Top 100 Vocabulary for Adults | Cybersecurity Professionals
Cybersecurity vocabulary is the language of protecting systems whose boundaries are constantly changing. Professionals must connect users, identities, devices, applications, networks, data and third parties while distinguishing threat from vulnerability, event from incident, prevention from detection, and security theatre from controls that actually reduce risk.
This profession-specific flagship belongs to the eduKate Adult Vocabulary for Professionals system. It complements Software & Technology Professionals, Telecommunications Professionals and Risk & Compliance.
The Four Banks
Threats & Weaknesses: threat, threat actor, attack, attack surface, vulnerability, exploit, exposure, misconfiguration, malware, ransomware, phishing, social engineering, credential theft, privilege escalation, lateral movement, persistence, exfiltration, denial of service, zero-day, compromise, breach, indicator, tactic, technique, procedure.
Identity & Controls: identity, authentication, authorisation, access control, least privilege, privileged account, MFA, password, credential, token, certificate, encryption, key, firewall, segmentation, endpoint protection, patching, hardening, backup, allowlist, denylist, logging, monitoring, detection, prevention.
Operations & Incident Response: event, alert, incident, severity, triage, investigation, containment, eradication, recovery, forensic, evidence, timeline, root cause, compromise assessment, SIEM, SOC, telemetry, playbook, escalation, tabletop exercise, response plan, business continuity, disaster recovery, lessons learned, remediation.
Risk, Governance & Resilience: risk, likelihood, impact, asset, control, control effectiveness, residual risk, risk appetite, policy, standard, procedure, governance, compliance, privacy, data classification, third-party risk, supply-chain risk, audit, assurance, exception, accountability, security awareness, resilience, zero trust, security posture.
Top 100 Cybersecurity Vocabulary: Working Meanings
| # | Word | Professional meaning |
|---|---|---|
| 1 | Threat | A circumstance or actor capable of causing harm to systems or data. |
| 2 | Threat actor | A person or group carrying out or enabling malicious activity. |
| 3 | Attack | An intentional attempt to compromise confidentiality, integrity or availability. |
| 4 | Attack surface | The set of points through which a system may be attacked. |
| 5 | Vulnerability | A weakness that can be exploited or contribute to compromise. |
| 6 | Exploit | A method or code used to take advantage of a vulnerability. |
| 7 | Exposure | A condition making an asset accessible or susceptible to harm. |
| 8 | Misconfiguration | An insecure or incorrect system setting. |
| 9 | Malware | Malicious software designed to disrupt, damage or gain unauthorised access. |
| 10 | Ransomware | Malware that encrypts or disrupts systems to extort payment. |
| 11 | Phishing | Deceptive communication intended to obtain information or trigger unsafe action. |
| 12 | Social engineering | Manipulation of people to bypass security controls. |
| 13 | Credential theft | Unauthorised acquisition of authentication information. |
| 14 | Privilege escalation | Gaining higher access rights than originally authorised. |
| 15 | Lateral movement | Movement through a network after initial compromise. |
| 16 | Persistence | Techniques used to retain access after compromise. |
| 17 | Exfiltration | Unauthorised extraction of data from a system. |
| 18 | Denial of service | An attack intended to make a service unavailable. |
| 19 | Zero-day | A vulnerability unknown to or not yet patched by the affected vendor at the time of exploitation. |
| 20 | Compromise | A state in which system security has been breached. |
| 21 | Breach | An incident involving unauthorised access, disclosure or loss of protected information or systems. |
| 22 | Indicator | An observable sign suggesting malicious activity or compromise. |
| 23 | Tactic | A high-level objective pursued by an attacker. |
| 24 | Technique | A specific method used to achieve an attacker objective. |
| 25 | Procedure | The concrete implementation of a technique in a particular intrusion. |
| 26 | Identity | A digital representation of a user, service or device. |
| 27 | Authentication | Verification of identity. |
| 28 | Authorisation | Determination of what an authenticated identity may do. |
| 29 | Access control | Mechanisms limiting use of resources to authorised identities. |
| 30 | Least privilege | Granting only the minimum access needed for a task. |
| 31 | Privileged account | An account with elevated administrative or sensitive access. |
| 32 | MFA | Multi-factor authentication using more than one independent factor. |
| 33 | Password | A secret used as one authentication factor. |
| 34 | Credential | Information or token proving an identity or access right. |
| 35 | Token | A digital artefact representing authentication or authorisation state. |
| 36 | Certificate | A digital document binding an identity to a public key. |
| 37 | Encryption | Transformation of information so it is unreadable without authorised key material. |
| 38 | Key | A value used in cryptographic operations. |
| 39 | Firewall | A control filtering network traffic according to defined rules. |
| 40 | Segmentation | Dividing systems or networks to limit unnecessary access and spread. |
| 41 | Endpoint protection | Controls protecting user devices and servers from malicious activity. |
| 42 | Patching | Applying software updates to correct vulnerabilities or defects. |
| 43 | Hardening | Reducing system exposure by removing unnecessary services and insecure settings. |
| 44 | Backup | A recoverable copy of data or system state. |
| 45 | Allowlist | A list of explicitly permitted applications, users or traffic. |
| 46 | Denylist | A list of explicitly prohibited applications, users or traffic. |
| 47 | Logging | Recording system events for operational and security analysis. |
