Security and IT glossary

Around sixty of the terms that come up most often when businesses talk to us about security, compliance, and IT. Use the letters to jump down, or search the page.

• A
• B
• C
• D
• E
• H
• I
• M
• N
• P
• R
• S
• T
• U
• V
• Z

Acceptable use policyAUP

A written policy that sets out what staff may and may not do with the organisation's IT: its devices, its network, its email, its data, and increasingly its AI tools. It matters because it turns expectations into something you can point to, train against, and act on if someone ignores it. Auditors and insurers routinely ask to see one, and it is usually the document that decides whether pasting client data into a public chatbot is a disciplinary matter or an unwritten rule. See our policy frameworks service.

Anti-virus

Software that detects and removes malicious programs, such as viruses, worms, and trojans, usually by matching files against a list of known threats. Traditional anti-virus is reactive: it recognises malware it has seen before. Modern protection has largely moved on to behaviour based tools that also catch new and unknown threats, which is why most business security now uses endpoint detection and response rather than signature matching alone. See endpoint detection and response.

Backup as a serviceBaaS

A managed service where a provider takes, stores, and looks after your data backups for you, usually to the cloud, rather than you running backup hardware and software yourself. The value is not in taking copies but in testing that they restore, so recovery is a routine and not a panic. Good backup is the difference between a bad day and a closed business when ransomware or hardware failure hits. See our backup and disaster recovery service.

Backup verification

The routine of checking that a backup can actually be restored, rather than trusting the job that reported success. Verification ranges from an automated integrity check to a full test restore into an isolated environment, which is the only way to prove that the data and the recovery process both work. Unverified backups are a common reason a ransomware recovery takes weeks rather than days. See our backup and disaster recovery service.

Centre for the Protection of National InfrastructureCPNI

The UK government authority that advised organisations in critical national infrastructure on protective security, covering physical, personnel, and cyber measures together rather than separately. Its role has since passed to the National Protective Security Authority, so current guidance is published under that name, but CPNI is the name written into older contracts, standards, and security questionnaires. If a buyer cites it, they are asking about protective security as a whole and not only about IT. See our CAF alignment service.

Cloud access security brokerCASB

A security layer that sits between your users and the cloud services they use, so you can see which services are in use, control what data moves in and out of them, and apply policy to what happens inside. It exists because staff sign up to tools with a work account faster than any provider can approve them, and the resulting list is usually longer than anyone expects. Microsoft's is Defender for Cloud Apps. See Microsoft Defender for Cloud Apps and our Microsoft 365 service.

Compensating control

A different control put in place when the one a standard, an auditor, or an insurer expects is not practical, chosen because it reduces the same risk to a comparable level. It only counts if it is written down, justified, and reviewed, so that the reasoning can be shown rather than asserted. It is how a machine that cannot be patched, or a system that cannot take multi-factor authentication, gets through an assessment without anyone pretending the risk is not there. See our audit and assurance service.

Conditional Access

A Microsoft Entra feature that decides whether to allow a sign in based on signals such as who the user is, the device they are on, where they are, and how risky the attempt looks, then applies a condition: require multi-factor authentication, limit the session, or block it. It is how a Microsoft 365 tenant moves from a password check to a policy decision. Well written policies stop most credential attacks without making everyday work harder. See our Microsoft 365 service.

Containment

The stage of incident response where you stop an incident spreading, for example by isolating an affected device, disabling an account, or blocking a route in and out of the network. It comes before removing the threat and recovering, and it is deliberately about limiting damage rather than tidying up. How quickly you contain is usually what decides whether one machine or the whole organisation is affected. See our incident response service.

Critical national infrastructureCNI

The systems and services a country depends on, such as energy, water, transport, health, communications, and defence, where a serious failure would cause significant harm. Organisations in these sectors, and the suppliers who serve them, face tighter security expectations and specific frameworks, including the NCSC Cyber Assessment Framework. Supplying a CNI operator often means inheriting its security requirements, however small your own business is. See our CAF alignment service.

Cyber Essentials

A UK government backed certification scheme that checks five basic technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. Getting these right closes off the most common, opportunistic attacks that hit UK businesses every day. The base level is a self assessment verified by a certification body, and many UK public sector contracts require it as a minimum. See our Cyber Essentials service.

Cyber Essentials Plus

The higher tier of Cyber Essentials, which adds an independent technical audit on top of the self assessment: a qualified assessor tests a sample of your devices and accounts to confirm the five controls are in place. It carries more weight with buyers and insurers because an assessor has checked it directly. See our Cyber Essentials service.

