Cyber Security Glossary: PCI DSS and Security Terms in Plain English

This cyber security glossary explains the terms buyers, auditors and IT teams meet in PCI DSS, Cyber Essentials, ISO 27001 and penetration testing, grouped by topic, then lists about 90 general cyber security terms from A to Z. Terms with their own full entry, such as PCI PTS, CVSS and the OWASP Top 10, are listed at the end of the page.

What is a cyber security glossary for?

It gives everyone in a project the same meaning for the same word. A cyber security glossary (often spelt cybersecurity glossary) matters most in compliance work, because acronyms sound alike but carry different responsibilities: a QSA and an ASV are both PCI SSC approvals, yet an ASV only runs external scans, while a QSA assesses the whole standard and signs the Report on Compliance.

Where our wording differs from an official definition, the official one wins: the PCI SSC glossary for payment terms and the NCSC glossary for general security terms.

What do the PCI DSS glossary terms mean, from QSA to KIF?

What do the Cyber Essentials terms mean?

What do the ISO 27001 terms mean?

What do the penetration testing terms mean?

Cyber security terms, A to Z

The general cyber security terms below come up in board papers, supplier questionnaires, incident advice and test reports. Payment, Cyber Essentials, ISO 27001 and testing acronyms are in the tables above, and terms with a full guide of their own are listed further down the page.

A · B · C · D · E · F · G · H · I · K · L · M · N · O · P · R · S · T · U · V · W · Z

A

• Access control: The rules and technology that decide who can use which systems and data, and what they can do there. Cyber Essentials, ISO 27001 and PCI DSS all require it, built on least privilege.
• Adversary-in-the-middle (AiTM) phishing: A phishing kit that relays the real sign-in page between the victim and the service, capturing the password and the session once MFA is complete. Phishing-resistant methods such as passkeys defeat it.
• Allow listing: Permitting only approved applications, senders or network addresses and blocking everything else, the opposite of a block list. Cyber Essentials accepts application allow listing as one way to meet its malware protection control.
• Antivirus: Software that detects and removes known malware on a device. Modern products are usually sold as anti-malware or endpoint protection, and EDR goes further by recording activity and spotting suspicious behaviour.
• APT (advanced persistent threat): A well-resourced attacker, often state-backed, that gets into a network and stays hidden for a long time to steal data or prepare disruption.
• Assumed breach: A test that starts from inside, typically with a standard user account, to see how far an attacker who already has a foothold could get. See breach and attack simulation.
• Attack surface: Everything an attacker could try to reach: internet-facing systems, cloud services, applications, user accounts and supplier connections. Attack surface management keeps an up-to-date inventory of it.
• Authentication and authorisation: Authentication proves who a user is, with a password, passkey or MFA prompt; authorisation decides what that user may then do. Many serious web flaws, such as IDOR, are authorisation failures.

B

• Backdoor: A hidden way into a system that bypasses normal sign-in, planted by an attacker after a compromise so they can return, or left in software by mistake.
• Black box testing: A penetration test where the tester starts with no inside knowledge, as an outside attacker would. Our guide to black box vs white box testing compares the options.
• Botnet: A network of compromised computers or devices controlled remotely by a criminal, often used for DDoS attacks, spam and credential stuffing.
• Brute force attack: Guessing passwords or keys by trying many combinations. Account lockout, rate limiting, long passwords and MFA are the usual defences, and Cyber Essentials requires protection against it.
• BYOD (bring your own device): Staff using personal laptops, phones or tablets for work. Personal devices that access company email or data generally fall within Cyber Essentials scope, as our scoping questionnaire explains.

