The handoff tax starts with jargon. 284 terms, defined for the people who close the loop.

A vulnerability is a weakness in software, firmware, or hardware that could allow an attacker to gain unauthorised access, steal data, or disrupt services on your devices. Attackers exploit vulnerabilities to breach security; closing them is a core part of Cyber Essentials. Regular scanning and prompt patching minimise your risk.

A CVE (Common Vulnerabilities and Exposures) is a unique reference number assigned to each publicly disclosed security flaw. Think of it as a shared catalogue entry: when a vulnerability is discovered, it gets a CVE ID so security teams worldwide use the same name. This standardisation helps you track which flaws affect your business and prioritise fixes.

CVSS (Common Vulnerability Scoring System) is an industry-standard framework for rating the severity of vulnerabilities on a scale of 0 to 10. Rather than guessing which flaws matter most, CVSS assigns a consistent score based on ease of attack, impact, and other factors. This helps your team focus on the highest-risk issues first.

A CVSS Score is the numerical result (0–10) that describes how serious a vulnerability is: higher scores mean greater risk. The score considers how easy the flaw is to exploit and how much damage it could cause if exploited. Use CVSS scores to prioritise patching: patch high-scoring vulnerabilities first to reduce breach risk.

A CVSS Base Score is the core severity rating of a vulnerability, calculated from technical factors like attack method and required privileges. It stays the same regardless of when the vulnerability was published or your specific business setup. Base Score is the starting point; other scores refine it based on time and your environment.

A CVSS Temporal Score adjusts the Base Score based on when the vulnerability was published and whether a patch or workaround is available. A freshly published flaw with no fix scores higher temporally than an old flaw where patches exist. Use Temporal Scores to decide which gaps to close fastest.

A CVSS Environmental Score customises the severity rating to your organisation's specific setup: it factors in whether vulnerable systems are internet-facing, how many users rely on them, and whether sensitive data is at risk. Tailoring scores this way helps you allocate effort to vulnerabilities that actually threaten your business.

A CPE (Common Platform Enumeration) is a standardised way to name software, hardware, and operating systems so security tools can reliably match vulnerabilities to your installed products. Instead of guessing which flaws apply to 'Windows' or 'Chrome', CPE lets automated tools identify and alert you on relevant issues, cutting manual research.

A CVE ID is the unique reference number assigned to a specific vulnerability, formatted as CVE-YYYY-NNNNN (e.g., CVE-2024-1234). It acts like a ticket number for that flaw across all security databases and patch releases. Use the CVE ID to track whether a vulnerability affects your devices and to confirm a patch has been applied.

A Severity Rating is a label (Critical, High, Medium, Low) or numeric score that describes how harmful a vulnerability is. Severity depends on exploitability, impact scope, and required privileges. Understanding severity helps you rank which flaws your team should patch first to protect your business.

Vulnerability Disclosure is the process of reporting a security flaw to the affected vendor or organisation so they can create a fix before attackers learn about it. Responsible disclosure balances transparency with secrecy: vendors get time to patch before public details are released, reducing the window attackers can exploit.

A Zero-Day Vulnerability is a security flaw that is actively exploited in the wild but has no official patch yet. Attackers have found it; the vendor has not. Zero-days are extremely dangerous because you cannot simply update to fix them. Defence relies on detecting suspicious activity, air-gapping critical systems, or switching to unaffected alternatives temporarily.

Patch Management is the discipline of keeping software and operating systems up to date with security fixes and improvements. A formal patch process—identifying updates, testing on non-critical systems, scheduling rollout, and verifying installation—reduces the risk of both vulnerabilities and downtime. Most breaches exploit known, patchable flaws.

A Vulnerability Assessment is a systematic review of your systems to identify security weaknesses, missing patches, misconfigurations, and other gaps. Unlike a penetration test, it is not hands-on exploitation; instead, it catalogues what needs fixing. Assessments give you a clear roadmap of remediation priorities and costs.

Vulnerability Scanning is an automated process that checks your devices, applications, and networks against known security issues. Scanners compare installed software versions to CVE databases and flag any matches. Regular scanning—daily or weekly—detects new vulnerabilities quickly so you can patch before exploitation.

A False Positive is when a security scanner reports a vulnerability that does not actually exist on your device. False positives waste time investigating non-issues and can erode trust in your scanning tools. Tuning scanners to your environment and validating findings manually reduces false positives and helps your team focus on real threats.

A True Positive is when a security scanner correctly identifies a real vulnerability present on your device. True positives require action—patching, disabling a service, or mitigating risk—to reduce breach likelihood. The goal of vulnerability management is to find all true positives and remediate them before attackers do.

Vulnerability Remediation is the process of fixing or reducing the risk of security flaws. Actions include applying patches, disabling vulnerable features, changing configurations, or replacing affected software. Effective remediation is tracked from discovery through verification so nothing slips through the cracks.

An Attack Vector is the method or pathway an attacker uses to exploit a vulnerability—for example, via network access, physical USB insertion, or a malicious email. CVSS considers whether a flaw requires local access (lower risk) or can be exploited remotely over the internet (higher risk). Understanding attack vectors helps you prioritise defences.

Attack Complexity describes how difficult it is for an attacker to exploit a vulnerability. Low complexity means an attack needs little skill or preparation; high complexity means special conditions or knowledge are required. CVSS factors this in: vulnerabilities with low complexity are more dangerous because almost anyone can exploit them.

A threat actor is any individual or organised group that deliberately carries out cyberattacks against businesses, organisations or individuals. They range from opportunistic criminals to state-sponsored teams and operate with varying skill levels and resources. Understanding who targets your business helps you prioritise defences.

An exploit is a tool or technique that takes advantage of a known software vulnerability to compromise a device or system. Attackers use exploits to gain unauthorised access, steal data or install malware before patches are available. Prompt patching blocks most exploits.

Ransomware is malicious software that encrypts your files and data, rendering them inaccessible, and demands payment (ransom) in exchange for a decryption key. It spreads through phishing, weak passwords or unpatched vulnerabilities. Regular backups and prompt incident response are your best defences.

Malware is any hostile software designed to infiltrate, damage or steal from your devices without permission. It includes viruses, worms, trojans, ransomware and spyware, often installed via phishing emails, downloads or exploits. Microsoft Defender and endpoint detection catch most malware.

A trojan (or trojan horse) is malware disguised as legitimate software that tricks users into installing it. Once inside, it silently grants attackers access to your system, data or network. Never download software from untrusted sources, and keep backups current.

A worm is self-replicating malware that spreads automatically across networks and devices without user action. Unlike trojans, worms do not need to disguise themselves. They consume bandwidth and system resources, and can carry ransomware or other payloads.

A virus is malware that attaches itself to legitimate files or programs and spreads when those files are executed. It can corrupt files, steal data or slow performance. Email attachments and USB sticks are common delivery routes; antivirus software detects most viruses.

Phishing is a deceptive attack using fraudulent emails, messages or websites that impersonate trusted organisations to steal login credentials, financial data or install malware. It is the most common entry point for business breaches. Train staff to spot red flags and never click unsolicited links.

Spear phishing is a targeted attack against specific individuals or companies, personalised with real names and details to seem legitimate. It is more convincing than generic phishing and poses higher risk. It often precedes ransomware or data theft.

Business Email Compromise (BEC) is a targeted fraud scheme where attackers impersonate executives or suppliers via email to trick staff into transferring money or revealing sensitive data. BEC costs businesses billions annually. Verification protocols and multi-factor authentication reduce risk significantly.

Credential stuffing is an automated attack where criminals use stolen username and password pairs (from prior breaches) to gain unauthorised access to other systems. If staff reuse passwords across sites, this tactic succeeds at scale. Enforce unique, strong passwords and multi-factor authentication.

A brute force attack repeatedly tries all possible password combinations until access is gained. Attackers use automated tools to test thousands of guesses per second against your accounts. Strong passwords, account lockouts and multi-factor authentication all frustrate brute force attempts.

A Man-in-the-Middle (MITM) attack intercepts unencrypted communications between two parties to eavesdrop or alter data in transit. Coffee shop Wi-Fi and compromised networks are common venues. Use HTTPS, avoid public Wi-Fi for sensitive work, and deploy firewalls to detect interception.

A Denial of Service (DoS) attack overwhelms a server or network with traffic, making services unavailable to legitimate users. A single attacker directs the flood from one location. It disrupts operations but does not steal data. Firewalls and rate-limiting software mitigate DoS attacks.

A Distributed Denial of Service (DDoS) attack is a DoS attack launched simultaneously from hundreds or thousands of compromised devices (a botnet), amplifying the impact. Most large organisations experience DDoS annually. CDNs and DDoS mitigation services absorb these attacks cost-effectively.