Data destruction

The secure disposal of data you no longer need, and of the drives and devices it lived on, so that it cannot be recovered afterwards. In practice that means a documented method (overwriting, cryptographic erasure, or physical destruction) and a record of what was destroyed and when. It matters because a retired laptop or an old backup set is still a data breach waiting to happen, and retention rules require you to delete as well as to keep. See our policy frameworks service.

Data loss preventionDLP

A set of tools and rules that stop sensitive information leaving your organisation by accident or design. DLP can detect content such as card numbers or personal data and then warn the user or block the action when someone tries to email, copy, or paste it somewhere it should not go. In Microsoft 365 it is part of Purview, and it is increasingly used to catch sensitive data being typed into public AI tools. See our email and endpoint security service.

Data subject

The living individual that personal data is about: a customer, an employee, a candidate, or a contact at a supplier. UK data protection law gives data subjects rights over their data, including seeing it, correcting it, and in some cases having it deleted, and those rights are what most data protection work is organised around. Knowing whose data you hold, and where it is, is what makes answering a request possible at all. See also data subject access request and our policy frameworks service.

Data subject access requestDSAR

A request from an individual for a copy of the personal data you hold about them, along with an explanation of how and why you use it. In the UK the response is normally due within one month, and the clock starts as soon as the request is recognisable as one, whether or not it arrives on a form or uses the right words. Most of the difficulty is practical: finding the data across mailboxes, files, and systems, and removing other people's information before you send it. See our policy frameworks service.

Def Stan 05-138

A UK Ministry of Defence standard that sets out the cyber security controls a supplier must meet, scaled to the risk level of the contract. It is how the MOD assures the security of its supply chain, and the required level is determined by a risk assessment of the work. The current issue maps to recognised standards including ISO 27001, the NCSC Cyber Assessment Framework, and Cyber Essentials. See our CAF alignment work.

DEFCON 658

A standard contract condition used by the UK Ministry of Defence that requires a supplier to protect MOD identifiable information against cyber risk, in line with the relevant Def Stan. In short, if a contract carries DEFCON 658, you must have the agreed cyber security controls in place and flow them down to your own subcontractors. It is a common trigger for defence suppliers needing to prove their security. See our CAF alignment work.

Disaster recovery as a serviceDRaaS

A managed service where a provider holds a standby copy of your systems and can bring them back up on its own infrastructure if yours becomes unavailable. It differs from backup as a service in what it returns: not only the data, but a running environment, to an agreed recovery point and recovery time. The value is in the tested failover, so the plan is proved before the day you need it. See our backup and disaster recovery service.

DKIMDomainKeys Identified Mail

An email authentication method that adds a digital signature to your outgoing messages, so a receiving mail server can confirm the message came from your domain and was not altered in transit. It works alongside SPF and DMARC to make your email harder to forge. Without it, criminals find it easier to impersonate your organisation in phishing emails. See also SPF and DMARC.

DMARCDomain-based Message Authentication, Reporting and Conformance

An email security policy that tells receiving servers what to do with messages claiming to be from your domain that fail the SPF and DKIM checks, for example quarantine or reject them. It also sends you reports on who is sending mail in your name. Set up properly, DMARC is one of the strongest defences against criminals spoofing your domain to defraud your clients. See also SPF and DKIM.

DORADigital Operational Resilience Act

European Union regulation that sets requirements for how financial firms manage their information and communications technology risk, including third party providers, incident reporting, and resilience testing. It applies to a wide range of financial entities operating in the EU. UK firms with EU operations or EU clients may fall within its scope, so it is worth checking whether it reaches your business. See our policy frameworks.

Dumpster diving

Searching discarded paper, packaging, and old equipment for information worth having, such as a printed report, an internal contact list, or a drive that was thrown out rather than wiped. It needs no technical skill and it walks straight past every control you have inside the building, which is what keeps it in use. Locked confidential waste, shredding, and a documented route for retiring hardware deal with most of it. See also data destruction and shoulder surfing.

Endpoint detection and responseEDR

Security software on your laptops, servers, and other devices (the endpoints) that watches for suspicious behaviour, alerts on it, and can respond automatically, for example by isolating an infected machine. Unlike traditional anti-virus, which matches known threats, EDR looks at how programs behave and so catches new attacks. It also records activity, which helps an analyst investigate what happened. See our email and endpoint security service.

