Glossary of Cybersecurity Terms
Alphabetical glossary divided into tables by initial letter, combining the original entries, proposed additions and terms from the Identity and Access Management article. Definitions are plain-English paraphrases or merged summaries, not verbatim quotations.
The Source column links to the supporting organisation or publication; the original provenance of pre-existing wording was not recorded. Definitions not attributed to an external definition source are labelled as the author’s editorial definitions or website working definitions. Links marked “Context only” provide background, not a source for the definition.
Domains are editorial classifications of each term’s main area of use, not claims about historical origin. Related terms refer to other entries in this glossary.
The Domain column provides a simple hierarchy: entries that define the glossary’s subject areas are grouped under Cybersecurity, the umbrella domain. Other entries use more specific Domain values, such as Identity and access management or Cryptography, to show their main subject area. Entries remain arranged alphabetically for easy lookup.
Source references reviewed: 11 November 2026.
- CSA — Cloud Security Alliance;
- IBM — International Business Machines;
- Mgmt — management.
- NATO — North Atlantic Treaty Organization.
- NHI — non-human identity (in NHI Management and NHI Mgmt Group);
- OWASP — Open Worldwide Application Security Project;
- UK — United Kingdom;
- UK DfE — Department for Education;
- UK DSIT — Department for Science, Innovation and Technology (in UK DSIT / Forward Digital).
- UK ICO — Information Commissioner’s Office;
- UK NCA — The UK’s National Crime Agency
- UK NCSC — The UK’s National Cyber Security Centre;
- US — United States of America. A slash separates jointly credited sources.
- US CISA — the USA’s Cybersecurity and Infrastructure Security Agency.
- US FBI – the USA’s Federal Bureau of Investigation
- US NCC — the USA’s National Cybersecurity Center.
- US NIST — the USA’s National Institute of Standards and Technology.
- WHO — World Health Organization.
|
Term |
Definition |
Domain |
Source |
|
Acceptance criteria |
Conditions that a service or other work product must satisfy for stakeholders to accept it. |
Security assurance |
|
|
Acceptance test(ing) |
A test (process) used to check whether a service or system meets its acceptance criteria and can be accepted. |
Security assurance |
|
|
Account provisioning |
Distribution of account updates to connected services. In the case study, the provider reports that user identities were not updated. |
Identity and access management |
|
|
Account recovery |
Regaining control of an account when the ordinary means of signing in is unavailable. |
Identity and access management |
|
|
Account takeover |
Someone other than the legitimate account holder gaining control of the account. |
Identity and access management |
Author’s editorial definition. Context only: US CISA |
|
Activity monitoring |
Reviewing or recording device activity to identify concerns requiring investigation or intervention; unlike filtering, monitoring does not itself block activity. |
Education and online safety |
|
|
Advanced persistent threat (APT) |
A highly capable threat actor, or a sustained intrusion campaign, involving targeted access and long-term persistence. |
Threat intelligence |
|
|
Agentic AI |
AI systems that can pursue tasks, use tools and take actions without continuous human intervention. |
AI security |
|
|
AI agent identity |
The identity an AI agent uses to authenticate to the tools and data it accesses, including when acting under delegated authority. |
Identity and access management |
|
|
AI security |
Protecting AI systems and their connected tools and data against manipulation, excessive permissions and unintended disclosure. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US NIST (adversarial machine learning; AI-system attack risks). |
|
AI-enabled threats |
Cyber threats in which AI is used to support or carry out harmful activity, including intrusion steps with limited human intervention. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (AI-enabled cyber intrusion; assessment, not a formal definition). |
|
Alert fatigue |
Exhaustion or desensitisation caused by excessive alerts, making important warnings harder to recognise and address. |
Security operations |
|
|
Application security |
Protecting applications and websites from weaknesses and unauthorised actions, including changes to their content. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: OWASP (web application security controls and secure development). |
|
Artificial intelligence (AI) |
Computer systems that perform tasks normally associated with human intelligence, such as recognising patterns, interpreting language or making predictions. |
AI security |
|
|
Asset management |
Identifying and maintaining records of the devices, software, data and other resources an organisation depends on. |
