Security glossary
Plain definitions of the terms that appear in security marketing, written so that you can tell which of them describe something you need. No commercial links on this page.
Adware
Software that displays advertising you did not ask for, often bundled with a free download. Usually more of a nuisance than a danger, but it frequently arrives alongside things that are worse.
Behavioural detection
Judging a program by what it does once running — encrypting files in bulk, editing startup entries, contacting unusual addresses — rather than by what it is. The layer most likely to catch something genuinely new, and the one that can only act after execution has begun.
Botnet
A network of compromised machines controlled remotely and rented out, typically for spam, credential stuffing or denial-of-service attacks. An infected machine in a botnet often shows no symptom at all to its owner.
Credential stuffing
Taking username and password pairs from one breach and trying them automatically on hundreds of other services. It works only because people reuse passwords, which is why a password manager is a security measure and not a convenience.
Definition / signature
A fingerprint of a known piece of malware. Fast and precise for what it covers, and useless against anything not yet catalogued. Still present in every product, but no longer the main line of defence.
Drive-by download
Malware delivered by merely visiting a compromised or malicious page, with no click required, by exploiting a flaw in the browser or a plug-in. Keeping the browser updated is the main defence.
Endpoint
Industry term for a device that connects to a network — a laptop, a phone, a server. “Endpoint protection” is the business-facing name for what consumers call antivirus.
Exploit
Code that takes advantage of a specific flaw in software to make it behave in a way it was not meant to. An exploit is the means of entry; what it then installs is the payload.
False positive
A clean file wrongly flagged as malicious. Worth watching in laboratory results: an aggressive product can score well on detection while quarantining software you depend on.
Firewall
A filter deciding which network connections a machine may accept and make. Modern operating systems include one; a suite’s firewall typically adds per-application control and a friendlier interface.
Hash
A short fixed-length fingerprint computed from a file. Two identical files produce the same hash, and the file cannot be reconstructed from it. Reputation lookups send the hash rather than the file.
Heuristics
Detection based on suspicious structure or code patterns rather than an exact match, which catches repacked variants of known families at the cost of some false positives.
Keylogger
Software that records what you type, usually to capture passwords and card numbers. Often a component of a broader information stealer rather than a product in itself.
Malware
The umbrella term for hostile software: viruses, worms, trojans, ransomware, spyware, stealers and the rest. “Virus” is a specific old subtype that ordinary usage has stretched to cover everything.
Patch
A vendor’s fix for a flaw. Applying patches promptly closes far more real-world attack routes than any product feature, because much successful attack activity uses vulnerabilities that were patched months or years earlier.
Phishing
A message engineered to make you hand over credentials or money, usually by impersonating an organisation you trust and creating urgency. Spear phishing is the same thing researched and aimed at one specific person.
Ransomware
Malware that encrypts your files and demands payment for the key. Once encryption is complete, no antivirus reverses it; recovery depends on a backup made beforehand and kept out of reach.
Real-time protection
Scanning that happens continuously as files are written, opened and executed, as opposed to a scheduled scan of the whole disk. It is the part that matters most, and the part that is disabled when someone turns protection off to install something questionable.
Reputation lookup
Asking the vendor’s servers how old and how widespread a particular file is across its user base. A binary first seen minutes ago on a handful of machines is treated very differently from one installed millions of times over years.
Sandbox
An isolated environment in which suspicious code can be run and observed without reaching the real system. Used both inside security products and by operating systems to confine applications.
Social engineering
Manipulating a person rather than defeating a machine. Most successful consumer compromises begin here, which is why no amount of software fully removes the risk.
Trojan
Malware disguised as something you wanted — a cracked application, a codec, an invoice. The name describes the delivery method, not what the payload does.
Two-factor authentication (2FA)
A second proof of identity beyond the password, such as a code from an app or a hardware key. App-based and hardware factors resist interception far better than codes sent by SMS.
VPN
A service that encrypts your traffic and routes it through the provider’s server, hiding it from the local network and from your internet provider. It does not stop malware, and it moves your trust from your network operator to the VPN operator rather than removing the need to trust anyone.
Zero-day
A vulnerability being exploited before the vendor has released a fix — there are zero days of warning. Signature-based detection is structurally blind to these, which is the argument for behavioural layers.
Definitions are written for a general reader and are deliberately non-technical; they are not standards definitions. Where a vendor uses one of these words to mean something specific to its own product, that vendor’s definition governs its own terms. Suggest an addition or a fix: info@zlatenis.online.