Lateral movement is the attacker's technique of spreading from an initial foothold to other devices, accounts or systems within your network. After compromising one device, an attacker pivots inward to access sensitive data or critical systems. Network segmentation and least-privilege access block lateral movement.

Privilege escalation is when an attacker gains elevated access rights (admin or system level) from a lower-privileged account they have already compromised. This opens access to files, systems and data off-limits to ordinary users. Limiting admin rights and patching vulnerability exploits mitigate escalation risk.

An Intrusion Detection System (IDS) monitors network traffic and system activity to identify and alert on suspicious behaviour or known attack patterns. It logs evidence but does not block threats (unlike an IPS). IDS tuning requires expertise to balance security with false alarms.

An Intrusion Prevention System (IPS) monitors and actively blocks suspicious network traffic and attacks in real time before they reach your systems. It combines detection with automatic enforcement. IPS is often embedded in firewalls and provides stronger defence than IDS alone.

Incident response is the coordinated process of detecting, investigating and remediating a security breach or attack to restore normal operations. Speed is critical: minutes lost multiply the damage and cost. Maintain an incident response plan, practise regularly, and have contacts for forensics and legal advice on file.

An endpoint is any device connected to your business network and requiring protection, such as a computer, laptop, tablet, or server. Endpoints are common targets for cyber-attacks because they hold valuable data and often connect to corporate systems. Securing every endpoint is critical to preventing breaches across your organisation.

Endpoint Detection and Response (EDR) is security software that continuously monitors devices for suspicious activity, logs every action, and alerts your team to threats. Unlike traditional antivirus, EDR captures detailed context about how an attack unfolds, enabling faster investigation and response. It helps you catch advanced threats that basic defences miss.

Managed Detection and Response (MDR) is an outsourced security service where experts monitor your endpoints 24/7, investigate threats, and recommend remediation actions. MDR combines advanced monitoring tools, human expertise, and round-the-clock oversight—ideal for teams lacking in-house security staff. Costs vary by device count and threat complexity.

Extended Detection and Response (XDR) integrates threat detection and response across multiple layers—endpoints, networks, email, servers, cloud apps—into one unified platform. XDR gives security teams a complete picture of an attack's journey across your entire infrastructure. It reduces false alerts and accelerates incident response compared to single-tool monitoring.

Windows Defender (now called Microsoft Defender) is built-in antivirus and malware protection included free with Windows operating systems. It provides real-time scanning of files and programmes, and integrates with Windows Update for the latest threat definitions. For small businesses with basic security needs, Windows Defender offers essential baseline protection at no extra cost.

Microsoft Defender for Endpoint is a paid enterprise security platform that combines antivirus, EDR capabilities, and threat intelligence across Windows, Mac, and Linux devices. It logs every device action, integrates with Microsoft 365, and includes automated response to common attacks. Pricing is per-device per-month and scales with your fleet.

Antivirus is security software that scans files and programmes on your device to detect and remove computer viruses. It works by comparing files against a catalogue of known malware signatures and stopping malicious software before it runs. Antivirus is a foundational layer of defence but is insufficient alone against modern threats like ransomware and sophisticated malware.

Anti-malware is software designed to detect and remove a broader range of malicious software than traditional antivirus, including spyware, adware, trojans, and ransomware. It uses both signature-based detection (matching known threats) and behavioural analysis (watching for suspicious actions). Running anti-malware alongside antivirus strengthens your device's defences.

Device inventory is a complete list of all computers, laptops, mobile devices, and servers your organisation owns or uses for business. It includes hardware details (model, serial number, processor), operating system versions, installed software, and licence compliance data. Maintaining accurate inventory helps you track security patches, manage costs, and prove compliance to regulators.

Asset management is the process of tracking, cataloguing, and maintaining all IT resources (devices, software, licences) your organisation owns throughout their lifecycle. It covers purchasing, deployment, security patching, licence renewal, and decommissioning. Good asset management ensures you know what you have, maintain compliance, control costs, and reduce security gaps.

Device registration is the process of enrolling a computer or mobile device into your organisation's management system so it can be monitored, secured, and kept up to date. Registration creates a record linking the device to a user and organisation, enabling remote management, security policy enforcement, and inventory tracking. Registration is often required before accessing corporate resources.

An agent is lightweight software installed on each of your devices that reports information back to a central security or management system. The agent runs in the background, collects data about installed software, security status, and system changes, then sends it to your monitoring platform. Agents enable detailed visibility and automated response without requiring expensive infrastructure.

A Windows agent is software designed specifically for Windows computers that monitors system health, security status, and software inventory. It reports back to a management platform (cloud or on-premises) so your IT team can see what's installed, which patches are missing, and whether security settings are correct. Windows agents are the primary tool for managing large device fleets.

An Operating System (OS) is the core software that runs on a device and manages all hardware, applications, and user tasks. Common business OSs include Windows, macOS, and Linux. Keeping your OS up to date with security patches is essential because attackers target OS vulnerabilities to gain control of devices.

An OS patch is a small software update that fixes specific security vulnerabilities or bugs in your operating system. Patches are released regularly (often monthly) by the OS vendor and should be applied promptly to close security gaps. Delaying patches leaves your devices exposed to known exploits that attackers actively use.

A cumulative update is a single package containing all security patches and bug fixes released for your operating system up to a specific date. Instead of installing patches individually, cumulative updates bundle them together, reducing the number of restarts needed and simplifying deployment. Windows 10 and 11 primarily use cumulative updates released monthly.

Hardware inventory is a detailed record of the physical components in each device, including processor type, memory (RAM), storage capacity, network interface, and peripherals. Hardware data helps you understand device capabilities, plan upgrades, assess compatibility with software, and detect unauthorised or rogue devices. Most management tools collect hardware inventory automatically.

Firmware is specialised low-level software stored on your device's hardware (not the hard drive) that controls how the hardware boots and operates. Firmware sits between the hardware and your OS, managing power, temperature, and security features. Firmware updates are critical for security because vulnerabilities here can bypass OS-level defences entirely.

The BIOS (Basic Input/Output System) is firmware that initialises your computer's hardware before the operating system loads. It controls boot sequence, hardware detection, and low-level security settings like Secure Boot. BIOS updates patch vulnerabilities (e.g., Spectre, Meltdown) that could allow attackers to bypass OS protections, so keeping BIOS current is a critical security priority.

System hardening is the process of removing unnecessary services, closing unused ports, applying security settings, and disabling risky features on devices to reduce attack surface. Examples include turning off unneeded network services, enforcing strong passwords, enabling encryption, and configuring firewalls. Hardening follows frameworks like the NIST Cybersecurity Framework and CIS Benchmarks.

An application inventory is a comprehensive catalogue of all software programmes installed across your business devices. Tracking versions, publishers, and locations helps identify outdated software, security gaps, and licensing risks. Without a complete inventory, you cannot manage vulnerabilities or ensure compliance.

An installed application is a software programme deployed on a specific device or user account. It includes the application name, version, vendor, installation path, and (for Windows) uninstall metadata. Installed applications can have vulnerabilities and licensing implications, and drift from approved corporate standards.

A software vulnerability is a flaw or weakness in application code that an attacker can exploit to bypass security controls, steal data, or disrupt service. Vulnerabilities range from low-risk cosmetic bugs to critical remote-code flaws; severity is usually ranked by CVSS score and real-world exploit activity.

A third-party application is software built by an external vendor and installed on your devices (e.g. Adobe Reader, Slack, Chrome). Unlike in-house software, you depend on the vendor for security patches and updates. Third-party software is a major attack surface and the most common source of exploitable vulnerabilities in SMBs.

A legacy application is older software still running in your business despite newer versions being available. Legacy software often cannot be updated without breaking business processes, lacks modern security controls, and runs on unsupported operating systems. Migration or replacement typically requires planning and budget.

Unsupported software is any programme no longer receiving patches or security updates from its vendor. This includes software past end-of-life, custom tools without an active maintainer, or commercial products where your licence expired. Running unsupported software leaves you exposed to known, unpatched vulnerabilities.

End of Life (EOL) is the date when a software vendor stops distributing and supporting a product version. After EOL, the vendor ceases all updates, including security patches, though the software itself continues to run. Devices running EOL software accumulate unpatched vulnerabilities and fall out of compliance with security standards.

End of Support (EOS) is the date when a vendor stops providing all technical assistance and updates for a product, though patches may continue under extended support programmes. EOS is typically earlier than EOL. After EOS, your organisation must either upgrade or accept the risk of running unsupported software.

A software licence is a legal agreement granting permission to use a software product under specific terms (e.g. per-device, per-user, site, or perpetual). Licences specify usage rights, duration, support entitlements, and restrictions. Breaching licence terms exposes you to legal liability and financial penalties.

