Cybersecurity glossary

Short, plain-English definitions of terms used across this site, with links to the guides that explain them in more depth.

Last reviewed 20 October 2026 · 86 terms

A

Account takeover

When someone else gains control of a person's online account, usually with a stolen or reused password or a one-time code obtained by deception.

Activation Lock

An Apple feature linked to Find My that requires the owner's Apple Account password before a lost, stolen or erased device can be set up and used again.

Admin consent workflow

A Microsoft Entra ID feature that lets users request access to an app they aren't allowed to approve themselves, so an administrator can review it.

AI agent

An AI system that can carry out multi-step tasks on a person's or organisation's behalf, such as reading files, sending messages or calling other services, using the access it has been given.

API key

A long string of characters that a program uses to identify itself to an online service and access it. Anyone who has a copy of a key can usually use whatever access it grants.

Authenticator app

A phone app that shows sign-in codes or asks the user to approve sign-ins, used as a second step when signing in.

AWS CloudTrail

An Amazon Web Services feature that records actions taken in an AWS account, such as who made a change, when and from where, so activity can be reviewed later.

B

Backup

A separate copy of data that can be restored if the original is lost, damaged or encrypted by ransomware.

Break-glass account (also: emergency access account)

A cloud-only administrator account kept for emergencies, used to regain access to a Microsoft 365 tenant if normal admin access fails.

Browser extension

A small add-on program that adds features to a web browser. Depending on the permissions it is given, an extension may be able to read or change the content of web pages a person visits.

Brute-force attack

An attempt to guess a password, PIN or key by trying a very large number of possible combinations, usually with automated tools.

Business email compromise (also: BEC)

A scam where criminals pose as a business you already deal with, often using a hacked or look-alike email address, to redirect a payment to their own account.

C

Conditional Access

A Microsoft Entra ID feature that decides whether to allow a sign-in, and what to require, based on conditions such as the user, app, location and device.

Consent phishing

An attack that tricks someone into granting a malicious app access to their mail, files or profile, rather than stealing their password.

Content Credentials

Information attached to a digital image, video or audio file that records details about where it came from and how it was made or edited, including whether AI tools were used. It is based on an open technical standard published by the Coalition for Content Provenance and Authenticity (C2PA).

Small files that websites store in a web browser to remember information such as sign-in status, preferences or items in a shopping cart. Some cookies are also used to track browsing across different websites.

Copilot agent

A Microsoft 365 Copilot feature that is set up to carry out a particular task or answer questions using chosen data sources and actions. An agent can only work with the data and permissions it has been given.

Credential stuffing

Automated attempts to sign in to many websites using email and password pairs leaked from other sites. It relies on the same password being reused on more than one site.

Credit ban

A request made to Australian credit reporting bodies asking them not to share a person's credit report for a set period, which is available when a person believes they are, or are likely to be, a victim of fraud such as identity theft.

Credit report

A record held by credit reporting bodies that lists a person's credit history, such as credit applications, credit accounts and repayment history. In Australia, people can request free copies of their own credit report.

D

Dark web monitoring

A service that searches websites, forums and data dumps not indexed by ordinary search engines for personal details, such as email addresses or passwords, that may have been exposed in data breaches.

Data loss prevention (also: DLP)

Rules that detect sensitive information, such as card numbers or health details, and restrict how it can be shared or used.

DDoS (distributed denial of service)

An attempt to make a website, server or network unavailable by flooding it with traffic from many devices at once. A denial of service (DoS) attack that comes from a single source is the simpler form.

Deepfake

Video, audio or an image created or altered with AI to imitate a real person.

DKIM (also: DomainKeys Identified Mail)

An email standard that adds a digital signature to outgoing messages so receivers can check they came from the domain and weren't altered.

DMARC

An email standard that checks the visible From address lines up with SPF or DKIM, tells receivers what to do with failures, and sends reports.