ENISAEuropean Union Agency for Cybersecurity

The European Union's agency for cyber security, which publishes threat assessments and guidance and supports EU rules and certification schemes, including NIS2. Its output does not bind a UK organisation, but it is free, detailed, and widely cited, and it reaches UK firms indirectly through EU customers whose own obligations flow down a contract. Reading it is often the quickest way to understand what an EU client is about to ask you for. See our compliance readiness service.

External attack surface managementEASM

The practice of finding and monitoring everything about your organisation that is reachable from the internet: domains, mail records, exposed services, forgotten test sites, and anything else an attacker can see without logging in. It works from the outside in, which is why it regularly turns up assets nobody in the business remembers owning. The aim is to reduce what is exposed and then keep watching, because the surface changes every time something new is published. See our domain health check.

Host-based intrusion prevention systemHIPS

Security software that runs on an individual device and watches the activity on that host (the operating system, applications, and network traffic to and from it) to detect and block attacks in real time. Where a network firewall guards the perimeter, a HIPS protects the single machine it sits on, stopping malicious behaviour even once something is already inside. It is often built into modern endpoint protection. See our email and endpoint security service.

Incident response

The organised way you handle a security incident, such as a breach or ransomware attack, from the moment it is spotted through containing it, removing the threat, recovering, and learning from it. A good incident response plan means people know their roles and act fast, rather than improvising under pressure. The team that already knows your systems will always respond faster than one meeting them for the first time. See our incident response service.

Information sharing and analysis centreISAC

A member organisation where companies in the same sector share threat intelligence, so that an attack on one becomes an early warning for the rest. Membership is organised by industry, for example finance, aviation, or energy, and most ISACs are US based, so the name is usually written center. The UK equivalent run by the National Cyber Security Centre is the Cyber Security Information Sharing Partnership. The value is warning that is specific to your sector rather than generic. See our threat detection and response service.

IP addressInternet Protocol address

The numeric address that identifies a device on a network so traffic can find its way to it. Public addresses are visible on the internet and are what firewall rules, allow lists, and mail records are usually built around; private addresses are used inside your own network. It comes up in security work constantly, because restricting a service to known addresses, or noticing an unexpected one in a log, is often the simplest control available. See our IP and network tools.

ISACA

An international professional association for information systems audit, governance, and risk, best known for the CISA and CISM qualifications and the COBIT governance framework. Its certifications are a common requirement in audit and assurance roles, so the name appears in tender documents and job specifications more often than in technical work. It certifies people rather than organisations, so a company is never certified by ISACA, only staffed by people who are.

ISO 27001

The international standard for an information security management system, the set of policies, risk decisions, and routines that govern how an organisation protects its information. Rather than checking a fixed list of controls, it certifies that you run a working system for managing security over time. Certification is awarded after a two stage external audit and carries weight with enterprise and public sector buyers. Note that being aligned to ISO 27001 and being certified to it are different claims. See our ISO 27001 service.

IT service managementITSM

The disciplined way IT work is organised and run: how requests and incidents are logged, prioritised, escalated, and closed, how changes are approved, and how any of it is measured. ITIL is the best known framework for it. Done well it is invisible, and it is the difference between a service desk that can tell you what it did last month and one that just answers the phone. See our IT support and helpdesk service.

Malware

Any software written to do harm: viruses, worms, trojans, spyware, ransomware, and the tools an attacker uses once inside. Badware and malicious code mean the same thing. The label matters less than the delivery, because most malware arrives through email, a downloaded file, or a stolen login, which is where the defences belong. See our email and endpoint security service.

Managed detection and responseMDR

A service where a specialist team monitors your systems around the clock, investigates alerts, and responds to threats on your behalf. It combines the tooling of endpoint detection and response with human analysts, so you get expert eyes on your security without building a 24 hour team yourself. For most businesses this is the practical way to get round-the-clock threat coverage. See our threat detection and response service.

Managed security service providerMSSP

A company that manages an organisation's security operations as an outsourced service, which can include monitoring, threat detection, incident response, and the day-to-day running of security tools. It lets a business get specialist security cover without recruiting and retaining a full in house team. The value is in the depth of expertise and the round the clock coverage. See our threat detection and response service.