Licence compliance means using every software licence in accordance with its terms—correct number of users/devices, valid maintenance, no unauthorised distribution. Non-compliance risks software audits, legal action, and substantial fines. Larger organisations are audit targets; maintaining an accurate software inventory and licence catalogue is the easiest defence.

A dependency is a software library or component that another application requires to function. Dependencies can be system libraries (Windows Runtime), frameworks (.NET, Java), or third-party packages (npm, PyPI). A vulnerability in a dependency affects all applications using it; hence managing and patching dependencies is critical.

Open source software is code distributed with source-code visibility and a licence permitting use, modification, and redistribution. Examples include Linux, Firefox, Apache, and Python. Open source is free but not free of vulnerabilities; you must track security advisories and apply patches yourself, as there is no vendor guaranteeing support.

The software supply chain encompasses every step from code authorship to deployment: development, build systems, dependency repositories, distribution channels, and installation. A supply-chain attack injects malicious code at any point. Securing it requires vetting vendors, scanning dependencies, and monitoring package repositories for tampering.

An artifact repository is a centralized store for software packages and binaries (e.g. NuGet, npm registry, Maven Central). Organisations use private repositories to version and control releases. Misconfigured repositories can leak credentials or allow unauthorised users to push malicious packages into your build pipeline.

A package manager is a tool (npm, pip, apt, Chocolatey, NuGet) that automates downloading, installing, and updating software packages and dependencies. It resolves version conflicts and dependency chains. Package managers increase deployment speed but also risk if a malicious or compromised package is published to a repository you trust.

A software version is a specific release of an application, identified by a version number (e.g. 24.1.5) and associated with particular features, fixes, and security patches. Different versions carry different vulnerability profiles; older versions accumulate unpatched flaws. Tracking and enforcing minimum-version standards is essential for security and support.

An application update is a release of new code that adds features, fixes bugs, or closes security vulnerabilities. Updates range from minor patches (e.g. 1.0.1) to major revisions (e.g. 2.0), each with different risks and installation complexity. Timely updates are critical; unpatched applications are the fastest path to compromise in SMBs.

A rollback is reverting a device or application to an earlier version or state after an update fails or causes harm. Rollbacks require backup data and system snapshots, and downtime cannot be avoided. Planning rollback procedures before deploying updates is essential; testing major updates in a pilot group first minimises rollback risk.

A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined rules. It acts as a barrier between your internal network and the internet, allowing legitimate traffic through whilst blocking potential threats. Every business network should have a firewall; they're often built into routers or run as separate appliances.

Network security encompasses all measures and practices that protect your organisation's data and systems from unauthorised access, cyberattacks, and misuse over network connections. This includes firewalls, encryption, access controls, and monitoring. Strong network security is essential for protecting customer data and business continuity.

A firewall rule is a specific instruction that defines what network traffic the firewall should permit or block. Rules are based on factors like source/destination IP addresses, ports, and application types. Well-designed rules allow business-critical traffic through while stopping malicious access attempts.

A port is a virtual endpoint in a computer used for sending or receiving data over a network. Ports are numbered (0–65535) and each serves a specific purpose or application, like port 443 for secure web browsing or port 25 for email. Firewalls often control which ports remain open on your devices.

A network port is a communication endpoint on a device that enables applications to send and receive data across your network or the internet. Each port is identified by a number and supports a particular service or protocol. Controlling which ports are open is a key part of network security.

An inbound rule is a firewall instruction that governs what incoming traffic your network or device will accept. For example, allowing customers to connect to your web server on port 443 or blocking unrequested incoming connections. Most businesses block inbound traffic by default and explicitly allow only necessary services.

An outbound rule is a firewall instruction that controls what data and traffic your devices are allowed to send out to the internet or other networks. Outbound rules can prevent malware from 'calling home' to attackers and stop unauthorised data exfiltration. Many organisations restrict outbound connections to approved destinations only.

An IP address is a unique numerical identifier assigned to each device on a network, much like a postal address for data packets. IP addresses allow devices to find and communicate with each other over networks and the internet. Every connected device in your business has one.

IPv4 (Internet Protocol version 4) is the older and most widely used IP addressing standard, using a 32-bit format expressed as four numbers separated by dots, e.g. 192.168.1.1. Although nearly exhausted due to billions of connected devices, IPv4 remains the dominant protocol for most business networks.

IPv6 (Internet Protocol version 6) is the newer IP standard using a 128-bit format that supports vastly more addresses than IPv4, expressed as hexadecimal groups separated by colons. IPv6 solves the IPv4 address shortage and adds improved security features. Adoption is growing as businesses expand their device footprint.

A subnet is a logical subdivision of an IP network that groups devices together and allows your organisation to segment traffic. Subnetting improves network performance, organisation, and security by separating different departments or device types. Most businesses partition their networks into multiple subnets.

A network segment is a portion of your network separated from others, either logically or physically, to improve security and performance. Segmentation isolates sensitive systems—like financial servers—from general office traffic. This practice reduces the damage if one segment is compromised.

A VPN (Virtual Private Network) creates an encrypted tunnel for your internet traffic, protecting it from interception and masking your IP address. VPNs are essential when staff connect from home or public WiFi, and many organisations use them for secure remote access. Choose a VPN provider with a clear no-logging policy.

A DMZ (Demilitarised Zone) is a network segment that sits between your internal network and the untrusted internet, hosting publicly accessible services like web servers. It isolates external-facing systems so that if one is compromised, attackers cannot directly reach your sensitive internal data. This layered approach is a core security best practice.

Ingress refers to incoming traffic or data entering your network or a specific device from external sources, typically the internet. Ingress traffic requires careful monitoring and control through inbound firewall rules. Blocking unnecessary ingress is a first line of defence against unauthorised access.

Egress refers to outgoing traffic or data leaving your network to external destinations, such as the internet. Monitoring egress helps detect compromised devices sending stolen data to attackers. Many organisations control egress via outbound firewall rules or web content filters.

Rate limiting is a technique that restricts the number of requests or data transmissions a source can send within a given timeframe. It protects servers from being overwhelmed and can mitigate certain cyberattacks. Rate limiting is commonly used in web applications and APIs to maintain service availability.

DDoS protection refers to measures designed to defend your network against Distributed Denial-of-Service attacks, where attackers flood your systems with traffic to cause unavailability. Protection includes rate limiting, traffic filtering, and using specialised services. DDoS attacks can cripple online services; protection is vital for customer-facing systems.

A Web Application Firewall (WAF) is a specialised security tool that sits in front of web applications and filters HTTP/HTTPS traffic to block attacks like SQL injection and cross-site scripting. Unlike traditional firewalls, WAFs understand application-layer requests. Any organisation running public-facing websites should consider a WAF.

Network Access Control (NAC) is a security framework that authenticates devices and enforces compliance policies before allowing them to connect to your network. NAC can quarantine non-compliant devices or restrict their access. Implementing NAC helps prevent unauthorised and infected devices from accessing sensitive business resources.

A patch is a small code change released to fix bugs or security flaws in software. They are smaller and more targeted than major updates, typically addressing one issue or a narrow set of issues. Patches help keep your business software stable and safe without requiring a complete reinstall.

A security patch is a code update specifically designed to fix a publicly discovered security vulnerability. These patches close gaps that attackers could exploit to access your systems or data. They should be applied as quickly as possible to reduce your attack surface, especially if the vulnerability is actively being exploited in the wild.

A hotfix is an urgent patch released outside normal schedules to address a critical issue or active attack. Hotfixes are often deployed immediately to prevent serious damage, such as data loss or system compromise. Unlike planned patches, they are usually treated as temporary and are often rolled into a larger update later.

Windows Update is Microsoft's system that automatically distributes security patches, driver updates, and feature enhancements to Windows devices. Updates include monthly security patches (released on Patch Tuesday), cumulative quality updates, and optional feature releases. You can schedule when devices install these to minimise business disruption.

macOS Update is Apple's distribution system for security fixes, driver updates, and feature improvements to Mac devices. Apple releases major versions annually plus regular security updates throughout the year. Updates include both critical security patches and optional enhancements, which IT teams can schedule to avoid disrupting users.

Linux Update refers to the distribution-specific package management systems (like apt for Ubuntu or yum for Red Hat) that deliver security fixes and software improvements. Linux updates are often more granular than Windows or macOS, allowing you to patch individual packages without rebooting. Update schedules vary by distribution.

Patch Tuesday is the second Tuesday of each month when Microsoft releases security updates and quality fixes for Windows, Office, and other products. It has become the industry standard day for patch management, allowing IT teams to plan testing and deployment schedules. Many organisations use it to synchronise their update windows.

