Security Awareness Glossary

Access control is the set of rules and technologies that decide who can use which systems, data or locations, and what they are allowed to do there.

Adaptive training is security awareness training that continuously adjusts content, difficulty and timing to each employee's behaviour, role and risk.

Adversary-in-the-middle (AiTM) phishing uses a reverse proxy between the victim and a real login page to steal session tokens, allowing attackers to bypass multi-factor authentication.

Adware is software that displays or redirects users to unwanted advertising, often tracking their activity and sometimes leading to further malware.

An AI risk management framework is a structured approach for identifying, assessing and controlling the risks of developing and using artificial intelligence.

An algorithm is a defined set of step-by-step instructions that a computer follows to solve a problem or turn input into output.

Angler phishing is a social media scam in which attackers pose as a company's customer support account to trick people into sharing credentials or data.

Anomaly detection is the identification of activity that deviates from normal patterns, used in security to spot potential attacks or compromised accounts.

Artificial intelligence (AI) refers to computer systems that perform tasks such as understanding language, recognising patterns and making decisions that normally require human intelligence.

An attack surface is the total set of technical, physical and human entry points an attacker could use to gain access to an organisation.

Authentication is the process of verifying the identity of a user, device or system before granting access, using factors such as passwords, devices or biometrics.

Baiting is a social engineering technique that lures victims with an attractive offer or object, such as a free download or USB stick, to make them install malware or reveal data.

A browser-in-the-middle (BitM) attack tricks victims into logging in through an attacker-controlled remote browser, giving the attacker a fully authenticated session despite MFA.

A brute-force attack is an automated attempt to gain access by systematically trying many password or key combinations until one succeeds.

Business email compromise (BEC) is email-based fraud in which attackers impersonate or take over trusted accounts to trick employees into transferring money or data.

CEO fraud is a scam in which attackers impersonate a senior executive to pressure employees into making urgent payments or sharing sensitive information.

ClickFix is a social engineering technique that uses fake errors or CAPTCHAs to trick users into pasting and running a malicious command on their own computer.

Clone phishing is a phishing attack that copies a legitimate email the victim already received and replaces its links or attachments with malicious ones.

Credential harvesting is the theft of usernames, passwords and other login data through deception, typically using fake login pages.

Cyber hygiene is the set of basic, routine security practices that individuals and organisations follow to keep systems and data safe.

The Cyber Resilience Act (CRA) is an EU regulation that sets cybersecurity requirements for products with digital elements throughout their lifecycle.

A data breach is an incident in which personal or confidential data is accessed, disclosed, altered or lost without authorisation.

A deepfake is audio, video or an image created or altered with AI so that a real person appears to say or do something they never said or did.

Device code phishing abuses the legitimate OAuth device login flow: attackers trick victims into entering an attacker-generated code on a real login page, granting the attacker access tokens and bypassing MFA.

Domain spoofing is the forging or imitation of a trusted domain in emails or websites to make fraudulent messages appear legitimate.

DORA (Digital Operational Resilience Act) is an EU regulation that sets ICT risk management, incident reporting, testing and training requirements for financial entities.

HTML smuggling is a technique that hides malicious files or phishing pages inside HTML attachments, which are assembled in the victim's browser to bypass email and network security.

A human firewall is a workforce trained to recognise, resist and report cyberattacks that target people, making employees an active layer of an organisation's security.

Human risk management (HRM) is a data-driven approach to identifying, measuring and reducing the cybersecurity risk created by human behaviour in an organisation.

NIS2 is the EU directive (EU) 2022/2555 that sets cybersecurity risk-management, training and incident-reporting obligations for essential and important entities across critical sectors.

OSINT (open-source intelligence) is information collected from publicly available sources, used by attackers to prepare targeted social engineering and by defenders to assess exposure.

Phishing is a social engineering attack in which criminals send deceptive messages that imitate a trusted sender to steal credentials, money or data, or to install malware.

A phishing simulation is a controlled, harmless attack sent by an organisation to its own employees to train them to recognise and report real phishing and social engineering.

Pretexting is a social engineering technique in which an attacker invents a believable scenario and false identity to persuade a victim to share information or take an action.

Prompt injection is an attack that hides malicious instructions in input or content processed by an AI model, causing it to ignore its intended instructions, leak data or take unwanted actions.

Security awareness training teaches employees to recognise and respond to cyber threats that target people, such as phishing, social engineering and deepfakes, with the goal of lasting behaviour change.

Security culture is the shared values, attitudes and everyday behaviours that determine how people in an organisation handle security.

Shadow IT is the use of software, cloud services, devices or AI tools for work without approval from the IT or security team.

Smishing (SMS phishing) is a phishing attack delivered via text message or messaging apps that tricks recipients into clicking links, sharing data or sending money.

Social engineering is the manipulation of people into revealing confidential information, granting access or taking harmful actions, by exploiting trust, fear, urgency or helpfulness rather than technical vulnerabilities.

Spam bombing floods a victim's inbox with thousands of emails, often as the first step of an attack in which criminals then pose as IT support to gain remote access.

Spear phishing is a targeted phishing attack aimed at a specific person or organisation, using researched personal and business details to make the message highly convincing.

Spoofing is disguising an email, call, message, website or voice so it appears to come from a trusted source.

Vishing (voice phishing) is a social engineering attack carried out by phone, in which attackers pose as a trusted person or organisation to extract information, credentials or payments.

Voice cloning is the use of AI to replicate a real person's voice, allowing attackers to generate convincing speech for fraud, vishing and impersonation.