Last materially reviewed: September 3, 2026
Direct Answer
This glossary explains common cybersecurity terms in plain English for Philippine users, businesses, incident responders and compliance teams. Use the A-Z navigation to jump to a term, then follow linked Cybercode guides for deeper practical guidance.
A-Z: A · B · C · D · E · F · H · I · K · L · M · P · R · S · T · V · W · Z
A
- Account takeover (ATO)
- Unauthorized control of another person’s online account. See account compromise signs.
- Access control
- Rules and technical controls that determine who can access systems, data or functions.
- Attack surface
- All systems, accounts, devices, applications and interfaces that could potentially be attacked.
- Attack vector
- The path or method an attacker uses to gain access to a system or user.
- Authentication
- The process of verifying identity before access is granted.
- Authorization
- The permissions granted after identity has been authenticated.
B
- Backup
- A separate copy of data used to restore information after loss, corruption or ransomware. See backup and recovery.
- Business email compromise (BEC)
- A fraud scheme using compromised or impersonated business email to redirect payments or obtain sensitive information. See BEC guide.
- Botnet
- A network of compromised devices remotely controlled to send spam, conduct attacks or perform other malicious activity.
- Brute-force attack
- Repeated attempts to guess a password, key or credential.
C
- Cloud security
- Controls used to protect cloud accounts, workloads, storage, identities and data. See cloud security for SMEs.
- Compromise
- A condition in which confidentiality, integrity, availability or control of a system/account has been lost.
- Credential
- Information used to authenticate a user, such as passwords, tokens, certificates or keys.
- Credential stuffing
- Automated use of stolen username/password pairs across multiple services.
- Cryptography
- Techniques for protecting information through encryption, hashing, digital signatures and related methods.
- Cyberattack
- An intentional attempt to disrupt, damage, access or manipulate systems, accounts or data. See business cyberattack response.
- Cybersecurity incident
- An event that threatens or harms systems, networks, accounts or information and may require investigation and response.
D
- Data breach
- An incident involving unauthorized access, disclosure, alteration, loss or destruction of protected data. See data breach response.
- Data exfiltration
- Unauthorized transfer or theft of data from a system or network.
- Defense in depth
- Using multiple layers of security so failure of one control does not leave the organization unprotected.
- Denial-of-service (DoS)
- An attack intended to make a system or service unavailable by exhausting resources.
- Distributed denial-of-service (DDoS)
- A denial-of-service attack launched from many devices or systems at once.
E
- Encryption
- Transforming readable information into protected ciphertext that requires a key to read.
- Endpoint
- A device connected to a network, such as a laptop, desktop, phone, server or IoT device.
- Endpoint detection and response (EDR)
- Security technology that monitors endpoints for suspicious behavior and supports investigation and containment.
- Exploit
- Code or a technique that takes advantage of a vulnerability.
F
- Firewall
- A security control that filters network traffic according to defined rules.
- Forensics
- The collection and analysis of digital evidence to understand an incident while preserving integrity and chain of custody.
H
- Hash
- A fixed-length value generated from data and often used to verify integrity or store password representations.
- Honeypot
- A decoy system or service designed to attract and observe attackers.
I
- Identity and access management (IAM)
- Processes and technologies used to manage identities, authentication and permissions.
- Incident response
- The organized process for preparing for, detecting, containing, eradicating and recovering from cybersecurity incidents. See incident response plan.
- Indicator of compromise (IOC)
- A technical clue suggesting a system, account or network may have been compromised.
- Insider threat
- Risk caused by an employee, contractor or other trusted person through malicious, negligent or accidental behavior.
- Intrusion detection system (IDS)
- A tool that detects suspicious network or system activity and generates alerts.
K
- Keylogger
- Software or hardware that records keystrokes, often to steal credentials and sensitive information.
L
- Least privilege
- Giving users and systems only the minimum access necessary for their tasks.
- Log
- A record of system, application, security or user activity used for monitoring and investigation.
M
- Malware
- Malicious software designed to disrupt, spy on, damage or gain unauthorized control.
- Man-in-the-middle attack
- An attack in which a malicious party intercepts or alters communications between two parties.
- Multi-factor authentication (MFA)
- Authentication requiring two or more independent verification factors. See MFA guide.
P
- Passkey
- A phishing-resistant authentication credential based on public-key cryptography that can replace or supplement passwords.
- Patch
- A software update that fixes vulnerabilities, defects or other issues.
- Penetration test
- An authorized security assessment that simulates attacks to identify exploitable weaknesses.
- Phishing
- Fraudulent messages or sites designed to steal credentials, money or information. See clicked phishing link response.
- Phishing simulation
- An authorized exercise using simulated phishing to measure and improve employee awareness. See phishing simulation guide.
- Privilege escalation
- Gaining permissions beyond those originally authorized.
R
- Ransomware
- Malware that blocks access to systems or data, often through encryption, and demands payment. See ransomware response.
- Recovery point objective (RPO)
- The maximum acceptable amount of data loss measured in time.
- Recovery time objective (RTO)
- The target time within which a system or service should be restored after disruption.
- Risk assessment
- A process for identifying threats, vulnerabilities, likelihood and potential impact to prioritize controls.
- Rootkit
- Malicious software designed to maintain hidden privileged access to a system.
S
- Security awareness
- Training and communication that helps users recognize and reduce cybersecurity risks. See employee cybersecurity training.
- Security information and event management (SIEM)
- A platform that collects and analyzes logs and security events from multiple systems.
- Social engineering
- Manipulating people into revealing information, transferring money or taking unsafe actions.
- Spear phishing
- A targeted phishing attack crafted for a specific person or organization.
- Spyware
- Software that secretly monitors activity or collects information.
- Supply-chain attack
- An attack that compromises a trusted vendor, software component or service to reach downstream targets.
T
- Threat
- A circumstance or actor capable of causing harm to systems, data or operations.
- Threat actor
- A person or group responsible for malicious cyber activity.
- Threat intelligence
- Information about attackers, tactics, vulnerabilities and indicators used to improve security decisions.
- Trojan
- Malware disguised as legitimate software or content.
V
- Vendor risk
- Cybersecurity risk introduced by suppliers, SaaS providers, contractors or other third parties. See vendor/SaaS security checklist.
- Virtual private network (VPN)
- Technology that creates an encrypted connection between a device and a network or service.
- Vulnerability
- A weakness that can be exploited to compromise a system, account or process.
- Vulnerability scanning
- Automated testing used to identify known security weaknesses.
W
- Web application firewall (WAF)
- A security control that filters and blocks malicious web traffic targeting applications.
- Whaling
- A phishing attack targeting senior executives or other high-value individuals.
- WordPress hardening
- Reducing WordPress attack surface through updates, access controls, secure configuration, backups and monitoring. See WordPress security checklist.
Z
- Zero-day
- A vulnerability that is unknown to the vendor or does not yet have an available patch when attackers can exploit it.
- Zero trust
- A security approach that continuously verifies users, devices and access rather than automatically trusting network location. See zero trust for small businesses.
Official Sources
- NIST Computer Security Resource Center — Glossary
- NIST Cybersecurity Framework
- National Computer Emergency Response Team Philippines (NCERT-PH)
- Republic Act No. 10175 — Cybercrime Prevention Act
Related Resources
- Cybersecurity hub
- Cyber Incident Response Checklist
- Employee Cybersecurity Policy Template
- Technology Law Glossary
Disclaimer
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.