Microsoft Defender for Cloud Apps

Microsoft's cloud access security broker, which discovers the cloud apps your staff are using, rates the risk of each one, and applies policy to what happens inside them, such as blocking a download to an unmanaged device. It is the tool that answers the question of what has been signed up to with a work account, and the list is usually longer than anyone expects, AI tools included. It sits alongside Defender for Endpoint and Defender for Office 365 in the Microsoft security stack. See our Microsoft 365 service.

Microsoft Defender for Endpoint

Microsoft's endpoint detection and response platform, built into Windows and managed centrally, which protects devices against threats and provides investigation and response tools. It goes well beyond the basic Defender anti-virus, adding behaviour based detection, threat analytics, and the ability to isolate a compromised device. It is a common choice for organisations already invested in Microsoft 365. See our email and endpoint security service.

Ministry of DefenceMOD

The UK government department responsible for defence, and the customer at the top of a supply chain that reaches a long way down into small engineering and technology firms. Its contracts carry cyber security conditions, most visibly DEFCON 658 and the risk levels set out in Def Stan 05-138, and those conditions are flowed down to subcontractors. If you supply a supplier to the MOD, the requirements can still reach you. See our defence and aerospace page.

Multi-factor authenticationMFA

A login method that requires more than one piece of proof of who you are, typically your password plus a code from an app or a tap on your phone. Because an attacker would need both factors, MFA blocks the vast majority of attacks that rely on a stolen password alone. It is one of the single most effective security controls a business can turn on, and it is usually free to enable.

NCSC Cyber Assessment FrameworkCAF

A framework from the UK National Cyber Security Centre for assessing how well an organisation manages cyber security risk, especially for operators of essential services and the public sector. It is outcome based: rather than a tick list, it sets out objectives and principles you must show you are meeting. It is increasingly used across regulated and government linked sectors. See our CAF alignment service.

Patch management

The routine of keeping software, operating systems, and devices updated with the fixes that vendors release, many of which close security holes. Attackers move quickly to exploit known weaknesses, so timely patching is one of the most basic and important defences there is. Done well it is quiet and automatic, which is why it is one of the five Cyber Essentials controls. See also vulnerability scanning.

Penetration testing

A controlled exercise where a skilled tester, with permission, tries to break into your systems the way an attacker would, then reports what they found and how to fix it. Unlike an automated scan, a penetration test uses human skill to chain weaknesses together and reach things a scanner would miss. It gives you a tested picture of where you stand. See also vulnerability scanning.

Phishing

A fraud where criminals send messages, usually email, that pretend to be from someone you trust, to trick you into handing over passwords, money, or sensitive data, or into clicking a malicious link. It is the most common way attacks begin, because it targets people rather than technology. Training, email filtering, and multi-factor authentication together cut the risk sharply. See also spear phishing and our email and endpoint security service.

Professional services automationPSA

The business system an IT provider runs on: tickets, time, assets, contracts, and billing in one place, usually paired with a remote monitoring and management tool. It matters to a client because it holds the record of your estate and your history with the provider, which is what makes support consistent and a handover to someone else possible. It is a fair question to ask a prospective provider what they use, and whether you can see your own data in it. See our IT support and helpdesk service.

Public key infrastructurePKI

The certificates, keys, and issuing authorities that let systems prove who they are and encrypt what they send: the machinery behind the padlock on a website, a signed email, and a VPN that admits only known devices. It rests on trust in the authority that issued a certificate, and on every certificate having an expiry date, which is why an unnoticed expiry takes more services down than an attack does. Knowing what has been issued, and when each one runs out, is most of the work. See our domain health check.

Ransomware

Malicious software that encrypts your files, and increasingly steals a copy first, then demands a payment to restore access or to stop the data being published. It can halt a business completely and is one of the most damaging threats facing UK organisations. Tested backups, endpoint protection, and a rehearsed incident response plan are the core defences. See our backup and disaster recovery service.

Recovery point objectiveRPO

The most data you are willing to lose, expressed as time: an RPO of one hour means a failure should never cost you more than an hour of work. It sets how often backups or replication have to run, and it is a business decision rather than a technical one. Its twin is the recovery time objective (RTO), which is how quickly the service has to be back. Agreeing both honestly is what turns a backup into a plan. See our backup and disaster recovery service.

Safe Attachments and Safe Links

Two protections in Microsoft Defender for Office 365. Safe Attachments opens an incoming attachment in an isolated environment and watches what it does before the recipient can reach it. Safe Links rewrites links in mail and Office documents so the destination is checked at the moment someone clicks, not only when the message arrived. Together they catch the payloads and the delayed links that ordinary filtering misses. See our email and endpoint security service.