Asset security |
|
|
Asset security |
Protecting the devices, software, data and other resources an organisation depends on, including managing unsupported software. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (asset inventories, proportionate protection and unsupported systems). |
|
Attack vector |
The route or method an attacker uses to gain unauthorised access to a system or device. |
Threat intelligence |
|
|
Authentication |
Checking a claimed identity by verifying control of a registered means of signing in; successful authentication does not establish that every later action is appropriate. |
Identity and access management |
|
|
Authenticator |
A means used to sign in, such as a password, passkey or security key. |
Identity and access management |
|
|
Authorisation |
Deciding which resources or actions an authenticated identity is permitted to access or perform. |
Identity and access management |
|
|
Autonomous AI hacking |
Proposed website usage. Cyber intrusion activity in which an AI system selects and carries out multiple steps with limited human intervention; the degree of autonomy should always be stated. |
AI-enabled threats |
Author’s editorial definition |
|
Term |
Definition |
Domain |
Source |
|
Baseline |
In an IAM review, a recorded starting position for the access journeys being examined. |
Security assurance |
Author’s editorial definition Context only: UK NCSC |
|
Biometric recognition |
Recognition using characteristics such as fingerprints or facial patterns. |
Identity and access management |
|
|
Breach notification |
Informing a regulator or affected individuals about a breach when the applicable reporting conditions are met. |
Incident response |
|
|
Burnout |
An occupational phenomenon associated with unmanaged chronic workplace stress, characterised by exhaustion, distance or cynicism towards work, and reduced professional efficacy. |
Workforce wellbeing |
|
|
Business continuity |
The ability to keep critical activities operating during and after a disruption. |
Business resilience |
|
|
Business resilience |
The ability to maintain or restore critical activities when services or dependencies are disrupted. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US NIST (CSF 2.0, GV.OC-04–05: critical services, dependencies and resilience objectives; cyber scope). |
|
Term |
Definition |
Domain |
Source |
|
Chief information security officer (CISO) |
The senior role responsible for leading an organisation’s information security programme and communicating cyber risks to its leadership. |
Security governance |
|
|
Cloudflare Access |
The provider’s service for controlling access to applications, discussed in the June 2025 incident. |
Identity and access management |
|
|
Cloudflare WARP |
The provider’s connectivity software discussed in the incident. WARP is retained as a product name, not expanded as an acronym. |
Business resilience |
|
|
Common Vulnerability Scoring System (CVSS) |
A standard method for rating a vulnerability’s technical severity; it is not, by itself, an assessment of business risk. |
Vulnerability management |
|
|
Confidentiality, integrity and availability (CIA) |
The security objectives of protecting information from unauthorised disclosure, unauthorised alteration and loss of access. |
Information security principles |
|
|
Content filtering |
Technology that identifies and restricts access to illegal, inappropriate or potentially harmful online content. |
Education and online safety |
|
|
Credential |
The record binding an account to its authenticators. It is distinguished here from the authenticator used to sign in. |
Identity and access management |
|
|
Credential revocation |
Invalidating a credential. |
Identity and access management |
|
|
Credential rotation |
Replacing passwords, keys or other authentication secrets to limit how long a compromised credential remains useful. |
Identity and access management |
|
|
Credential synchronisation |
Copying credentials across devices, as discussed in the article’s passkey lifecycle explanation. |
Identity and access management |
|
|
Critical infrastructure |
Systems essential to a nation’s security and economy, including power grids, water supplies, healthcare, and financial networks. |
Critical infrastructure security |
|
|
Critical infrastructure security |
Protecting essential systems, such as power, water, healthcare and financial networks, against cyber compromise and disruption. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US CISA (critical infrastructure security, dependencies and essential services). |
|
Cross-domain attack |
An attack that spans security environments such as endpoints, identity systems, cloud services and applications. |
Threat detection and response |
|
|
Cryptographic inventory |
A record of where cryptography is used, what it protects and which algorithms, systems and dependencies are involved. |
Cryptography |
|
|
Cryptography |