| 48 | Monitoring | Ongoing observation of systems for abnormal or risky behaviour. |
| 49 | Detection | Identification of suspicious or malicious activity. |
| 50 | Prevention | Controls intended to stop unwanted activity before impact occurs. |
| 51 | Event | An observable occurrence in a system or network. |
| 52 | Alert | A notification indicating a potentially relevant security condition. |
| 53 | Incident | An event or set of events requiring security response. |
| 54 | Severity | The seriousness of a security incident or impact. |
| 55 | Triage | Rapid assessment used to prioritise security alerts or incidents. |
| 56 | Investigation | Structured analysis of what happened, how and with what impact. |
| 57 | Containment | Action limiting spread or further damage. |
| 58 | Eradication | Removal of malicious presence and identified cause. |
| 59 | Recovery | Restoration of systems and service after an incident. |
| 60 | Forensic | Relating to preservation and analysis of digital evidence. |
| 61 | Evidence | Information used to support conclusions about an incident. |
| 62 | Timeline | A chronological reconstruction of events. |
| 63 | Root cause | A fundamental causal factor whose correction may reduce recurrence. |
| 64 | Compromise assessment | A structured search for evidence that systems have been breached. |
| 65 | SIEM | Security Information and Event Management technology used to aggregate and analyse security data. |
| 66 | SOC | Security Operations Centre: a team or function monitoring and responding to security events. |
| 67 | Telemetry | Operational data collected from systems for monitoring and analysis. |
| 68 | Playbook | A defined response procedure for a recurring security scenario. |
| 69 | Escalation | Raising a security issue to higher expertise, authority or urgency. |
| 70 | Tabletop exercise | A discussion-based simulation used to test response plans and decision-making. |
| 71 | Response plan | A structured plan for managing cybersecurity incidents. |
| 72 | Business continuity | Maintaining critical business functions through disruption. |
| 73 | Disaster recovery | Restoration of technology and data after severe disruption. |
| 74 | Lessons learned | Knowledge captured from an incident to improve future security. |
| 75 | Remediation | Action correcting security weakness or damage. |
| 76 | Risk | The possibility of loss arising from threats exploiting vulnerabilities. |
| 77 | Likelihood | The estimated probability of a security event occurring. |
| 78 | Impact | The consequence if a security event occurs. |
| 79 | Asset | Something of value requiring protection. |
| 80 | Control | A measure intended to reduce security risk. |
| 81 | Control effectiveness | The degree to which a control works as intended. |
| 82 | Residual risk | Risk remaining after controls are applied. |
| 83 | Risk appetite | The amount and type of risk an organisation is willing to accept. |
| 84 | Policy | A high-level rule or principle governing security activity. |
| 85 | Standard | A specific mandatory requirement supporting policy. |
| 86 | Governance | The structure of authority, oversight and accountability for cybersecurity. |
| 87 | Compliance | Conformity with applicable security or legal requirements. |
| 88 | Privacy | Appropriate collection, use and protection of personal information. |
| 89 | Data classification | Grouping data according to sensitivity and protection needs. |
| 90 | Third-party risk | Risk introduced through suppliers, vendors or external services. |
| 91 | Supply-chain risk | Risk arising from dependencies across products, software or suppliers. |
| 92 | Audit | A structured review against defined controls or requirements. |
| 93 | Assurance | Evidence-based confidence that security controls are operating appropriately. |
| 94 | Exception | An approved departure from a normal security requirement. |
| 95 | Accountability | Obligation to answer for security decisions and outcomes. |
| 96 | Security awareness | Knowledge and behaviour reducing human security risk. |
| 97 | Resilience | Ability to withstand attack, continue essential service and recover. |
| 98 | Zero trust | A security approach requiring continuous verification rather than implicit trust based on network location. |
| 99 | Security posture | The overall condition of an organisation’s security capabilities and exposure. |
| 100 | Defence in depth | Use of multiple complementary security layers so failure of one control does not determine the outcome. |
An Alert Is Not an Incident
Security tools generate signals. Professionals still have to determine whether the signal represents benign behaviour, policy violation, attempted attack or actual compromise. Mature security teams reduce both missed incidents and alert fatigue.
Scenario: Stolen Credentials
Do more than reset the password. Check session tokens, MFA status, privilege, lateral movement, mailbox or cloud rules, data access and whether the same credential was reused elsewhere. Credential theft can be the first visible point of a much larger compromise.
Seven-Day Cybersecurity Vocabulary Plan
| Day | Practice |
|---|---|
| 1 | Separate threat, vulnerability, exposure and risk. |
| 2 | Map identity, authentication, authorisation and privilege. |
| 3 | Trace one attack from initial access to exfiltration. |
| 4 | Practise incident triage and containment language. |
| 5 | Audit one control for effectiveness and residual risk. |
| 6 | Recall 75+ terms by security function. |
| 7 | Write a one-page incident review with timeline, impact and remediation. |
Continue the Digital Profession Wing
- Data & Analytics Professionals
- AI & Machine Learning Professionals
- Product Management Professionals
- Software & Technology Professionals
Conclusion
Cybersecurity vocabulary turns a noisy stream of alerts, weaknesses and controls into structured risk decisions. It helps professionals ask what matters, what is exposed, what failed, and whether recovery leaves the organisation safer than before.