E

End-to-end encryption

A way of protecting messages or files so that only the sender and the intended recipient can read them. The service that carries the data cannot read its contents.

eSIM

A digital SIM built into a phone, tablet or smartwatch that lets it connect to a mobile network without a physical SIM card. A mobile plan is loaded onto it electronically.

Essential Eight

Eight mitigation strategies published by the Australian Signals Directorate to help organisations protect their systems, with maturity levels from Zero to Three.

F

Factory reset

A process that erases data, accounts and settings on a device and returns it to the state it was in when it left the factory.

FIDO2

A set of open standards for signing in with passkeys and security keys instead of, or as well as, passwords.

FIPS 140

A United States government standard, published by the National Institute of Standards and Technology (NIST), that sets security requirements for cryptographic modules. Products may state that they have been validated against a version of it, such as FIPS 140-2 or FIPS 140-3.

Firmware

Software built into hardware such as routers and cameras. Manufacturers release firmware updates, some of which fix security weaknesses.

G

Guest network

A separate Wi-Fi network on a router for visitors and untrusted devices, kept apart from the main network.

H

Hallucination (AI)

When an AI tool produces information that sounds confident and plausible but is incorrect, made up or not supported by its sources.

I

Identity and access management (IAM)

The policies, processes and tools that control who or what can sign in to systems and what each identity is allowed to do. Cloud providers such as AWS use IAM as the name of their access control service.

Identity theft

Using someone else's personal information, such as their name, date of birth or identity documents, to commit fraud.

IMEI

International Mobile Equipment Identity: a unique number assigned to a mobile phone or other cellular device. Mobile networks can use it to identify a device, including one reported lost or stolen.

Inbox rule

An automatic rule that moves, deletes or forwards incoming email. Attackers create hidden rules in compromised mailboxes.

Infostealer

A type of malware designed to collect information from an infected device, such as saved passwords, browser cookies and session tokens, and send it to the attacker.

Insider threat

A risk to an organisation that comes from someone with authorised access, such as a staff member, contractor or supplier, whether the harm is deliberate or accidental.

K

Kill switch (VPN)

A VPN app feature that blocks internet traffic if the VPN connection drops, so traffic is not sent outside the encrypted connection.

L

Least privilege

Giving people and systems only the access they need to do their job, and no more.

Legacy authentication

Older sign-in protocols that can't use multifactor authentication. Microsoft's documentation links legacy authentication to credential stuffing and password spray attacks.

M

Malware

Software designed to harm a device or steal from its user. Ransomware is one type.

MFA fatigue

A tactic where someone who has an account's password sends repeated sign-in approval requests, hoping one gets approved to make them stop.

Microsoft 365 Copilot

An AI assistant in Microsoft 365 that works with an organisation's files, email and chats, using each user's existing permissions.

Microsoft Secure Score

A measurement in the Microsoft Defender portal of how many of Microsoft's recommended security actions an organisation has taken. Microsoft says it isn't a guarantee against a breach.

Money mule

A person who receives money and transfers it onward on behalf of others, sometimes without realising the money comes from crime. Criminals use money mules to move and hide the proceeds of scams and other offences.

Multi-factor authentication (also: MFA, two-factor authentication, 2FA)

Signing in with more than one kind of proof, such as a password plus an approval on your phone, a fingerprint or a security key.

N

No-logs policy

A statement by a VPN or other service provider that it does not keep records of users' online activity. It is a claim made by the provider, and some providers publish independent audits of it.

O

Oversharing

Content shared more widely than it needs to be, for example a site open to everyone in an organisation or a link anyone can use.

P

Passkey

A way to sign in without a password, using a cryptographic credential stored on a device or security key and unlocked with a fingerprint, face or PIN. Passkeys are designed to resist phishing.

Passphrase

A password made of several random words. The ACSC describes a passphrase as four or more random words.

Password manager

An app that creates, stores and fills in a different strong password for each account.