Methods for protecting information using mathematical techniques, including encryption and approaches designed to resist quantum-computer attacks. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US NIST (cryptography, including post-quantum methods). |
|
Cyber Essentials |
A UK government-backed certification scheme focused on fundamental technical controls against common cyber threats. |
Security assurance |
|
|
Cyber literacy |
The practical understanding needed to discuss cyber risks, make informed decisions and use digital systems responsibly. |
Security awareness and culture |
|
|
Cyber policy and geopolitics |
The area concerned with state authority, strategic competition and the use of cyber activity alongside other instruments of power. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK Government (National Cyber Strategy: cyber power and international interests; combined label is editorial). |
|
Cyber risk management |
Understanding, assessing, prioritising and communicating cyber risks so that security decisions reflect organisational objectives and willingness to accept risk. |
Cybersecurity |
US NIST (plain-English summary). |
|
Cybersecurity culture |
The shared attitudes, expectations and everyday behaviours that shape how people protect information and respond to security risks. |
Security awareness and culture |
|
|
Cybersecurity divide |
Proposed website term. The gap between organisations’ ability to protect themselves and recover from incidents because of differences in funding, skills, access to services or other resources. |
Cyber risk management |
Author’s editorial definition. |
|
Cyber sovereignty |
The principle that a state should exercise authority over digital infrastructure, data and online activity within its jurisdiction. |
Cyber policy and geopolitics |
|
Term |
Definition |
Domain |
Source |
|
Data breach |
An incident where sensitive, protected, or confidential data is accessed, stolen, or used by an unauthorised individual. |
Data security |
|
|
Data controller |
The organisation or person that determines why and how personal data is processed. |
Privacy and data protection |
|
|
Data poisoning |
Deliberate contamination of data used to train or adapt an AI model, with the aim of influencing its behaviour or weakening its reliability. |
AI security |
|
|
Data processor |
An organisation or person that processes personal data on a controller’s behalf and instructions. |
Privacy and data protection |
|
|
Data protection impact assessment (DPIA) |
A structured assessment used to identify and reduce the risks that personal-data processing poses to individuals. |
Privacy and data protection |
|
|
Data security |
Protecting information against unauthorised access, use or disclosure and other compromises to its confidentiality, integrity or availability. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: OWASP (confidentiality, integrity and availability of information). |
|
Deepfake |
AI-generated or manipulated media that convincingly depicts a person saying or doing something they did not actually say or do. |
Digital fraud and deception |
|
|
Dependency |
Another service that the identity process needs in order to work. A dependency failure is loss of that required service. |
Security architecture |
|
|
Device and IoT security |
Protecting connected physical devices and managing the security risks associated with their software, connectivity and remote control. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (enterprise-connected device security; not a definition covering every IoT setting). |
|
Digital fraud and deception |
The use of digital systems or manipulated media to mislead people, impersonate trusted parties or induce harmful actions. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US FBI (synthetic media, impersonation and financial fraud examples). |
|
Digital fraud prevention |
Measures that help prevent deceptive digital requests from leading to harmful actions, including verification through a separate trusted channel. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US FBI (independent identity verification and fraud-prevention advice). |
|
Digital identity |
A representation of a person, service or device that enables systems to distinguish it and make access decisions. |
Identity and access management |
|
|
Distributed denial-of-service (DDoS) |
An attack that uses multiple sources to overwhelm a service or network, preventing legitimate users from accessing it. |
Network security |
|
Term |
Definition |
Domain |
Source |
|
Education and online safety |
Measures in educational settings that help protect children and young people from online harm, including filtering, monitoring and safeguarding. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK DfE (filtering, monitoring and online safeguarding in schools and colleges). |
|
Emergency access |
An approved exceptional access route used when ordinary access is unavailable. |
Identity and access management |
Author’s editorial definition. Context only: UK NCSC |
