Security glossary in plain English
Plain-English definitions of the security terms in your CyberVigil report and our guides, from DMARC and SPF to HSTS, phishing and ransomware.
This glossary explains the security terms you'll see in your CyberVigil report and across our guides, in plain English first and technical detail second. Each entry covers what the term means, why it matters to a small business, and what to do next, with links to the matching free checker or fix guide where one exists.
Terms A to Z
- Business email compromise
- Business email compromise (BEC) is a scam in which criminals hack or impersonate a business email account to trick employees, customers or vendors into sending money or sensitive information.
- DKIM
- DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email. Receiving servers check it against a public key in your DNS to confirm the message came from your domain and wasn't altered.
- DMARC
- DMARC is an email standard that lets a domain owner tell receiving mail servers how to handle messages that fail SPF and DKIM checks, and ask for reports about email sent using the domain.
- HSTS
- HSTS (HTTP Strict Transport Security) is a response header that tells browsers to connect to a website only over HTTPS for a set period, and to block visitors from bypassing certificate errors.
- MFA
- Multifactor authentication (MFA) is a sign-in method that requires two or more different kinds of proof, such as a password plus a code from your phone, before granting access to an account.
- Phishing
- Phishing is a scam in which criminals pose as a trusted person or company in an email, text or website to trick people into clicking harmful links, opening attachments, or sharing passwords or payment details.
- Ransomware
- Ransomware is malicious software that encrypts a device's files, making them and the systems that rely on them unusable, after which criminals demand a ransom in exchange for decryption.
- Security headers
- Security headers are HTTP response headers a website sends to browsers with each page, instructing them to enforce HTTPS, block framing, and restrict risky behavior. They help reduce common web attacks.
- SPF
- SPF (Sender Policy Framework) is a DNS record that lists the mail servers and services allowed to send email for your domain, so receiving providers can spot messages sent from anywhere else.
- SSL certificate
- An SSL certificate (technically a TLS certificate) is a digital file, signed by a trusted certificate authority, that proves a website's identity and lets browsers set up an encrypted HTTPS connection.
Security has a lot of acronyms. This glossary translates them into plain English so you can read your report, answer an insurance question, or follow a fix guide without searching for every term. Entries are short on purpose.
How is this glossary organized?
Every entry starts with a one- or two-sentence definition you could repeat to a colleague. Below that, you'll find why the term matters for a small business, a simple example, and links to the related checker or fix guide.
Where a term has several names, we list them all. For instance, the entry on DMARC also gives its full name, and the entry on SSL certificates explains why you'll also hear "TLS."
Which terms show up in my scan report?
Your report uses plain names first, with the technical term in brackets. These entries explain the ones you're most likely to see:
- Email: SPF lists who can send email for your domain, DKIM signs your messages, and DMARC tells providers what to do with fakes.
- Website: an SSL certificate makes HTTPS possible, HSTS tells browsers to always use it, and security headers add other browser protections.
A few report items, like domain tamper protection (DNSSEC) and the certificate issuer lock (CAA), are explained right inside your report rather than here. They're useful extras, but most businesses get more value from fixing email authentication and HTTPS first.
To see each of these in context, run the free website security scan, or read what we check for a full list.
Which terms help me spot scams?
Some terms describe how attacks work rather than settings to change. Knowing them makes it easier to recognize trouble early.
Phishing is a message designed to trick someone into clicking a link or sharing a password. Business email compromise is a scam that uses a real or convincing business email to request payments. Ransomware locks your files until a payment is made. Two-step sign-in, also called MFA, is one of the most effective protections against all three.
How should I use these definitions?
Use them as a starting point, then act. Most entries link to a free checker, like the DMARC checker or SSL checker, so you can see where your business stands right away.
If you want a deeper technical definition, NIST's glossary collects formal definitions from its publications. Our editorial policy explains how we write and review every entry.
Common questions
Who is this glossary for?
Small business owners and staff who run into security terms in a scan report, an insurance form or an email from their IT provider. You don't need any technical background to use it.
Why do some terms have two names?
Many security terms have a formal name and an everyday one. Website certificates technically use TLS today, for example, but most hosts and browsers still call them SSL certificates. We list both so you can recognize either.
Where do your definitions come from?
We write our own plain-English definitions and check them against primary sources like RFCs, NIST publications and provider documentation. Each entry lists the sources it relies on.
Sources
- Glossary (NIST Computer Security Resource Center)
- Cybersecurity for Small Business (Federal Trade Commission)
Scan your website today
Get a free report on your website and email settings, with step-by-step fixes for anything that needs attention.
- Free check
- No signup
- No changes to your website