C

• CAF (Cyber Assessment Framework): The NCSC’s outcome-based framework for organisations that run essential services, used by regulators under the NIS Regulations. See the Cyber Assessment Framework.
• Chargeback: A card payment reversed by the cardholder’s bank after a dispute. Most card-not-present fraud losses reach merchants as chargebacks.
• CISA KEV: The US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue, a list of vulnerabilities with evidence of active exploitation that many teams use to set patching priorities. See vulnerability management.
• Compensating control: An alternative control an assessor can accept when a PCI DSS requirement cannot be met as written because of a legitimate, documented constraint, provided it meets the intent and rigour of the original. Our guide to compensating controls explains the worksheet.
• Credential stuffing: Trying usernames and passwords leaked in one breach against other services, betting that people reuse passwords. MFA and checks against known breached passwords stop most of it.
• CVE (Common Vulnerabilities and Exposures): The public catalogue that gives each known vulnerability an identifier, such as CVE-2021-44228. The identifier names the flaw; CVSS rates its severity.
• CWE (Common Weakness Enumeration): MITRE’s catalogue of software weakness types, such as CWE-79 for cross-site scripting. A CVE is one instance of a flaw; a CWE is the kind of mistake behind it.

D

• Data breach: A security incident in which data is lost, destroyed, altered, disclosed or accessed without authorisation. Under UK GDPR, a notifiable personal data breach must be reported to the ICO within 72 hours of becoming aware of it, where feasible.
• DDoS (distributed denial of service): Flooding a website or network with traffic from many sources so genuine users cannot reach it, an attack on availability in CIA triad terms.
• Defence in depth: Layering independent controls so that one failure does not lead straight to a breach, for example MFA, endpoint protection and monitoring working together.
• DLP (data loss prevention): Tools and rules that detect and block sensitive data, such as card numbers or customer records, leaving through email, web uploads or removable media.
• DMARC, SPF and DKIM: Three email authentication records. SPF lists the servers allowed to send for your domain, DKIM signs messages, and DMARC tells receiving servers what to do with mail that fails, which makes spoofing your exact domain harder. See business email compromise.
• DORA (Digital Operational Resilience Act): The EU regulation on ICT risk, incident reporting, resilience testing and third-party risk for financial entities, applied since 17 January 2025. See our DORA guide.

E

• EDR (endpoint detection and response): Software on laptops and servers that records activity, detects suspicious behaviour and lets responders isolate a device. It goes further than traditional antivirus.
• Encryption: Scrambling data with a key so only holders of the right key can read it. It protects data in transit, for example with TLS, and at rest, for example with disk encryption.
• Exploit: Code or a technique that takes advantage of a vulnerability. A flaw with a working public exploit is far more urgent to fix, which is what EPSS tries to predict.

F

• File integrity monitoring (FIM): Alerting when critical system files, configuration or content change unexpectedly. PCI DSS Requirement 11.5.2 requires a change-detection mechanism of this kind.
• Firewall: A device or software that allows or blocks network traffic according to rules. Firewalls are one of the five Cyber Essentials controls, and a firewall configuration review checks the rule base.

G

• Grey box testing: A penetration test where the tester has some inside knowledge, such as user accounts or architecture diagrams, which gives more depth in the same time than black box testing.

H

• Hashing: A one-way function that turns data into a fixed-length value. Passwords should be stored as salted hashes, and PCI DSS accepts keyed cryptographic hashes of the full card number as one way to render stored card numbers unreadable.
• Honeypot: A decoy system, account or file that no legitimate user has any reason to touch, so any activity on it is a strong sign of an intruder.
• HSM (hardware security module): A tamper-resistant device that generates, stores and uses cryptographic keys. Payment HSMs protect PINs and card keys, and are evaluated under PCI PTS.

I

• IAM (identity and access management): The processes and tools that create, change and remove user identities and their access rights, including single sign-on and MFA.
• IDS and IPS: Intrusion detection and intrusion prevention systems watch network traffic for attack patterns; an IDS alerts, while an IPS can also block. PCI DSS Requirement 11.5.1 requires intrusion detection or prevention techniques.
• Incident response: The planned way an organisation detects, contains, investigates and recovers from a security incident. Our incident response plan template is a starting point.
• Indicator of compromise (IoC): Evidence that a system may have been breached, such as a known malicious IP address, file hash or domain name.
• Insider threat: Risk from people with legitimate access, such as staff, contractors or suppliers, who misuse it deliberately or cause harm by mistake. Least privilege, prompt removal of leavers’ access and monitoring reduce it.
• IoT (internet of things): Network-connected devices such as cameras, sensors, smart TVs and building controls. Many ship with weak default settings and rarely receive updates, so they belong on a separate network segment; see IoT and hardware penetration testing.