Password spraying

An attack that tries a small number of commonly used passwords against many different accounts, rather than many passwords against one account, to avoid triggering lockouts.

Patch

An update that fixes a security weakness or bug in software.

Payment redirection fraud (also: invoice fraud)

Tricking a business or person into paying money into a scammer's account, usually by sending changed bank details.

Phishing

Fake messages that impersonate a trusted organisation or person to get information, money or access. Smishing uses text messages and vishing uses phone calls.

Phishing-resistant MFA

Sign-in methods, such as passkeys and FIDO2 security keys, designed to work only with the genuine website, so a fake page can't capture them.

Pretexting

A social engineering technique in which someone invents a believable story or role, such as a supplier, IT support person or official, to persuade a person to share information or take an action.

Privileged Identity Management (PIM)

A Microsoft Entra ID feature that gives people administrator roles only when needed and for a limited time, with options for approval, justification and review.

Prompt injection

An attack that tries to slip instructions into what an AI model reads, to change what it does.

Q

QR code phishing (also: quishing)

Phishing that uses a QR code to send someone to a fake website.

R

Ransomware

Malware that locks or encrypts files and demands payment. Attackers may also threaten to leak stolen data.

Remote access scam

A scam where someone persuades you to let them control your computer or phone, often by claiming there's a technical or banking problem.

Romance baiting

A scam that combines a fake online relationship with a fake investment, where the scammer builds trust over time and then encourages the person to invest money, often in cryptocurrency, on a fraudulent platform.

Root user (AWS)

The identity created when an Amazon Web Services account is first opened. It has complete access to all services and resources in the account.

S

Safe account scam

An impersonation scam in which someone pretending to be from a bank, police or a government agency claims a person's money is at risk and asks them to move it to a supposedly safe account that the scammer controls.

Secret (credentials)

In computing, any sensitive value that grants access to a system, such as a password, API key, access token, certificate or encryption key.

Security defaults

A free, on-or-off set of baseline protections in Microsoft Entra ID, including MFA registration and blocking legacy authentication.

Security key

A small physical device that is plugged in or tapped to sign in. Many can store passkeys.

Sensitivity label

A Microsoft Purview label that marks how confidential a file, email or site is, and can apply protections such as encryption.

Shared responsibility model

The division of security tasks between a cloud provider and its customer. Which tasks fall to each side depends on the type of cloud service.

SIM swap and number porting fraud

When a criminal takes control of a person's mobile phone number, either by having the number moved to a new SIM with the same telco (SIM swap) or transferred to another telco (porting). Calls and text messages, including one-time codes, then go to the criminal.

Social engineering

Manipulating people, rather than technology, into giving away information, money or access.

SPF (also: Sender Policy Framework)

An email standard that lists which servers are allowed to send email for a domain.

Spoofing

Disguising an email, phone call or website so it appears to come from a trusted source.

Spyware

Software that secretly monitors activity on a device, such as messages, locations, keystrokes or browsing, and sends the information to someone else.

Stalkerware

Monitoring software installed on a person's device without their knowledge or consent that allows someone else to see information such as messages, location or activity.

T

Task scam

A job scam that offers payment for simple online tasks, such as rating products or liking videos, then asks the person to pay their own money to unlock earnings or continue working.

TLS (Transport Layer Security)

A security protocol that encrypts data travelling between two systems, such as a web browser and a website. It is what puts the 's' in 'https'.

Trojan

Malware disguised as legitimate or useful software so that people install or open it themselves.

V

Voice cloning

Using AI to imitate a real person's voice, sometimes from only a short recording.

VPN (virtual private network)

A service that creates an encrypted connection between a device and a server run by the VPN provider or an organisation, so traffic travels through that connection before reaching the internet or a private network.

Z

Zero-access encryption

A term some providers use to describe storing data encrypted with keys the provider does not hold, so the provider states it cannot read the stored data.