An update schedule is a planned timetable for when patches and updates will be tested, approved, and rolled out to your devices. Effective schedules balance security urgency against operational stability and user impact. Scheduling reduces unplanned downtime, prevents conflicts with critical business processes, and gives IT time to test for compatibility.

Unattended maintenance is automatic patching that occurs without user intervention, usually during off-hours or pre-scheduled windows. The system applies updates and reboots independently, reducing IT overhead and ensuring compliance. This is essential for server environments and organisations with hundreds of devices that cannot rely on manual patching.

A rollout strategy is your plan for how, when, and in what order patches are deployed across your organisation. Effective strategies consider device criticality, user groups, testing phases, and risk tolerance. Common approaches include phased rollouts (low-risk devices first), ring deployments (test rings before production), or staggered timing to avoid deployment bottlenecks.

Canary deployment releases patches to a small subset of devices (the canary group) first to detect problems before affecting the wider organisation. If the canary group runs without issues for a set period, the patch rolls out to remaining devices. This approach catches unexpected compatibility issues and driver conflicts early, minimising widespread outages.

Staged rollout is a multi-phase approach where patches are deployed to progressively larger device groups over time (e.g. 10% then 50% then 100%). Each stage includes a pause to monitor for issues. This reduces risk by containing problems to smaller groups, giving IT time to respond if something breaks, and maintaining business continuity.

A rollback plan is a documented procedure to remove or revert a problematic patch if it causes system failures, data loss, or other serious issues. The plan should include which patches can be safely uninstalled, which require a system restore, and how quickly each rollback can be executed. A tested rollback plan is your safety net against bad updates.

Update compliance measures what percentage of your devices have installed required security patches and updates. It is a key metric for regulatory compliance (e.g. ISO 27001, PCI-DSS, GDPR), risk management, and cyber insurance requirements. Tracking compliance by device group, department, or type helps identify patching gaps and manage risk.

Patching cadence is how often you systematically apply patches to your devices, such as weekly, monthly, or quarterly. A regular cadence reduces administrative overhead and keeps your security posture predictable. Many organisations align their cadence with Patch Tuesday to take advantage of industry synchronisation and shared risk assessment data.

A critical update is a patch for a flaw that poses severe risk to your business, such as an actively exploited remote code execution vulnerability. Critical updates should be tested quickly and deployed within days, not weeks. Delaying critical patches significantly increases your exposure to data theft, ransomware, and system compromise.

A security update is any patch that addresses a known security vulnerability. Security updates range from critical (immediate threat) to low-priority (unlikely to be exploited). Prioritising by severity and exploitability allows your team to focus effort on the highest-risk flaws while still maintaining a regular cadence for lower-risk patches.

A quality update is a patch that fixes bugs, improves performance, or improves stability without addressing security vulnerabilities. Quality updates are lower priority than security patches but still important for maintaining reliable systems. They are often bundled into monthly update cycles alongside security patches on Patch Tuesday.

A feature update is a significant release that adds new capabilities, improvements, or user interface changes to an operating system or application. Feature updates are usually major releases (e.g. Windows version upgrades) that occur on longer cycles. They carry higher risk and require more planning, testing, and user communication than security or quality patches.

A service pack is a large bundle of accumulated patches, hotfixes, and quality improvements released together, usually for older operating systems or applications. Service packs can include security patches, feature improvements, and driver updates. Although less common in modern rolling-update models, legacy systems may still require service packs to stay supported and secure.

Dark Web Monitoring is continuous automated scanning of hidden online marketplaces and forums for signs that your organisation's data, credentials, or devices have been compromised and are being traded. Security teams use it to detect breaches early and respond before data is exploited. Detection of a leak lets you reset passwords and alert users within hours rather than days.

A Dark Web Scan is a single, targeted search of dark web marketplaces and theft forums to determine whether specific company credentials, employee details, or device identifiers are being offered for sale or posted publicly. Scans form the core of breach early-warning — running them monthly or after known breaches keeps you ahead of attackers.

Threat Intelligence is processed, analysed information about active security threats, attackers' methods, and vulnerable software in the wild. It transforms raw data (breach reports, code samples, attack logs) into actionable insight: who is attacking, how they work, what you need to patch first. Organisations use it to prioritise fixes and detect ongoing attacks.

A Threat Feed is a regularly updated list of known malicious websites, IP addresses, files, and tactics circulated by security vendors or threat researchers. Feeds flow into firewalls, endpoint scanners, and monitoring tools so they automatically recognise and block bad activity in real time. Subscribe to feeds from trusted vendors matching your industry and device types.

Indicators of Compromise are specific digital signatures (malware file hashes, suspicious IP addresses, unusual command patterns) that prove an attacker has accessed your network or devices. IoCs let you search past logs to confirm breach scope: you find the IoC pattern, you know the extent of the intrusion. They are the evidence breach responders hunt for.

A Malware Signature is a unique cryptographic fingerprint of known malicious software, used by antivirus and endpoint detection tools to spot and block it. New signatures are published daily as researchers reverse-engineer discovered malware; your antivirus must update frequently to catch emerging threats. Signature-based detection is fast but misses brand-new, never-before-seen malware.

An Intelligence Source is any trusted provider of threat data: government agencies (NCSC, CISA), commercial vendors (SecurityScorecard, recorded cybercriminal forums), industry peers via ISACs, or your own incident logs. Each source has strengths (NCSC focuses on state threats; vendor feeds catch commodity malware fast). Cross-check sources to avoid false alarms.

Breach Intelligence is analysis of confirmed data thefts: which company was hit, what data was stolen, when, and by whom. Detailed breach reports from forensic firms and law enforcement help you understand attacker motivation, tools, and next targets. If your industry peer suffers a breach, their breach intelligence tells you what defences failed and which you should strengthen.

A Data Breach is an unauthorised disclosure of personal or business information: customer names, payment card details, passwords, device secrets. Breaches occur via hacking, insider theft, or accidental exposure. Organisations must notify affected individuals and regulators (ICO in the UK) within 72 hours; failure costs fines and reputation damage.

A Credential Leak is the exposure of usernames, passwords, or API tokens online, usually via dark web marketplaces after a breach or phishing campaign. Leaked credentials are immediately used to break into other services (password reuse is widespread). Check dark web monitoring alerts for leaks monthly and force password resets for any account found.

A Compromised Account is a user identity an attacker has gained control of, often via stolen credentials or phishing. The attacker logs in as the legitimate user and can exfiltrate data, install malware, or escalate to admin accounts. Detect compromise via unusual login locations, late-night access, or impossible travel, then revoke the password immediately.

A Threat Advisory is a formal warning issued by vendors, government agencies (NCSC, CISA), or security researchers about an imminent or active attack campaign, new vulnerability, or malware surge. Advisories include indicators, affected software, and remediation steps. Subscribe to advisories from NCSC and your software vendors; action them within 48 hours.

A Security Alert is an automated notification that something suspicious has occurred on your devices or network: a known malware file detected, an impossible login pattern, a patch update failing. Alerts should be prioritised (critical exploit attempt vs. low-level policy violation). Actionable alerts have context and steps to investigate.

An Attack Pattern is a repeating sequence of steps an attacker uses to breach an organisation: spear-phishing employees, disabling antivirus, stealing data. Patterns vary by attacker group and target industry. The MITRE ATT&CK framework catalogues patterns so defenders can anticipate the next move after an attacker's first foot-hold.

Tactics, Techniques and Procedures are the specific methods attackers use at each stage of a breach. Tactics are goals (credential theft, lateral movement); Techniques are how they achieve them (phishing, brute-force); Procedures are the exact tools and scripts. Knowing the TTP of known attacker groups lets you detect their activity and block their preferred techniques.

MITRE ATT&CK is a free, public catalogue of attacker tactics and techniques based on real-world breach data. It organises attack methods by stage (initial access, persistence, privilege escalation) so defenders can map their controls against actual attacker moves. It is the industry standard for threat modelling and breach response planning.

Adversarial Emulation is a controlled security test in which a team simulates a real attacker's methods — using their published tools, techniques, and attack sequences — to find gaps in your defences. It mirrors realistic threat actor behaviour rather than generic penetration tests. Run adversarial emulation annually to prove your detection and response capabilities.

A Penetration Test is a contracted security assessment where a qualified firm attempts to break into your systems, devices, and networks using real-world attack methods. Penetration testers document every finding and provide remediation guidance. Running penetration tests every 12 months (or after major changes) is a Cyber Essentials Plus requirement.

A Red Team is a group of security specialists who simulate adversaries during a full-scale security exercise, attacking your organisation's defences to test response procedures and technical controls. Red team exercises are more comprehensive than penetration tests and include social engineering, physical security, and incident response. Schedule red team exercises every 12-24 months.