K

• Keylogger: Malware or a small hardware device that records keystrokes to capture passwords, card numbers and messages as they are typed.

L

• Lateral movement: An attacker moving from the first compromised machine to others in the network, usually by reusing credentials. Segmentation and monitoring limit it, and an internal penetration test shows how far it could go.
• Least privilege: Giving each user, service and system only the access it needs for its job, and no more, which limits the damage from any one compromised account.

M

• Magecart: The name given to card-skimming attacks that inject malicious JavaScript into online checkouts. PCI DSS 6.4.3 and 11.6.1 target them, as our e-commerce PCI guide explains. The name comes from early attacks on Magento stores; our guide to Magento PCI compliance covers that platform.
• Malware: Malicious software, including viruses, worms, trojans, ransomware and spyware. Malware protection is one of the five Cyber Essentials controls.
• Man-in-the-middle attack: An attacker positioned between two parties who reads or alters their traffic, for example on an untrusted Wi-Fi network. TLS with proper certificate checks is the standard defence.
• MDR (managed detection and response): An outsourced service in which a provider monitors your environment, investigates alerts and helps contain threats, usually around the clock.
• MFA (multi-factor authentication): Signing in with two or more different types of factor: something you know, have or are. Cyber Essentials requires it on cloud services wherever the service offers it; see Cyber Essentials MFA rules and two-factor vs two-step verification.

N

• Network segmentation: Separating a network into zones with controlled traffic between them. In PCI DSS, segmentation can take systems out of scope, and penetration testing must confirm it works, as our PCI DSS scoping guide explains.
• NIS2: The EU directive that widens cyber security duties and incident reporting for medium and large organisations in 18 sectors. It does not apply in the UK itself, but it can reach UK firms that operate or offer services in the EU. See NIS2.
• NIST CSF: The US National Institute of Standards and Technology Cybersecurity Framework. Version 2.0, published in February 2024, groups security outcomes under six functions: govern, identify, protect, detect, respond and recover. See NIST CSF.

O

• OSINT (open-source intelligence): Information gathered from public sources, such as websites, social media, company filings and leaked data. Attackers use it to plan phishing; testers use it to show what an attacker could learn about you.

P

• Passkey: A phishing-resistant sign-in method based on public key cryptography and unlocked on your device with a fingerprint, face or PIN. It only works on the genuine site, so a fake login page cannot capture it.
• Patch management: Finding, testing and installing software updates. Cyber Essentials requires critical and high-risk updates within 14 days of release, and PCI DSS requires critical patches within one month.
• PCI DSS (Payment Card Industry Data Security Standard): The security standard for organisations that store, process or transmit payment card data. The current version is v4.0.1. See what PCI DSS is.
• PCI SSC (PCI Security Standards Council): The body founded by the major card brands that writes PCI DSS and the other PCI standards and qualifies assessors. See the PCI Security Standards Council.
• Pretexting: A social engineering technique built on an invented story, such as a caller posing as IT support, to get information or access. It is common in vishing.
• Privilege escalation: Gaining more access than an account was given, for example moving from a standard user to local administrator or domain administrator. Penetration testers look for it after the first foothold.
• PTaaS (penetration testing as a service): Penetration testing delivered through an online platform, where findings and fixes are tracked as the work happens rather than only in a final report. See penetration testing as a service.

R

• Ransomware: Malware that encrypts or steals data and demands payment to restore it or keep it unpublished. Tested offline backups are the key recovery control; see ransomware prevention.
• Remote code execution (RCE): A vulnerability that lets an attacker run their own commands on a system over a network. RCE flaws on internet-facing systems are usually rated Critical.
• Risk assessment: Identifying what could go wrong, how likely it is and how much it would hurt, then deciding how to treat each risk. See our cyber security risk assessment guide.
• Rootkit: Malware that hides itself and other malicious activity deep in the operating system, usually with the highest privileges, which makes it hard to detect and remove; rebuilding the device is often the safest fix.