|
Emergency disconnect override |
An emergency way to disconnect the provider’s connectivity software; the article describes the WARP control reported unavailable during the incident. |
Business resilience |
|
|
Encryption |
The process of converting data into a code to prevent unauthorised access. |
Cryptography |
|
|
End-of-life software |
Software that has reached the end of its supported lifecycle and no longer receives normal vendor security updates. |
Asset security |
|
|
Enrolment |
Establishing an account and its means of signing in. |
Identity and access management |
|
|
Evidence pack |
A record of test date, service version, configuration, conditions, expected and observed results, timestamps, exceptions, ownership and supporting records. |
Security assurance |
Author’s editorial definition. Context only: UK ICO |
|
Excessive agency |
A condition in which an AI-enabled system has more capabilities, permissions or autonomy than can be safely controlled. |
AI security |
|
|
Exploit |
Code or a technique that takes advantage of a vulnerability to perform an unauthorised action. |
Software security |
|
|
Exploit Prediction Scoring System (EPSS) |
A model estimating the probability that a published vulnerability will be exploited in the wild within the next 30 days. |
Vulnerability management |
|
Term |
Definition |
Domain |
Source |
|
Failing closed |
Denying access when the service cannot obtain the identity or policy information needed to make the access decision. |
Identity and access management |
|
|
False positive |
A security alert that flags benign activity as suspicious or malicious. |
Security operations |
|
|
Federation |
Arrangements through which one service relies on identity information from another service. |
Security architecture |
|
|
Fieldwork |
The survey data-collection activity, distinguished from the later publication date. |
Research methods |
|
|
Firewall |
A network security system that monitors and controls incoming and outgoing traffic based on predefined security rules. |
Network security |
|
Term |
Definition |
Domain |
Source |
|
Hacktivism |
Hacking or disruptive online activity undertaken to advance a political, social or ideological cause. |
Threat intelligence |
|
|
Harvest now, decrypt later |
Collecting encrypted information today with the intention of decrypting it when more powerful technology becomes available. |
Cryptography |
|
|
Human resources data feed |
An automated supply of employment updates used as an input to the access lifecycle. |
Identity and access management |
Author’s editorial definition. Context only: UK NCSC |
|
Human-centred security |
An approach to security that takes account of people’s needs and experiences, including ways to challenge and resolve problems with identity services. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US NIST (people’s needs, abilities, limitations and cybersecurity experiences; redress is an editorial example). |
|
Hybrid warfare |
The combined use of military and non-military methods—including cyber operations, disinformation and economic pressure—to pursue strategic objectives. |
Cyber policy and geopolitics |
|
Term |
Definition |
Domain |
Source |
|
Identity and access management (IAM) |
The policies, processes and systems governing who may access what. |
Cybersecurity |
|
|
Identity proofing |
Establishing confidence in a claimed identity. |
Identity and access management |
|
|
Identity provider |
A service that authenticates people and supplies identity information to other services. |
Security architecture |
|
|
Incident response |
The organised handling of a security incident, including investigating what happened, limiting harm and communicating with affected parties when appropriate. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (incident analysis, mitigation and communications). |
|
Information security principles |
The fundamental objectives that guide the protection of information, including confidentiality, integrity and availability. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: OWASP (CIA triad and security fundamentals). |
|
IoT (internet of things) |
Physical devices (e.g., smart whiteboards, CCTV cameras) connected to the internet that can be controlled remotely. |
Device and IoT security |
|
Term |
Definition |
Domain |
Source |
|
Key-value storage |
Storage that retrieves a stored value using an identifying key. |
Security architecture |
|
|
Known Exploited Vulnerabilities (KEV) catalogue |
CISA’s catalogue of vulnerabilities for which there is reliable evidence of real-world exploitation. |
Vulnerability management |
|
Term |
Definition |
Domain |
Source |
|
Lateral movement |
The techniques attackers use to move from an initial foothold into other systems or accounts. |
Threat detection and response |
|
|
Least privilege |
Giving a person, device or service only the access needed to perform its authorised task. |
Identity and access management |
|
|
Logging |