Vulnerability Research is systematic analysis of software code or systems to discover flaws that attackers could exploit. Researchers (academic, vendor, independent) publish findings as CVEs (Common Vulnerabilities and Exposures) so vendors can patch and organisations can prioritise updates. Subscribe to CVE feeds matching your software inventory and patch critical findings within 14 days.

A compliance framework is a structured set of guidelines, processes, and controls designed to help organisations meet legal and regulatory requirements. It provides a blueprint for implementing security policies across your business and demonstrates to auditors that you're taking compliance seriously. Common frameworks include GDPR, HIPAA, and PCI DSS.

A compliance audit is a formal examination of your organisation's systems, records, and processes to verify you're meeting regulatory requirements. An auditor (internal or external) checks your devices, controls, and documentation against industry standards. It typically produces a report listing gaps and recommendations for remediation.

A compliance report is a documented assessment of how well your organisation meets security and regulatory requirements. It summarises your current controls, identifies non-compliance issues, and often rates your overall security posture. These reports are used internally to drive improvements and externally to satisfy customers, insurers, or auditors.

GDPR (General Data Protection Regulation) is European data-protection law that requires organisations handling personal data to keep it secure, obtain consent, report breaches within 72 hours, and respect individuals' data rights. It applies to any business operating in the EU or serving EU customers, with heavy fines for violations.

HIPAA (Health Insurance Portability and Accountability Act) is a U.S. law requiring healthcare providers and their partners to secure patient medical records and personal health information. It mandates encryption, access controls, breach notification, and regular audits. Non-compliance can result in substantial fines.

PCI DSS (Payment Card Industry Data Security Standard) is a security standard for organisations handling credit card data. It requires secure networks, encrypted cardholder data, regular security testing, and strong access controls. If you accept card payments, your payment processor likely requires PCI DSS compliance.

ISO 27001 is an international standard for establishing and maintaining an information security management system (ISMS). It defines processes for identifying risks, implementing controls, and regularly reviewing your security posture. Many large customers and regulated industries now require vendors to hold ISO 27001 certification.

ISO 27002 is an international guideline providing detailed recommendations for implementing information security controls aligned with ISO 27001. Rather than a certification standard, it's a practical reference listing controls across areas like physical security, access management, and incident response to help you close gaps.

SOC 2 (Service Organisation Control) is a compliance framework for cloud and SaaS providers, audited by a certified accountant. It covers five trust principles: security, availability, processing integrity, confidentiality, and privacy. Customers often request SOC 2 reports from vendors to verify trustworthiness.

SOC 2 Type II is a deeper, extended audit covering your security controls over a minimum 6-month period, demonstrating they work reliably over time. It's harder and costlier to achieve than Type I (a point-in-time snapshot) but provides stronger assurance to customers and partners.

The NIST Cybersecurity Framework is a U.S. government-backed set of practices for managing cyber risk across identify, protect, detect, respond, and recover functions. It's flexible, applicable to any size organisation, and widely adopted by government contractors and critical infrastructure operators.

CIS Controls (Centre for Internet Security Controls) are 18 prioritised best practices for defending against common cyber attacks. They cover basic hygiene like asset inventory, software patching, and access control through to advanced detection and incident response. They're vendor-neutral and practical for organisations of any size.

Cyber Essentials is a UK government-backed certification scheme run by the NCSC. It assesses five basic security controls: firewalls, secure configuration, access control, malware protection, and patch management. It's free to self-assess and relatively quick to complete, ideal for SMBs.

Cyber Essentials Plus is the next level of the NCSC's Cyber Essentials scheme, adding an external technical test of your systems and devices. An approved assessor verifies you've correctly implemented the five core controls. It costs more than self-assessment but provides independent verification.

The NCSC (National Cyber Security Centre) is the UK government's technical authority on cyber security, part of GCHQ. It publishes guidance, runs certification schemes like Cyber Essentials, and advises organisations on threats and defences. Check its website for practical security advice.

DORA (Digital Operational Resilience Act) is EU regulation requiring financial institutions to manage ICT risks, test incident response, and report major outages. It mandates regular third-party testing and security assessments. If you provide digital services to EU banks, DORA applies to you.

A benchmark is a reference standard or best-practice baseline for security configuration. It defines the correct settings for software, operating systems, or networks to minimise vulnerabilities. Organisations use benchmarks (like CIS or NIST) to harden devices and measure their security posture against industry peers.

Security hardening is the process of strengthening your devices and systems by disabling unnecessary services, applying secure configurations, and patching vulnerabilities. It reduces your attack surface and makes compromise harder. For example, removing unneeded software or tightening firewall rules hardens your environment.

A configuration baseline is a documented standard state for your devices and applications, defining correct settings for security, performance, and compliance. It serves as a benchmark to measure drift and as a recovery point if something breaks. Baselines are essential for audit trails and reproducible security.

Policy compliance is the degree to which your devices, users, and processes follow established security and operational policies. It's measured by audits, scans, and reports showing how many devices meet required configurations. Non-compliance often triggers remediation workflows or denial of access.

A risk assessment is a systematic evaluation of potential security threats and vulnerabilities affecting your organisation's devices and data. It identifies what could go wrong, the damage it might cause, and how likely it is to happen. The results guide which risks to tackle first and how to protect your business.

A risk score is a numerical rating that quantifies the overall security threat posed by a vulnerability or issue on your devices. It combines severity (how bad the vulnerability is) with likelihood (how easily an attacker could exploit it). Higher scores mean greater priority for remediation.

A risk level is a category (typically critical, high, medium, low) that describes the seriousness of a security threat. It reflects both the potential damage and the probability of exploitation. Risk levels guide your remediation schedule and resource allocation.

Risk appetite is the amount of risk your organisation is willing to accept in pursuit of its business goals. It defines boundaries: which vulnerabilities are tolerable for how long, and which require immediate action. Clear risk appetite prevents both paralysis and dangerous complacency.

Risk mitigation is any action taken to reduce, eliminate, or transfer a security risk. Examples include patching software, disabling insecure settings, isolating vulnerable devices, or purchasing cyber insurance. Mitigation is the core of security management.

Risk acceptance is the deliberate decision to tolerate a known security risk because mitigation is too costly, disruptive, or impractical. It must be documented, approved by leadership, and regularly reviewed. Accepted risks must still be monitored.

A threat model is a structured framework that identifies potential attackers, their motivations, entry points, and the assets they might target in your organisation. It helps you prioritise defences where attackers are most likely to strike. Threat modelling is the foundation of strategic security planning.

A vulnerability report is a detailed list of security flaws discovered on your devices, typically grouped by severity, system, or application. It shows what is broken, where, how bad each issue is, and what the impact would be if exploited. It drives your patching and remediation priorities.

An executive report is a high-level security summary designed for non-technical decision makers and business leaders. It translates technical findings into business impact: risk level, key vulnerabilities, remediation costs, and strategic recommendations. It focuses on decisions, not technical detail.

A technical report is an in-depth security assessment aimed at IT teams and security professionals. It contains detailed vulnerability data, affected systems, affected configurations, attack vectors, and specific remediation steps. It is the operational guide for fixing issues.

A compliance report documents whether your organisation meets regulatory or industry security standards (such as Cyber Essentials, GDPR, or NIST). It maps security controls to requirements, highlights gaps, and shows evidence of compliance. It is essential for audits, certifications, and customer trust.

An incident timeline is a chronological record of events during a security incident: when it was discovered, who was notified, what actions were taken, and when the incident was resolved. Accurate timelines are critical for investigations, legal liability, and learning lessons.

Root cause analysis is the process of investigating why a security incident occurred, tracing back through the chain of events to identify the underlying cause rather than just the symptom. Understanding root causes prevents similar incidents and guides your remediation strategy.

A DORA compliance report assesses your organisation against the Digital Operational Resilience Act requirements, which mandate strong cybersecurity practices for financial services firms. It evaluates your ability to detect, prevent, and recover from IT incidents and demonstrates resilience to regulators.

Severity classification is the process of grading security issues by how damaging they would be if exploited, typically on a scale from critical to low. Severity guides remediation urgency: a critical flaw in a payment system requires faster action than a low risk in a non-critical device.

An impact assessment evaluates the potential business damage if a security vulnerability is exploited: data loss, downtime, financial loss, reputation harm, or regulatory penalties. It informs which risks are tolerable and how much investment in defence is justified.

A likelihood assessment estimates the probability that a known vulnerability will actually be exploited by a real attacker. It considers factors like how well-known the vulnerability is, whether working exploits exist, and how easy it is to execute. High likelihood plus high impact equals top priority.

A Key Risk Indicator (KRI) is a metric that signals emerging security risks before they become serious problems. Examples include unpatched device count, critical vulnerability age, or failed security control checks. KRIs let you act early rather than reacting to incidents.