S

• Sandboxing: Running untrusted code, or opening a suspicious file, in an isolated environment so it cannot affect the rest of the system. Email security tools often open attachments in a sandbox before delivering them.
• SAST (static application security testing): Automated analysis of source code without running it, which points to the file and line at fault. Our DAST guide compares the two approaches.
• SIEM (security information and event management): A platform that collects logs from across your systems, correlates them and raises alerts, while keeping the records investigators need. See PCI DSS Requirement 10 for the logging rules card businesses follow.
• SOC (security operations centre): The team, in-house or outsourced, that monitors security alerts and responds to incidents.
• SOC 2: An attestation report, under AICPA rules, on a service organisation’s controls against the Trust Services Criteria, common in US software procurement. It has nothing to do with a security operations centre; see SOC 2 compliance.
• Social engineering: Manipulating people into breaking security, through phishing emails, phone calls, texts or visits in person. Social engineering testing measures how staff respond.
• Software composition analysis (SCA): Scanning the open-source and third-party components in your software for known vulnerabilities and licence issues.
• Spoofing: Faking an identity, such as an email sender, caller ID, website or IP address, so that a message or connection looks trustworthy. It underpins most phishing and payment fraud.
• Spyware: Malware that secretly monitors a device and sends information such as browsing, messages, location or passwords to an attacker.
• SQL injection: A flaw where user input is run as part of a database query, letting an attacker read or change data. It sits under Injection in the OWASP Top 10.
• Strong Customer Authentication (SCA): The UK and EU rule that most customer-initiated online payments need two independent factors. For cards it is applied through 3-D Secure, which also shifts liability for card-not-present fraud.
• Supply chain attack: Compromising a target through a supplier, such as a software update, a managed service provider or a shared code library. See supply chain security.

T

• Threat intelligence: Information about attackers, their techniques and their infrastructure that helps you anticipate and detect attacks. ISO 27001:2022 Annex A 5.7 covers it.
• TLS (Transport Layer Security): The protocol that encrypts web and email traffic in transit, shown by https in the browser. PCI DSS requires strong cryptography, such as current TLS versions, for card data sent over open, public networks.
• Tokenisation: Replacing a card number with a token that is useless to an attacker, so fewer systems hold real card data. See PCI DSS tokenisation.
• Trojan: Malware disguised as legitimate software or a document, which the victim installs or opens themselves.

U

• UK GDPR: The UK’s version of the General Data Protection Regulation, which requires appropriate security for personal data and the reporting of notifiable breaches to the ICO. Our comparison of PCI DSS and GDPR shows where the two overlap.

V

• Virus: Malware that attaches itself to legitimate files or programs and spreads when they are run or shared. The word is often used loosely for any malware.
• VPN (virtual private network): An encrypted tunnel between a device and a network, used for remote access. Internet-facing VPN appliances are a frequent target, so they need prompt patching and MFA.
• Vulnerability: A weakness in software, hardware, configuration or process that an attacker could exploit. Published software flaws receive a CVE identifier, and our guide to what a vulnerability scan is explains how known ones are found.

W

• WAF (web application firewall): A filter in front of a web application that blocks common attacks such as SQL injection and cross-site scripting. PCI DSS Requirement 6.4.2 requires an automated solution of this kind for public-facing web applications.
• Whaling: Spear phishing aimed at senior executives, often to approve payments or share sensitive data.
• White box testing: A penetration test or code review with full information, such as source code and architecture documents, giving the deepest coverage in the time available.
• Worm: Malware that spreads across a network by itself, exploiting vulnerabilities in connected systems without anyone opening a file. WannaCry, in 2017, was a ransomware worm.

Z

• Zero-day: A vulnerability that attackers know about before the vendor has released a fix, so there is no patch to apply yet.
• Zero trust: A security model that never trusts a connection because of where it comes from, and checks identity, device and context on every request. The NCSC publishes design principles for zero trust architecture.

Who writes these definitions?

Sovereign Secure: a UK firm founded in 2012, a PCI SSC-approved QSA, QPA and CPSA company, also listed as a P2PE Assessor and 3DS Assessor, a GEAR member for 2026 to 2028, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. If a term you need is missing, ask our team.