Glossary

Security products are sold in vocabulary. These are the words that recur, defined in the sense they actually carry — including the several that are routinely used to imply more than they mean.

27 terms, alphabetical. Where a definition matters enough to deserve a longer treatment, it links to the guide that gives it one.

Adware

Software whose purpose is to display advertising, often installed alongside something else the user actually wanted. It sits on the boundary of malware: it may do nothing destructive while still degrading the machine and reporting behaviour to a third party.

Behavioural monitoring

A detection layer that watches what a program does once it is running — rewriting many files at speed, injecting into another process, deleting shadow copies — rather than examining the file beforehand. It is what stops malware families nobody has catalogued yet, because the behaviour is the signature.

Brute-force attack

Trying enormous numbers of candidate passwords until one works. It is defeated less by complexity rules than by length, by rate limiting at the service, and by a second factor.

Cloud reputation

A check in which the security product asks the vendor's network what is known about a specific file: how widely it has been seen, how old it is, how it behaved elsewhere. Effective against brand-new files, and the layer with the clearest privacy implications, because file metadata leaves your machine.

Credential stuffing

Taking username and password pairs from one breach and trying them automatically at many other services. It works only because passwords are reused, which is why a password manager addresses a risk no scanner can reach.

Drive-by download

A compromise that needs no download on the user's part: visiting a page is enough, because a flaw in the browser or a plug-in is exploited on arrival. The defence is patching and exploit mitigation, not caution about clicking.

Exploit

Code that takes advantage of a specific flaw in software to make it do something it should not, typically to gain execution. An exploit is the way in; malware is usually what comes through afterwards.

Exploit mitigation

Blocking the general techniques exploitation relies on, rather than the individual flaw. It buys time between a flaw being discovered and being patched. It does not fix the flaw — only the software vendor's update does that.

False positive

A harmless file wrongly identified as malicious. Measured by testing laboratories under the heading “usability”. A high rate matters more than it sounds, because it trains the user to dismiss warnings.

Firewall

A control on network traffic. Operating systems ship an inbound firewall by default. What a paid suite usually adds is outbound control: deciding which programs on your machine are allowed to talk out.

Heuristics

Judging a file by its structure and characteristics rather than by an exact match — packing, obfuscation, unusual imports, a document containing a macro that contacts the network. Catches variants of known families; also the layer most likely to produce a false positive.

Keylogger

Software that records keystrokes in order to capture passwords, card numbers and messages. A password manager's autofill reduces, but does not eliminate, the exposure.

Macro

A small program embedded in a document. Legitimate in office work and a long-standing malware carrier, which is why current office software disables macros from the internet by default and why a document asking you to enable them deserves suspicion.

Malware

The umbrella term for software written to act against the interests of the person running it: ransomware, spyware, banking trojans, keyloggers, cryptocurrency miners and more. “Virus” is one old subcategory that the industry kept as a brand name.

Passkey

A sign-in credential stored on your device and unlocked by the device itself — by fingerprint, face or PIN — rather than a secret you type. Because nothing reusable is transmitted, a passkey cannot be phished in the way a password or a typed one-time code can.

Password manager

An encrypted vault that generates and stores a different password for every service. It addresses reuse, which is the single most exploitable habit in consumer security, and it is a genuine reason to consider a suite that bundles one.

Patch

A vendor update that fixes a flaw. Automatic updates are the highest-value, lowest-effort security measure available to a home user, and they close a route that no scanner closes.

Phishing

A message designed to make you hand over a secret or authorise a payment, by imitating an organisation you trust. It targets judgement rather than software, which is why it survives every technical defence. See our guide to recognising it.

Quarantine

Where a security product puts a file it considers dangerous: isolated rather than deleted, with a restore option. The restore option is why a false positive is an inconvenience rather than a disaster.

Ransomware

Malware that encrypts your files and demands payment for the key. It is the threat most used to sell security software and the one where software alone helps least, because once encryption completes no product can undo it. Recovery depends on a backup the attack could not reach.

Sandbox

A restricted environment in which a program runs with limited access to the rest of the system. Used both by operating systems to contain applications and by security products to observe suspicious files safely.

Signature

A fingerprint of known-bad code. Fast and exact, with almost no false positives, and useless against anything the vendor has not seen before — which is why signatures are now one layer of several rather than the whole product.

Smishing

Phishing delivered by SMS or a messaging app. The mechanics are identical to e-mail phishing; the links are harder to inspect on a phone, which is the point.

Social engineering

Manipulating a person into doing something against their own interest — the category that includes phishing, fake support calls and invoice fraud. Public reporting from ENISA and Europol consistently ranks it among the dominant routes of attack.

Two-factor authentication (2FA / MFA)

Requiring a second piece of evidence besides the password: a code from an app, a passkey, or a hardware key. It is what turns a stolen password into a failed sign-in. App-generated codes and hardware keys are materially stronger than codes sent by SMS.

VPN

An encrypted tunnel between your device and a server run by the VPN provider. It hides your traffic from the local network and your address from the site you visit. It does not scan for malware, does not make you anonymous, and is frequently, wrongly, assumed to be bundled with entry-level antivirus tiers.

Zero-day

A flaw being exploited before a fix exists, so that defenders have had zero days to patch. Behavioural monitoring and exploit mitigation are the layers aimed at this case, since signatures by definition cannot be.

If a term you met in a product description is missing here, tell us at [email protected] and we will add it. How definitions are sourced is described in how we research.