A risk register is a living document that records all known risks to your organisation: their description, owner, current status, mitigation plan, and review date. It provides visibility across the business and ensures risks are tracked, monitored, and acted upon consistently.

An Identity Provider (IdP) is a system that creates and verifies user identities, then issues authentication credentials for access to applications and services. In your business, your IdP (such as Azure AD or Okta) is the central authority confirming who you are before you can access apps, data and resources.

Azure Active Directory (now called Microsoft Entra ID) is Microsoft's cloud-based identity and access management service. It authenticates users and controls their access to Microsoft applications, third-party SaaS tools and on-premises resources for organisations of any size.

Okta is a third-party cloud identity provider that authenticates users and manages access across applications and data. Many organisations use Okta as a centralised login system covering both cloud apps and on-premises systems without relying on a specific vendor.

Google Workspace is Google's cloud-based productivity suite (Gmail, Docs, Drive, Meet) with built-in identity and access management. It provides centralised authentication, device security policies and control over user access to organisation files and applications.

Multi-Factor Authentication requires users to prove their identity with two or more separate methods, such as a password plus a code from a mobile app or security key. MFA dramatically reduces the risk of account breach, even if a password is stolen, and is recommended by the NCSC.

Single Sign-On allows users to authenticate once with one set of credentials and gain access to multiple applications and systems without logging in again. It saves users time and makes security management easier by centralising access control across your organisation.

SAML (Security Assertion Markup Language) is a standard protocol that enables single sign-on by securely passing authentication information between your identity provider and applications. It is widely used in enterprise software and SaaS tools, simplifying integration with your existing systems.

OAuth 2.0 is a standard protocol that allows users to grant third-party applications permission to access their data without sharing their password. It powers 'Sign in with Google' and similar integrations, keeping passwords secure whilst enabling convenient access.

Access Control is the practice of deciding who can do what with your systems, data and resources. It involves authentication (confirming identity) and authorisation (granting specific permissions), and is central to keeping your organisation secure and compliant.

Role-Based Access Control grants permissions based on job roles rather than individual user names. For example, all accountants might have a 'Finance Role' that permits access to payroll software. RBAC scales easily and reduces administrative effort as your organisation grows.

Privileged Access Management is a security practice that controls, monitors and restricts high-level system access given to administrators and service accounts. PAM reduces the risk of insider threats and helps meet compliance requirements including Cyber Essentials.

Least Privilege means giving users only the minimum access rights they need to do their job, nothing more. It is a key security principle endorsed by the NCSC and Cyber Essentials that limits damage if an account is compromised.

A User Account is an identity created for a person in your organisation, with a unique username, password and assigned permissions. It allows that person to log in, access approved resources and be audited for security and compliance purposes.

A Service Account is a non-human identity used by applications or services to authenticate and perform automated tasks. Service accounts often have elevated permissions and must be carefully protected; regular credential rotation and monitoring are essential.

A Machine Account is an identity assigned to a device or server (rather than a person) to authenticate with networks and services. In Active Directory, every domain-joined computer has a machine account used to verify the device's identity securely.

Active Directory is Microsoft's on-premises system for managing user accounts, permissions and device access across a Windows network. It centralises identity management, group policies and security controls for organisations of all sizes.

LDAP (Lightweight Directory Access Protocol) is a standard protocol that applications use to query and authenticate users against a directory server such as Active Directory. Many business systems rely on LDAP to verify user identities and manage group memberships.

A Password Policy is a set of rules governing how passwords must be created and managed (length, complexity, expiry, history). Strong policies reduce breach risk; Cyber Essentials requires minimum standards for password strength and regular changes.

A Credential is any proof of identity such as a password, API key, certificate or security token. Credentials must be kept secret; if exposed, attackers can impersonate that user or service and access sensitive systems.

A Token is a digital credential issued after successful authentication, usually valid for a set time period. Tokens (such as JWT or OAuth tokens) allow systems to confirm a user is logged in without re-entering a password on every action.

Cloud infrastructure is computing power, storage and networking delivered over the internet by a provider, paid for on demand rather than owned outright. Instead of servers in your office, you rent hardware and systems remotely, scaling up or down as your business needs change. You access everything through a web browser or API, cutting capital costs and freeing your IT team from hardware maintenance.

Amazon Web Services (AWS) is the market-leading cloud platform providing compute, storage, databases and over 200 other services globally. It powers everything from startup websites to enterprise systems. Most businesses using 'the cloud' run at least some workloads on AWS; it offers flexibility, scale and a pay-as-you-go pricing model.

AWS Lambda is a serverless compute service that runs code without you managing servers. You upload a function, set a trigger (an API call, a file upload, a schedule), and Lambda executes it instantly, charging only for the milliseconds used. No provisioning, patching or idle costs—perfect for event-driven tasks that don't need to run constantly.

API Gateway is AWS's service for creating and managing application programming interfaces (APIs) that sit between your users and your backend services. It handles security, rate limiting, caching and request routing, letting you publish REST or HTTP APIs without building infrastructure. Clients call the gateway URL; the gateway forwards requests to your backend code.

A cloud API is a web interface that lets applications talk to cloud services like AWS, Azure or Google Cloud over the internet. Instead of installing software, your code makes HTTP requests to an API endpoint and gets back data or triggers actions. APIs are the standard way modern apps integrate cloud services—fast, reliable and version-controlled.

A REST (Representational State Transfer) API is a common style of web API using standard HTTP methods—GET to read, POST to create, PUT to update, DELETE to remove. Resources are identified by URLs ('example.com/devices/123'). REST is stateless, cacheable and language-agnostic, making it the de facto standard for cloud services and third-party integrations.

OData (Open Data Protocol) is a standard for querying and updating data over HTTP, extending REST with rich filtering, sorting and pagination via URL query syntax. Instead of fixed API endpoints, clients build queries dynamically—'?$filter=name eq "Server"&$orderby=risk desc'. It reduces API fragmentation and speeds up client development.

Microservices is an architecture where a large application is built as a collection of small, independent services, each owning a specific domain (user management, billing, scanning). Services talk via APIs; each can scale, deploy and fail independently. Contrast to monoliths, where one code change risks the whole system. Microservices cost more to operate but offer agility.

Serverless means your code runs on cloud infrastructure without you managing or provisioning servers. You write functions, upload them, set triggers, and the cloud platform handles scaling, patching and availability. You pay only for execution time. 'Serverless' is misleading—servers still exist—but you're freed from their management.

A container is a lightweight, portable package bundling your application code, runtime and dependencies into a sealed unit that runs identically on any machine. Containers are smaller and faster than virtual machines; Docker is the standard container format. DevOps teams use containers to ensure code works the same in development, testing and production.

A virtual machine (VM) is a software-emulated computer running inside physical hardware, with its own operating system, storage and network interface. Multiple VMs can run on one physical machine. VMs are flexible and isolated, letting you run Windows, Linux or other OSes side by side. Public clouds sell VMs by the hour.

Bare metal means physical hardware with no virtualisation layer—you rent or own an entire server, not a slice of one. Bare metal offers maximum performance, lowest latency and full OS control, but costs more and takes longer to provision. It suits workloads like databases, high-frequency trading or compliance-sensitive systems needing dedicated resources.

Hybrid cloud is a mix of public cloud (AWS, Azure, Google Cloud) and private infrastructure (on-premises servers or private cloud). A business might keep sensitive data on premises and burst workloads to public cloud during peaks. Hybrid offers flexibility and cost control but adds complexity—you must manage identity, networking and data consistency across both.

Public cloud means infrastructure owned and operated by a third party—AWS, Microsoft Azure, Google Cloud—and shared across many customers over the internet. You pay for what you use. Public cloud offers scale, reliability and low upfront cost, but you surrender physical control and must trust the provider's security and availability.

Private cloud is virtualised infrastructure dedicated to one organisation, either hosted on premises or managed by a provider exclusively for your use. You get cloud automation and elasticity while keeping data and control in-house. Private cloud costs more than public cloud but suits regulated industries and organisations with strict data residency needs.

Cloud security is the discipline of protecting data, applications and infrastructure in cloud environments. It covers identity and access control, encryption in transit and at rest, network isolation, threat detection and compliance. Responsibility is shared: the cloud provider secures the platform, you secure your configurations, code and access policies.

Data residency is the requirement that data be stored in a specific geographic location or country, often for regulatory compliance. The UK's ICO expects personal data to stay within the UK unless you meet strict conditions. Cloud providers offer regional options—AWS eu-west-1 is Ireland, eu-west-2 is London. Choosing the right region matters for compliance and latency.

Data sovereignty is the principle that data is subject to the laws of the country where it is stored, regardless of where you are. Storing data in the USA subjects it to US law and potential US government requests. The EU's GDPR, UK's GDPR-lite and other frameworks restrict where data of citizens can be processed. It's a legal and regulatory concern, not just technical.