Recording relevant actions so that access decisions and activity can be examined. |
Security assurance |
|
Term |
Definition |
Domain |
Source |
|
Malware and cyber extortion |
The area concerned with malicious software and demands backed by cyber harm, including ransomware that blocks access to devices or data. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK ICO (malware, ransomware and cyber extortion; combined label is editorial). |
|
Multi-factor authentication (MFA) |
Authentication requiring two or more different kinds of evidence, such as something a person knows and something they possess. |
Identity and access management |
|
Term |
Definition |
Domain |
Source |
|
Network security |
Controls that protect network communications and services against unauthorised traffic, access and disruption. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (network access, architecture and protection). |
|
Non-human identity (NHI) |
A digital identity used by software, services, devices or AI agents rather than a person. |
Identity and access management |
|
Term |
Definition |
Domain |
Source |
|
Online safeguarding |
Measures that help protect children and young people from harm when using digital services and devices. |
Education and online safety |
|
|
Out-of-band verification |
Confirming a request through a separate, previously trusted channel rather than relying on the channel that delivered it. |
Digital fraud prevention |
|
|
Overprivileged identity |
A person or software identity with more access permissions than its legitimate tasks require. |
Identity and access management |
|
Term |
Definition |
Domain |
Source |
|
Passkey |
A device-managed digital-key authenticator used instead of a password. |
Identity and access management |
|
|
Patch management |
The process of applying updates (patches) to software to fix vulnerabilities. |
Vulnerability management |
|
|
Personal data breach |
A security incident involving accidental or unlawful loss, destruction, alteration, disclosure of, or access to personal data. |
Privacy and data protection |
|
|
Phishing |
A deceptive message or interaction that impersonates a trusted source to obtain information or induce a harmful action. |
Social engineering defence |
|
|
Phishing-resistant authentication |
Authentication designed to resist deceptive sign-in attempts; it is not presented as protection against every account threat. |
Identity and access management |
|
|
Policy engine |
The component that evaluates access requests against rules and contextual signals to decide whether access should be allowed. |
Security architecture |
|
|
Post-quantum cryptography (PQC) |
Cryptographic methods designed to resist attacks by both classical computers and sufficiently capable quantum computers. |
Cryptography |
|
|
Privacy and data protection |
The area concerned with responsible processing of personal data, the risks to individuals and the duties of those deciding or carrying out that processing. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK ICO(personal data, processing responsibilities and individual rights). |
|
Privileged access |
Authority to perform consequential actions, such as changing security settings or administering accounts. |
Identity and access management |
|
|
Privileged access management |
Controls for elevated administration that can use approved temporary access and permissions limited to the task, with risk-sensitive approval arrangements. |
Identity and access management |
|
|
Privileged account |
An account with authority to administer systems or other users. |
Identity and access management |
|
|
Prompt injection |
An attempt to manipulate an AI system through instructions placed in user input or material the system retrieves, causing unintended behaviour. |
AI security |
|
|
Protected cyber risk escalation |
Proposed website term. A documented route for raising material cyber concerns to an appropriate decision-maker, with safeguards against suppression or retaliation. This is a website working definition, not a statement of established legal protection. |
Security governance |
Author’s editorial definition |
|
Term |
Definition |
Domain |
Source |
|
Quantum computing |
Computing that uses quantum bits (qubits) and quantum-mechanical principles to solve certain problems differently from classical computers. Sufficiently capable quantum computers could threaten widely used public-key cryptography; they are not faster for every type of calculation. |
Quantum security |
|
|
Quantum security |
The area concerned with the security implications of quantum computing, including risks to existing cryptography and methods intended to resist quantum attacks. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US NIST (post-quantum protection of information; glossary scope is cryptographic). |
|
Term |
Definition |
Domain |
Source |
|
Random-probability sampling |
Sampling through known selection probabilities, rather than treating a respondent group as automatically representative. |
