Security glossary

Last updated 21 September 2026

Plain definitions for the vocabulary that product marketing tends to stretch. Where a term is commonly misused, we say what it actually means.

A – F

Adware / PUP — software that injects advertising or changes browser settings. “Potentially unwanted program” is the industry term for things that are not quite malware but that you did not really agree to.
Behaviour monitoring — judging a program by what it does at runtime rather than by what the file looks like. The layer most likely to catch something new.
Botnet — a collection of compromised machines controlled remotely, typically rented out for attacks or spam.
Brute force — guessing credentials by trying many of them. Rate limits and multi-factor authentication are the defences.
Command and control (C2) — the infrastructure malware contacts for instructions. Blocking known C2 domains is a common detection method.
Credential stuffing — taking username and password pairs from one breach and trying them elsewhere. Works only because people reuse passwords.
Cryptojacking — using someone else’s device to mine cryptocurrency. Symptoms are heat, fan noise and battery drain.
Encryption in transit — protecting data as it moves across a network, which is what HTTPS and a VPN do. It is not protection of data at rest on your disk.
False positive — clean software wrongly flagged as malicious. A real cost of heuristic detection, and one independent labs measure alongside detection.
Fingerprinting — identifying a browser from its characteristics rather than by storing a cookie. This site does neither.

Heuristic analysis — looking for patterns associated with malicious software rather than for an exact known fingerprint.
Infostealer — malware that copies saved passwords, session cookies and wallet files and sends them to an attacker. Often leaves no visible symptom.
Multi-factor authentication (MFA / 2FA) — requiring a second proof of identity beyond the password. Hardware keys and authenticator apps resist phishing better than SMS codes.
Phishing — impersonating a trusted party to obtain credentials, approval or money. See our guide.
Quarantine — an isolated store where a scanner puts a suspect file so it cannot execute but can still be restored if the detection was wrong.
Ransomware — malware that encrypts files and demands payment. Defeated in practice by backups, not by recovery tools.
Real-time protection — continuous inspection of files as they are written, opened or executed, as opposed to a scan you start manually.
Rootkit — malware that hides below the operating system so ordinary scans cannot see it. Rare on consumer devices, hard to remove.

Sandbox — an isolated environment where code runs without access to the rest of the system. Apple’s app sandbox on iOS is why no vendor offers file-scanning antivirus there.
Signature — a fingerprint of a known malicious file. Precise, fast, and blind to anything not yet catalogued.
Social engineering — manipulating a person rather than exploiting software. The most common route into an account.
Supply-chain attack — compromising a supplier, an update channel or a library so that the malicious code arrives through a route the victim already trusts.
Trojan — malware disguised as something you wanted to install.
VPN — an encrypted tunnel between your device and a provider’s server. It hides traffic from the local network and shifts trust to the provider. It does not detect or remove malware and is not a substitute for a scanner.
Zero-day — properly, a vulnerability the vendor has had zero days to fix. In marketing copy it is frequently used to mean any new malware, which is not the same thing.
Zero trust — an architectural principle for organisations: verify every request rather than trusting anything by virtue of being inside the network. Largely irrelevant to a home laptop, despite appearing in consumer advertising.

Missing a term you ran into? Tell us and we will add it.