Security clearance

Government personnel vetting, applied to individuals rather than to organisations, so that a named person can be trusted with sensitive information or access. The UK levels run from a pre-employment baseline check of identity, right to work, and unspent criminal convictions, through Security Check (SC) to Developed Vetting (DV) for the most sensitive work. Clearance is sponsored by the organisation that needs the work done, it is tied to a role, and it takes time, so it belongs in project planning rather than at the end of it. It comes up throughout defence and aerospace supply chains. See our defence and aerospace page.

Security operations centreSOC

A team, and the tools they use, dedicated to monitoring an organisation's security, detecting threats, and responding to incidents, often around the clock. A SOC brings together alerts from across your systems so analysts can spot and act on the ones that matter. Most small and mid sized businesses access this through a service rather than building one in house. See our threat detection and response service.

Shoulder surfing

Reading someone's screen, keyboard, or notepad over their shoulder to pick up a password, a one-time code, or information they would never have handed over. It happens in coffee shops, on trains, in shared offices, and on video calls where a screen share shows more than was intended. Privacy screens, sensible seating, and the habit of locking a device before walking away deal with most of it. See also tailgating.

SIEMSecurity Information and Event Management

A system that collects logs and events from across your IT (servers, devices, applications, and network) into one place, then analyses them to spot signs of an attack. It is the engine a security team relies on to see what is happening and to investigate after the fact. On its own it is just tooling, so it is most useful paired with analysts who act on what it surfaces. See also security operations centre.

Single sign-onSSO

One sign-in that opens many applications, with a single identity provider vouching for the user instead of each application keeping its own password. It cuts password reuse, and it gives you one place to remove access when somebody leaves, which is usually the bigger win. It also concentrates risk in that one identity, so it belongs alongside multi-factor authentication and Conditional Access rather than instead of them. See also multi-factor authentication and our Microsoft 365 service.

SPFSender Policy Framework

An email authentication method that lists, in your domain's DNS records, which mail servers are allowed to send email on your behalf. A receiving server can then check whether a message claiming to be from you came from an approved source. It is a first line of defence against criminals forging your domain, and it works best alongside DKIM and DMARC. See also DKIM and DMARC.

Spear phishing

A targeted form of phishing aimed at a specific person or organisation, using details about them to make the message far more convincing than a generic scam. An attacker might pose as your finance director and reference a real project to trick a colleague into paying a fake invoice. Because it is tailored, it slips past people more easily, so awareness and strong checks on payments matter. See also phishing.

Tailgating

A physical security breach where someone without authorisation follows an authorised person through a secure door, for example by slipping in behind them before it closes. It exploits politeness rather than technology, which is what makes it effective. Defences are practical: access controls, awareness, and a culture where challenging an unknown face is normal and expected. It is a reminder that security is physical as well as digital.

Triage

The first pass over an alert or a reported problem, to work out what it actually is, how bad it could be, and who should deal with it next. Good triage is what stops a real incident queueing behind a printer fault, and what stops every false positive being treated as a crisis. It is a judgement step, which is why alert volume with nobody to triage it achieves very little. See our incident response service.

Unified threat managementUTM

A single appliance or platform that bundles several network security functions together, typically firewalling, intrusion prevention, web and content filtering, and gateway anti-malware. The appeal for a smaller network is one box and one console; the trade off is that one box is also a single point of failure and a single vendor's view of a threat. The category has largely been absorbed into what vendors now call next generation firewalls. See our connectivity service.

Vulnerability assessment

A structured review of where your systems are exposed, usually built on a vulnerability scan but going further: confirming what the scanner found, discarding the noise, judging what each issue means in your environment, and ranking the work. A scan produces a list, an assessment produces a plan. It is broader and cheaper than a penetration test, and it proves less, so the two are complementary rather than alternatives. See also vulnerability scanning and penetration testing.

Vulnerability scanning

An automated check of your systems against a database of known weaknesses, which produces a list of issues to fix, ranked by severity. Run regularly, it gives you an ongoing view of where you are exposed so you can patch the important things first. It is broad but shallow, so it complements, rather than replaces, a penetration test. See also penetration testing and patch management.

Zero trust

A security approach that assumes no user or device is trusted by default, even inside your own network, so every request to reach a resource has to be verified. The principle is never trust, always verify, which limits how far an attacker can move if they do get in. In practice it relies on strong identity checks, multi-factor authentication, and least privilege access. See also multi-factor authentication.