery site in under two hours.
The annual disaster recovery test showed that the restore took longer than our RTO.
Common phrases
disaster recovery plan · DR site · DR test · RTO and RPO · business continuity
The chance that a threat will use a weakness and cause harm, combined with how serious that harm would be for the organisation.
Where you use it
Central to management, audit and compliance language. Risks are identified, assessed, rated (low, medium, high), treated and accepted. The four classic responses are to mitigate, transfer (for example with insurance), avoid or accept a risk.
Examples
Running an unsupported operating system is a high risk we can no longer accept.
The risk owner signed off on the exception for six months.
The state of following the laws, regulations, standards and internal policies that apply to an organisation, and being able to prove it.
Where you use it
Used for both the goal and the team: 'the compliance team', 'a compliance requirement'. Organisations are 'compliant with' or 'in compliance with' standards such as ISO/IEC 27001 or PCI DSS. Security people often point out that compliance is not the same as security.
Examples
We need to show compliance with PCI DSS before the payment launch.
Is the new logging setup compliant with our retention policy?
Employees' knowledge of everyday security risks, such as phishing and weak passwords, and of what to do about them; also the training that builds this knowledge.
Where you use it
Mostly heard as 'security awareness training' or 'security awareness programme'. Many standards require it at least once a year. Teams measure it with phishing simulations, short quizzes and the number of suspicious emails staff report.
Examples
All new hires must complete security awareness training in their first week.
Better security awareness meant that more phishing emails were reported this quarter.
A formal document, approved by management, that sets the rules an organisation follows to protect its information, systems and people.
Where you use it
There is usually a top-level information security policy plus specific ones on acceptable use, passwords, access control or remote working. Policies are written, approved, reviewed yearly and enforced; breaking one is a 'policy violation'.
Examples
Under our security policy, personal USB drives are not allowed on company laptops.
The auditor asked when the security policy was last reviewed.
Common phrases
information security policy · acceptable use policy · policy violation · enforce a policy · review a policy
A formal, independent review that checks whether an organisation's security controls and processes meet a standard, a law or its own policies.
Where you use it
Also a verb: auditors audit a company. Audits can be internal or external and end with audit findings and requests for evidence. An 'audit log' or 'audit trail' is a record of who did what and when.
Examples
The ISO 27001 audit is next month, so please upload your evidence by Friday.
The external audit found no major issues with access control.
A structured process for identifying risks, estimating how likely and how serious they are, and deciding which ones need action first.
Where you use it
Required by most standards and regulations. Teams carry out or perform risk assessments for new projects, suppliers and systems, often with a likelihood × impact matrix, and record the results in a risk register.
Examples
We need a risk assessment before the new supplier gets access to customer data.
The risk assessment rated the legacy system as high risk.
Common phrases
carry out a risk assessment · third-party risk assessment · risk matrix · risk register
Any safeguard, whether technical, administrative or physical, that reduces a security risk, such as a firewall, a policy, a training course or a locked door.
Where you use it
Standards such as ISO/IEC 27001 (Annex A) and NIST SP 800-53 are essentially lists of controls. Controls are designed, implemented and tested, and described as preventive, detective or corrective. Auditors check whether a control is in place and operating effectively.
Examples
MFA is our main security control against stolen passwords.
The auditor asked for evidence that the security control had worked all year.
Usage note
Here 'control' is a noun meaning a safeguard, not the verb 'to check'. Turkish auditors also use 'kontrol' in this sense.
Common phrases
implement a control · preventive control · detective control · compensating control · control framework
General Data Protection Regulation: the European Union law, applied since May 2018, that sets rules for how organisations collect, use and protect personal data.
Where you use it
Said letter by letter. It can also apply to organisations outside the EU when they handle the data of people in the EU. Security teams meet it mostly through breach notification, which in many cases must reach the regulator within 72 hours of becoming aware.
Examples
Because EU customers were affected, we had to consider the GDPR notification deadline.
The data protection officer checks every new system against GDPR requirements.
Common phrases
GDPR compliance · breach notification · data protection officer · personal data · lawful basis
An authorised, simulated attack on a system, application or network, carried out by security specialists to find weaknesses before real attackers do.
Where you use it
Almost always called a pentest, and the people who do it are pentesters. Companies commission and scope a pentest, often yearly or after major changes, and receive a report of findings. The work needs written permission and an agreed scope.
Examples
The annual penetration test is scheduled for the second week of March.
The penetration test report listed two high-severity findings in the login flow.
Common phrases
run a penetration test · external penetration test · penetration test report · scope a pentest · web application pentest
A group of security specialists who act like real attackers, using any approved method, to test how well an organisation can detect and stop them.
Where you use it
A red team exercise is longer and more goal-based than a normal pentest and often tests people and processes, not just technology. The defenders are the blue team; when both sides work together openly, it is called purple teaming.
Examples
The red team reached the finance share without triggering a single alert.
We are planning a three-week red team exercise for the autumn.
Common phrases
red team exercise · red team engagement · red teaming · purple teaming
The agreed conditions of a security test: what may be tested, when, with which methods and whom to contact if something goes wrong.
Where you use it
Signed before any penetration test or red team exercise starts, usually together with the scope document. Testers refer to it constantly: 'Is that within the rules of engagement?' Often shortened to RoE.