Research methods |
|
|
Ransomware |
Malicious software that prevents access to devices or data, commonly through encryption, followed by a demand for payment to restore access. |
Malware and cyber extortion |
|
|
Ransomware-as-a-service (RaaS) |
A criminal business model in which ransomware operators provide tools and services that other criminals use to conduct attacks. |
Malware and cyber extortion |
|
|
Recovery point objective (RPO) |
The maximum acceptable data loss expressed as a period of time before an incident. |
Business resilience |
|
|
Recovery time objective (RTO) |
The target maximum time for restoring a specified system, service or business function after disruption. |
Business resilience |
|
|
Redress |
A route to challenge and resolve a problem with an identity service. |
Human-centred security |
|
|
Representative testing |
Testing under conditions reflecting the intended service environment, with differences and limitations recorded. |
Security assurance |
Author’s editorial definition. Context only: US NIST |
|
Research methods |
The approaches used to collect and interpret evidence, including survey fieldwork, probability sampling and weighting. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK Government (2025 survey technical report: fieldwork, probability sampling and weighting; a methods example). |
|
Retrieval-augmented generation (RAG) |
An AI application pattern that retrieves information from connected sources to help generate a response. |
AI security |
|
|
Risk appetite |
The level and type of risk an organisation is willing to accept while pursuing its objectives. |
Cyber risk management |
|
|
Risk-based assurance |
A level of confidence assessed against risk, rather than certainty about every action. |
Security assurance |
|
|
Risk-based prioritisation |
Allocating security effort according to likely harm and organisational context, rather than treating every weakness as equally urgent. |
Cyber risk management |
|
Term |
Definition |
Domain |
Source |
|
Secure defaults |
Protective settings enabled from the outset, rather than left for the customer to add. |
Security governance |
|
|
Security architecture |
The arrangement of security controls, identity services, policies and trust boundaries, including the dependencies that connect them. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (secure system design and connected components). |
|
Security assurance |
Evidence-based confidence that security arrangements meet stated requirements and address the risks of their intended use. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (assurance as confidence in appropriate and effective risk treatments). |
|
Security awareness and culture |
People’s understanding of cyber risks and the shared attitudes, expectations and everyday behaviours that influence security. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (shared understanding, expectations and security behaviours). |
|
Security awareness programme |
Planned education, communications and activities that help people recognise cyber threats and understand their security responsibilities. |
Security awareness and culture |
|
|
Security governance |
The direction and oversight of security through accountable leadership, policies, risk decisions and routes for escalating concerns. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US NIST (CSF 2.0 Govern function; strategy, policy and oversight). |
|
Security operations |
The day-to-day work of reviewing security activity and alerts to distinguish possible threats from benign events and identify concerns for investigation. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (active analysis of security logs and alerts). |
|
Sensitive information disclosure |
Exposure of confidential information through an AI system’s responses or connected application. |
Data security |
|
|
Service account |
An account used by an application or automated process to authenticate and access resources. |
Identity and access management |
|
|
Session |
A continuing signed-in interaction, relevant when checking whether access has actually stopped. |
Identity and access management |
|
|
Single sign-on (SSO) |
Using one organisational sign-in across connected services. |
Identity and access management |
|
|
Social engineering |
Manipulating people into disclosing information, granting access or taking actions that undermine security. |
Social engineering defence |
|
|
Social engineering defence |
Measures that help people recognise, verify and resist attempts to manipulate them into revealing information, granting access or taking harmful actions. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US FBI (recognising deception and independently verifying requests). |
|
Software bill of materials (SBOM) |
A structured inventory of the components and dependencies contained in a software product. |
Software supply-chain security |
|
|
Software composition analysis (SCA) |