Tenant isolation is the security guarantee that one customer's data and systems are completely separated from another's in a shared cloud environment. A public cloud provider's infrastructure runs thousands of tenants; isolation ensures your VM, storage and database are invisible to and unreachable by others. It's enforced at the hypervisor, network and database layers.

Multi-tenancy is an architecture where a single instance of software or cloud service serves many customers (tenants) simultaneously, each with isolated data and configurations. Contrast to single-tenancy, where each customer gets their own isolated instance. Multi-tenancy is cost-efficient and easier to update, but adds complexity in isolation and compliance management.

Encryption is the process of converting readable data into coded form using mathematical algorithms so only authorised parties with the correct key can decode it. It protects sensitive information on your devices and networks from unauthorised access. Use it to safeguard customer data, financial records, and intellectual property.

Encryption at rest protects data stored on physical media such as hard drives, laptops, and servers by keeping it encoded when not actively used. Ensures your files remain unreadable if a device is stolen or hard drive accessed directly. Essential for protecting databases, backups, and file stores in your business.

Encryption in transit scrambles data as it moves between devices, across networks, or to the cloud so attackers cannot intercept it. Protects emails, file transfers, API calls, and web traffic from eavesdropping. Required for any sensitive information travelling over the internet or internal networks.

AES (Advanced Encryption Standard) is a widely-used encryption algorithm adopted by governments and organisations worldwide to protect confidential data. It is fast, secure, and suitable for encrypting files, databases, and communications. The standard choice for most business encryption needs today.

AES-256 is the strongest variant of AES, using a 256-bit encryption key that would take millions of years to crack with current technology. Recommended for protecting your most sensitive data like trade secrets and personal records. Meets military-grade and high-compliance security standards.

TLS (Transport Layer Security) is a protocol that encrypts communication between your device and a website or application server. Prevents eavesdropping and data tampering during transmission. Look for the padlock icon in your browser address bar to confirm a site uses TLS.

HTTPS is the secure version of the web protocol HTTP, using TLS encryption to protect data sent to and from websites. Required for online banking, email, and any site handling personal or payment information. Always verify sites you visit use HTTPS before entering sensitive details.

PKI is a system that uses pairs of mathematically-linked keys (public and private) to encrypt communications and verify identities across networks. One key encrypts, only the matching private key decrypts. Forms the trust foundation for SSL certificates, secure email, and digital signatures.

A certificate is a digital document issued by a trusted authority that verifies the identity of a device, person, or organisation. Contains a public encryption key and identity details. Used to establish secure connections and prove you are communicating with the legitimate business or service.

An SSL/TLS certificate is a digital credential installed on a web server that encrypts traffic between your browser and the site, proving the organisation's identity. Essential for e-commerce, login pages, and any form processing. Expired or invalid certificates should trigger a security warning in your browser.

Data Loss Prevention is a set of tools and policies that monitor, restrict, and log the movement of sensitive data across your network and devices. Prevents employees accidentally emailing confidential files or uploading to unauthorised cloud services. Integral to protecting trade secrets and customer information.

Database encryption converts the contents of your databases into unreadable form, protecting customer records, financial data, and business intelligence even if someone gains unauthorised access. Can encrypt entire databases or individual columns depending on sensitivity. Standard requirement for compliance frameworks like Cyber Essentials.

Tokenization replaces sensitive data like payment card numbers with non-sensitive tokens that have no mathematical relationship to the original. Allows your business to process transactions without storing dangerous information. Reduces breach risk and compliance burden if your systems are compromised.

Hashing converts data into a fixed-length string of characters using a one-way mathematical function that cannot be reversed to recover the original. Used to verify passwords, detect tampering, and store credentials securely. Unlike encryption, hashed data cannot be decrypted even with the correct key.

Salting adds random data to a password before hashing, making identical passwords produce different hashes and defeating lookup attacks. Prevents attackers from recognising common passwords even when password files are stolen. Standard practice for secure password storage in modern systems.

Key management is the practice of securely generating, storing, rotating, and retiring encryption keys across your organisation. Poor key management—such as sharing keys or using static passwords—undermines even strong encryption. Requires documented processes and controlled access to key storage systems.

A Hardware Security Module is a specialised appliance that generates, stores, and manages encryption keys in a tamper-resistant vault outside your regular networks. Provides the highest level of key protection for regulated industries like finance and healthcare. Essential when encryption keys must never leave physical security.

Secure deletion overwrites data multiple times with random patterns before freeing storage space, making recovery impossible even with forensic tools. Standard practice when decommissioning devices or retiring backup media. Simple file deletion leaves data intact on the disk and vulnerable to recovery.

A backup is a copy of your data stored separately from the original so you can recover from accidental deletion, hardware failure, or ransomware attacks. Critical for business continuity; follow the 3-2-1 rule: three copies, two storage types, one offsite. Test restores regularly to confirm backups work.

Disaster recovery is a documented plan and tested procedures to restore critical systems and data after a major outage, cyberattack, or physical disaster. Includes backup procedures, recovery time targets, and communication plans. Essential for protecting your business reputation and meeting customer expectations during emergencies.

Security monitoring is the continuous observation of your systems, networks, and devices for signs of unauthorised access or malicious activity. It involves tracking user behaviour, system events, and network traffic to detect threats early. Most SMBs should automate this rather than watching logs manually—modern tools flag suspicious patterns automatically.

A Security Operations Centre is a team or facility that monitors, detects, and responds to security incidents across your organisation. Large enterprises staff SOCs 24/7; SMBs typically outsource this or use managed SOC services. The core job: watch alerts, investigate threats, coordinate response, and post-incident review.

Continuous monitoring means running security checks and threat detection every day, every hour, or in real-time rather than on a schedule. It replaces manual spot-checks with always-on automation. For SMBs, this is essential because threats don't wait for your annual audit.

Log monitoring is the automated review of event logs—records generated by your systems, applications, and security tools. A log monitoring system collects these records, searches them for suspicious patterns, and raises alerts. This catches failed logins, privilege escalations, and suspicious downloads before they become incidents.

Event logging is the process of recording significant actions on your devices and systems—user logins, file access, configuration changes, errors. Every operating system and application generates logs. Proper event logging is a baseline requirement for incident investigation and regulatory compliance.

An audit log is a detailed record of who did what, when, and on which system—typically immutable for compliance. Unlike general event logs, audit logs are designed for legal accountability and regulatory proof (GDPR, PCI-DSS, etc.). Organisations must retain them for defined periods and review them regularly.

A SIEM (Security Information and Event Management) tool aggregates logs and alerts from all your devices, networks, and applications into one central dashboard. It correlates events to detect complex attacks that individual logs might miss. Enterprise SIEMs are expensive; SMBs often start with simpler log aggregation or managed SOC tools.

An alert is a notification that a security tool has detected something suspicious or noteworthy—a malware signature match, an unusual login pattern, a patch missing. Alerts should be timely and actionable. Too many low-priority alerts ('alert fatigue') cause genuine threats to be ignored.

An alert threshold is a limit or rule that triggers an alert—for example, 'three failed logins in 10 minutes' or 'CPU above 85%'. Setting thresholds well is critical: too low causes false alarms; too high misses real threats. Thresholds must be tuned to your normal business operations.

Anomaly detection uses machine learning or statistical analysis to spot unusual behaviour—login at 3am from a new country, suddenly large file transfers, or a user accessing data they normally ignore. It flags deviations from baseline without requiring predefined threat signatures. Useful for insider threats and zero-day detection.

A baseline is your organisation's normal security posture and user behaviour—the standard you measure against. For example, 'users in Finance normally log in 08:00–18:00 UK time' or 'all Windows devices should have Windows Defender enabled'. Deviations from baseline trigger alerts. Build baselines from historical data.

An alerting rule is the logic that decides when to raise an alert—typically an if-then statement like 'if malware signature X matches a file, then alert with high priority to the security team'. Rules must balance sensitivity (catch threats) with specificity (avoid false alarms). Review and tune rules regularly.

An on-call schedule assigns team members responsibility for responding to security alerts outside normal working hours. It ensures someone is always reachable for critical incidents. SMBs may rotate on-call among a few staff or use a managed service; larger teams use scheduling tools to automate escalation.

Incident management is the structured process of detecting, investigating, containing, and recovering from a security breach. It involves clear roles (incident commander, communications lead, technical lead), a timeline, and post-incident review. A written incident response plan is a Cyber Essentials baseline for SMBs.

Mean Time to Detect is the average time between when a security incident occurs and when you notice it. For example, if three breaches took 2, 4, and 6 hours to spot, your MTTD is 4 hours. Shorter MTTD (ideally minutes, not days) limits attacker dwell time and damage. Continuous monitoring reduces MTTD significantly.