Examples
Denial-of-service testing is not allowed under the rules of engagement.
The rules of engagement say testing can only happen between 10 p.m. and 6 a.m.
Common phrases
agree the rules of engagement · within the rules of engagement · scope document · out of scope
A security professional who uses attackers' skills and methods, with the owner's written permission, to find and report weaknesses so that they can be fixed.
Where you use it
Also called a white-hat hacker; 'pentester' is the usual job title. Permission is what separates ethical hacking from crime. Certifications such as CEH and OSCP often appear in job ads.
Examples
An ethical hacker found the flaw through our bug bounty programme and reported it privately.
She works as an ethical hacker for a consultancy that tests banks.
A security problem or weakness that is identified and documented during an audit, assessment or penetration test, usually with a severity rating.
Where you use it
Normally used in the plural in reports: 'key findings', 'high-severity findings'. Each finding has a description, evidence, a risk rating and a remediation recommendation. Teams close or accept findings, and testers retest them.
Examples
The report has 14 findings: two high, five medium and seven low.
This finding is a false positive, because the service is not reachable from outside.
Common phrases
key findings · high-severity finding · close a finding · audit finding · retest a finding
The first stage of an attack or security test, in which information about the target is gathered, such as domain names, staff, technologies and exposed services.
Where you use it
Usually shortened to 'recon'. Passive reconnaissance uses public sources (OSINT) without touching the target, while active reconnaissance interacts with it. Pentest reports often begin with a recon section.
Examples
During reconnaissance, the testers found an old staging site on a forgotten subdomain.
Our threat model assumes that attackers start with reconnaissance on social media.
Common phrases
passive reconnaissance · active reconnaissance · OSINT · recon phase
A small demonstration, such as a piece of code or a screenshot, that shows a vulnerability is real and can actually be exploited.
Where you use it
Usually called a PoC, said letter by letter. Pentest reports and bug bounty submissions include a PoC as evidence. When a public PoC appears, the risk rises because attackers can reuse it. In general business English, a PoC is also a small trial of a product or idea.
Examples
The researcher's proof of concept showed that any user could read other users' files.
A public proof of concept was released yesterday, so we raised the patch priority.
Common phrases
public PoC · PoC code · working proof of concept · include a PoC
A programme in which an organisation invites outside researchers to find and report vulnerabilities in its systems and pays rewards for valid reports.
Where you use it
Run directly or through platforms such as HackerOne and Bugcrowd. Each programme has a scope, rules and a payout table. Researchers submit a report, and the company triages it and decides the bounty.
Examples
We launched a private bug bounty with 50 invited researchers.
The bug bounty paid 5,000 dollars for the account takeover report.
Common phrases
bug bounty programme · bug bounty hunter · bounty payout · in scope · submit a report
Ten questions from this glossary. Pick the right meaning for each term and see your score.
How to learn cybersecurity vocabulary
Read real texts from the field regularly: vendor security advisories, CVE entries, public incident reports and the documentation of the security tools you use every day.
Learn terms together with their partners: not just 'patch' but 'apply a patch' and 'roll out a patch'; not just 'incident' but 'contain an incident' and 'escalate an incident'.
Pay attention to pairs that are easy to confuse: threat, vulnerability and risk; authentication and authorization; encryption and hashing; remediation and mitigation. Interviews and audits often test exactly these.
Say acronyms the way teams do: SIEM like 'sim', SOC like 'sock', WAF like 'waff', and CVE, EDR and MFA letter by letter.
Practise writing short incident or finding summaries in English: what happened, what the impact is and what has been done so far.
Frequently asked questions
How can I learn English vocabulary for cybersecurity?
Read real texts from the field and notice how the words are used: vendor security advisories, CVE entries, public incident reports, security standards and the documentation of your own tools. Learn each term with its usual partners (apply a patch, contain an incident, escalate an alert) and reuse new words in your own tickets, notes and reports.
Which cybersecurity terms should I learn first?
Start with the words you will hear every day: threat, vulnerability, risk, malware, phishing, patch, incident, alert, firewall, authentication and encryption. Then move on to SOC and incident response vocabulary, and after that to penetration testing and compliance terms. The terms in this glossary are ordered the same way, from most to least essential.
What is the difference between a threat, a vulnerability and a risk?
A threat is something that could cause harm, such as an attacker or a piece of malware. A vulnerability is a weakness that a threat could use, such as an unpatched server. Risk combines the two: how likely it is that the threat will use the vulnerability, and how serious the impact would be.
Do security teams in Turkey use English or Turkish terms?
Both. Many tool and role names stay in English in daily speech: SOC, SIEM, EDR, pentest, patch, log and exploit. Other words have well-established Turkish equivalents, such as zafiyet, sızma testi, oltalama, fidye yazılımı and kimlik doğrulama. Official documents, regulations and contracts usually prefer the Turkish terms, so it helps to know both.
How do security professionals pronounce common acronyms?
Some acronyms are said as words: SIEM like 'sim', SOC like 'sock', WAF like 'waff' and DDoS as 'dee-doss'. Most others are spelled out letter by letter, for example VPN, MFA, EDR, CVE, TLS and IDS. When in doubt, listen to how conference talks and vendor webinars say them.
