Cybersecurity without the jargon: a glossary
Plain-English explanations of security terms you may encounter elsewhere — because nobody should need a technical dictionary to stay safe.
Last reviewed: October 2026
We don’t do jargon
Cybersecurity has a bad habit of making fairly simple ideas sound unnecessarily complicated. At Full Frame, we have a rule: we never use a technical term without explaining it in language that a non-technical reader can understand.
We take that rule seriously. In our security awareness sessions, we offer £20 to anyone who catches us using unexplained jargon.
This glossary is for the occasions when you encounter the terminology elsewhere — or when we need to explain what something is actually called.
2FA / two-factor authentication
An extra check when you sign in. Instead of relying only on a password, you are asked for something else — perhaps a code from an app, a security key or confirmation on another device. Also commonly called two-step verification or MFA.
Authentication
Proving that you are who you claim to be when signing in. A password, passkey, fingerprint and security key are all ways of authenticating.
Backup
A separate copy of information that lets you recover it after loss, damage, accidental deletion or an attack. A good backup should still be available if the original system is compromised.
Browser
The application you use to view websites — for example Safari, Chrome, Firefox or Edge.
Cloud
Someone else’s computing infrastructure reached over a network. Cloud storage and applications can be very secure; the word describes where a service runs, not how safe it is.
Cookie
A small piece of information a website stores in your browser. Cookies can do useful things such as keep you signed in, but some are also used to track activity for advertising and analytics.
Credentials
The information or method used to access an account — commonly a username and password, but the term can also include security tokens and keys.
Data breach
An incident in which information is accessed, exposed, lost or disclosed to people who should not have it.
DNS
The internet’s address book. DNS turns names such as example.com into the numerical addresses computers use to find services online.
Encryption
Scrambling information so that it cannot be read without the appropriate key. Modern phones, secure websites and messaging services use encryption extensively.
End-to-end encryption
Encryption designed so that a message can be read only on the devices of the people communicating. The company carrying the message should not hold the key needed to read its contents. It does not necessarily hide who communicated, when, or other metadata.
Firewall
A control that decides which network connections are allowed in or out. Firewalls can be built into devices, routers and larger organisational networks.
HTTPS
The encrypted connection normally used between your browser and a website. It protects data while it travels between you and that site. It does not mean the website itself is trustworthy. Scam sites use HTTPS too.
IP address
A numerical address used to send information across a network. Your public IP address can reveal information about the network you are using and an approximate location, but it is not usually a precise physical address.
Malware
Software deliberately designed to steal information, spy, disrupt systems or give somebody unauthorised access. Viruses, some spyware and ransomware are types of malware.
Metadata
Information about information. A photograph may contain when and where it was taken; a message has sender, recipient and timing information. Metadata can be revealing even when the content itself is protected.
MFA / multi-factor authentication
See 2FA. It means requiring more than one kind of proof when somebody signs in. The terminology varies between services.
Passkey
A modern way to sign in using security built into your phone or computer, often unlocked with Face ID, a fingerprint or device PIN. Passkeys are much harder to steal through phishing than passwords.
Password manager
Software that creates and stores strong, unique passwords so you do not have to remember them all. You protect the manager itself carefully, then let it remember the rest.
Phishing
A message, call or website designed to trick you into giving away information, signing in to a fake service, sending money or doing something that benefits an attacker.
Ransomware
Malware used to disrupt an organisation, commonly by encrypting data. Attackers may also steal information and threaten to publish it unless money is paid.
Router
The device that connects networks and directs traffic between them — commonly the box connecting a home or office network to the internet.
Security key
A small physical device used to prove your identity when signing in. Because it can verify the genuine website, a modern security key provides strong protection against phishing.
SIM swapping
An attack in which somebody persuades or tricks a mobile provider into moving your phone number to a SIM or eSIM they control. They can then receive calls and text messages sent to that number.
Spyware
Software used to monitor a device or its user. Highly sophisticated targeted spyware can access messages, files, microphones, cameras and location data, while less advanced forms may simply collect browsing or other activity.
VPN / virtual private network
A service that creates an encrypted connection between your device and another network or VPN provider. Organisations use VPNs to provide secure access to internal systems. Commercial VPNs can change where your internet traffic appears to come from, but they do not make you anonymous or automatically make everything you do secure.
Vulnerability
A weakness in software, hardware or a system that could be used to compromise it. Security updates frequently fix vulnerabilities.
Zero-day
A vulnerability for which defenders had no useful advance warning — often used for a newly discovered flaw before a fix is widely available. The term sounds dramatic because it is; most everyday attacks, however, still exploit stolen credentials, deception or older unpatched weaknesses.