Mean Time to Respond is the average time from when you detect an incident to when your team begins containment actions. A quick response (minutes to hours, not days) prevents spread. This metric measures your readiness, team capability, and tooling quality. SLAs often target MTTR under 4 hours for critical incidents.

Mean Time to Resolution is the average duration from incident detection to full recovery—systems restored, threat removed, post-incident review complete. It includes detection time, response time, and remediation time. This metric reflects your overall incident handling maturity. Target <24 hours for critical issues; track it over quarters to see improvement.

Uptime is the proportion of time your systems are running and accessible to authorised users—measured as a percentage (e.g. 99.9%). It excludes planned maintenance. High uptime is critical for business continuity. SMBs should target 99% or better; aim for redundancy and rapid failover to meet it.

Availability is the extent to which your systems, applications, and services are accessible when needed. It is influenced by uptime, performance, reliability, and disaster recovery capability. High availability requires investment in backup infrastructure, redundancy, and failover processes. It is a foundational element of business resilience.

Performance monitoring tracks how fast and efficiently your systems operate—CPU, memory, disk, network latency, application response times. It helps you spot bottlenecks, capacity limits, and resource exhaustion before they cause downtime. SMBs should monitor critical systems and applications daily; many use cloud platform dashboards for this.

A virtual Chief Security Officer is an automated advisory service that delivers security strategy, vulnerability prioritisation and risk reporting without requiring a full-time security executive. For small to mid-sized teams, a vCSO acts as your strategic security partner, continuously monitoring threats, recommending actions, and producing compliance-ready reports aligned to standards like Cyber Essentials.

Artificial Intelligence refers to computer systems designed to perform tasks that typically require human judgment, such as recognising patterns, making predictions or optimising decisions. In cybersecurity, AI identifies anomalies, predicts likely attacks and prioritises which vulnerabilities pose genuine risk to your business rather than drowning you in alerts.

Machine Learning is a type of artificial intelligence where systems automatically improve by learning from data rather than following explicit programmed rules. In security, ML models learn from thousands of devices and vulnerability patterns to spot emerging threats, predict which bugs will be actively exploited, and recommend fixes your peers in similar roles have found most effective.

Predictive analysis uses historical data and statistical models to forecast future events or outcomes with measurable probability. In vulnerability management, predictive analysis anticipates which known flaws are likely to be attacked soon, which will spread fastest through your network, and where remediation effort will yield the greatest reduction in business risk.

An automated response is a pre-defined action the system executes immediately when a security condition is met, without waiting for human approval. For example, isolating a device showing signs of compromise, disabling a compromised account, or blocking traffic from a known malicious IP. Automated response cuts incident response time from hours to seconds.

Remediation automation uses security tools to automatically fix or mitigate vulnerabilities and misconfigurations across your entire estate without manual patching or configuration changes. Rather than asking staff to manually deploy every update or firewall rule, the system applies fixes consistently and at scale across hundreds or thousands of devices.

Security orchestration connects separate security tools and processes so they communicate automatically, share threat intelligence, and execute co-ordinated responses without manual handoffs. For small teams stretched thin, orchestration means your firewall, antivirus, patch tool and monitoring platform work as a unified system, not isolated silos requiring constant manual sync.

Workflow automation uses rules and triggers to automatically execute sequences of security or administrative tasks, reducing manual steps and human error. For example, when a vulnerability is discovered, the workflow automatically assigns it to the right team, creates a ticket, schedules a remediation window, and confirms when the fix completes.

A rule engine is software that evaluates conditions ("if this happens") and triggers corresponding actions ("then do that") based on logic you define. In cybersecurity, a rule engine lets you codify your security policies—for example, 'if a device has an unpatched critical CVE AND it touches customer data, then isolate it'—and enforce them automatically across your entire network.

A policy engine is the system component that enforces your organisation's security policies—such as password complexity, device encryption, firewall rules or approval workflows—consistently across all devices and users. Rather than relying on individuals to remember and follow policies, the engine audits, enforces and reports on compliance automatically.

Conditional logic is 'if-then' reasoning that lets you specify when an action should trigger based on one or more conditions. For example, 'if device is missing a critical patch AND device has not been patched this month, then apply the patch outside business hours'. Conditional logic lets you write sophisticated security rules without coding.

A threshold is a pre-set boundary or limit that, once crossed, triggers an action or alert. For example, 'remediate unpatched critical vulnerabilities if more than 10% of devices are affected', or 'alert if failed login attempts exceed 5 per minute'. Thresholds filter noise, so you react only to genuine problems rather than every minor incident.

Scheduling lets you specify when security actions run—exact dates and times, specific days of the week, or recurring intervals. Rather than applying patches or scans immediately and risking business disruption, you schedule them for weekends, after hours, or during planned maintenance windows your team controls.

Cadence is the frequency or rhythm at which a recurring activity happens—daily, weekly, monthly. For security, cadence defines how often you scan for vulnerabilities, check for compliance drift, run automated backups or refresh threat intelligence. A tighter cadence catches problems faster; a relaxed cadence reduces tool load but accepts more risk.

A budget constraint is a limit on resources (money, computing power, staff time) that bounds how much security work can be done. For example, 'remediate only high and critical vulnerabilities this quarter because we lack staff to patch everything'. Budget constraints force prioritisation so you focus remediation on the highest-impact work.

A maintenance window is a scheduled period—usually nights or weekends—when you allow systems to be taken offline, restarted or updated without impacting business. Security teams use maintenance windows to apply patches, updates and configuration changes that might disrupt user work if done during business hours.

Business hours are your organisation's normal operating times when most staff are working and systems are serving customers. Security tools avoid deploying updates, running heavy scans or triggering automated restarts during business hours to prevent user impact and keep productivity high.

Off-peak refers to times outside normal business hours—nights, weekends, holidays—when staff are not actively using systems and business impact is minimised. Security teams schedule resource-heavy tasks like full scans, large patch deployments and backups during off-peak periods to avoid slowing down user devices during working hours.

Zero Trust is a security approach that assumes no device, user or network should be trusted automatically, even if previously verified. Instead, every access request is challenged with up-to-date proof of identity, device health and permission. Zero Trust reduces breach impact because compromising one credential or device does not grant an attacker free rein across your network.

Security analytics is the process of examining security data—logs, events, scan results, threat intelligence—to discover patterns, anomalies and evidence of compromise. Analytics transforms raw security data into actionable insights: which devices are highest-risk, which vulnerabilities are most critical, where threat activity is clustering, and what to fix first.

CyberHeal is RoboShadow's automated remediation engine that automatically applies security fixes to your devices without manual intervention. It handles patching, configuration corrections, policy enforcement, and malware removal, turning weeks of manual remediation work into overnight automated fixes. You define rules and CyberHeal executes them, freeing your team for higher-value work.

RoboGuard is RoboShadow's external vulnerability scanning orchestration service that schedules recurring scans of your internet-facing assets from an attacker's perspective. It discovers exposed services, misconfigurations, and vulnerabilities without requiring agent software, and integrates IP thresholds so you can scale scanning effort by risk. It's your early warning system for what attackers can see.

RoboAI refers to RoboShadow's machine learning capabilities that prioritise vulnerabilities by real-world exploit probability and your specific business context. Rather than overwhelming you with a list of every flaw, RoboAI learns from your environment to surface the threats most relevant to you. It predicts which vulnerabilities are worth your remediation effort now.

vCSO Reports are executive-level security dashboards in RoboShadow that summarise your organisation's vulnerability posture, remediation progress, and compliance status in language business leaders understand. They highlight trends, compare you to security benchmarks, and flag board-level risks without technical jargon. Ideal for showing the board what you've fixed and what still needs attention.

LAN Scanner is RoboShadow's internal network discovery tool that maps all devices connected to your local area network automatically, from desktops and laptops to printers, IoT equipment, and rogue hardware. It identifies operating systems, installed software, and open ports so you know exactly what's on your network. Unmanaged or forgotten devices often pose compliance and security risk.

Agent-based scanning uses software installed on your devices to scan from the inside, delivering deep visibility but requiring installation overhead. Agentless scanning inspects devices remotely from your network without installing software. External scanning probes your systems from the internet as an attacker would. Each approach has strengths; combining all three gives you complete coverage and validates findings across methods.

Benchmarks in RoboShadow are standardised compliance and security reference frameworks such as Cyber Essentials, PCI DSS, ISO 27001, NIST, HIPAA, and SOC 2 that your organisation must meet. RoboShadow's benchmark reports show which controls you're meeting, where gaps exist, and what steps close them for audits and certifications. Benchmarks let you measure security objectively.