Examination of software’s third-party components to identify issues such as known vulnerabilities and licensing risks. |
Software supply-chain security |
|
|
Software dependency |
An external component, library or package that another piece of software relies on to function. |
Software supply-chain security |
|
|
Software security |
Protecting software against weaknesses and exploitation that could allow unauthorised actions or compromise. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK Government (secure development and maintenance; reducing software weaknesses). |
|
Software supply-chain security |
Protecting software against risks introduced through suppliers, components, dependencies and delivery processes. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK Government (software supply-chain attacks, vendors and software resilience). |
|
Supplier security assurance |
Evidence-based assessment of whether a supplier’s security arrangements adequately address the risks of the relationship. |
Third-party risk management |
|
|
Supply chain attack |
An attack that compromises a supplier, component or delivery process to reach organisations that depend on it. |
Software supply-chain security |
|
|
Survey weighting |
Adjustment of survey results to represent the relevant populations; it does not turn self-report into an independent forensic count. |
Research methods |
|
Term |
Definition |
Domain |
Source |
|
Third-party risk management |
Assessing and addressing security risks that arise from reliance on suppliers and other external parties. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (supplier risk and assurance; supplier-focused scope). |
|
Threat detection and response |
Identifying possible attacks and acting on evidence of compromise, including activity that moves across systems or security environments. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (detecting attacks and responding to signs of compromise). |
|
Threat intelligence |
Information about threat actors, their objectives and methods that helps people understand and assess cyber threats. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US NIST (SP 800-150: analysed and contextualised threat information; glossary wording is broader). |
|
Transitive dependency |
A component brought into an application because one of its direct dependencies relies on it. |
Software supply-chain security |
|
|
Trust boundary |
A point where access moves between environments governed by different security assumptions or controls. |
Security architecture |
|
|
Two-step verification |
A second check when signing in, retained as a fallback where passkeys are not available in the cited NCSC advice. |
Identity and access management |
|
|
Typosquatting |
Publishing a malicious package under a name resembling a legitimate package, hoping users or automated processes select it by mistake. |
Software supply-chain security |
|
Term |
Definition |
Domain |
Source |
|
United Kingdom General Data Protection Regulation (UK GDPR) |
The UK data-protection regulation referred to in the article for risk-appropriate security of in-scope personal-data processing under Article 32. |
Privacy and data protection |
|
Term |
Definition |
Domain |
Source |
|
Vishing |
Social engineering conducted through voice calls or voice messages to obtain information, money or access. |
Social engineering defence |
|
|
Voice cloning |
Using AI to generate speech that resembles a particular person’s voice. |
Digital fraud and deception |
|
|
Vulnerability |
A weakness in software, hardware or configuration that could be exploited to compromise security. |
Vulnerability management |
|
|
Vulnerability management |
Identifying, assessing and prioritising security weaknesses and addressing them through actions such as patching. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: UK NCSC (identifying, triaging, prioritising and addressing vulnerabilities). |
|
Term |
Definition |
Domain |
Source |
|
Website defacement |
Unauthorised alteration of a website’s content, often to display an attacker’s message or damage the owner’s reputation. |
Application security |
|
|
Workers KV |
Cloudflare’s key-value storage service discussed as a dependency in its June 2025 incident account. |
Security architecture |
|
|
Workforce wellbeing |
The area concerned with people’s wellbeing at work, including the effects of unmanaged chronic stress and excessive security alerts. |
Cybersecurity |
Author’s editorial definition. Supporting guidance: US NIST (cybersecurity-workforce burnout and alert overload; not a general wellbeing definition). |
|
Term |
Definition |
Domain |
Source |
|
Zero-day exploit |
A cyberattack that targets a previously unknown vulnerability in software, giving defenders zero days to patch it. |
Software security |
|
|
Zero trust (zero trust architecture) |
A security approach that grants no inherent trust because of network location or ownership, and evaluates access against explicit policies. |
Security architecture |