Glossary
Cybersecurity glossary.Human risk, phishing and security terms.
Plain-language definitions for security teams: what each term means, why it matters, and how it connects to the risk people and AI agents bring to your business.
Every term, A to Z.
No term matches that search. Try a shorter word, or search the whole site.
A
- Account takeover (ATO) When an attacker gains control of a legitimate account, usually with stolen credentials or a hijacked session. Cybersecurity fundamentals
- AI agent risk The security risk created by AI agents that act on a person’s behalf with their own access to systems and data. Human and AI agent risk
- Attack surface Every point where an attacker could try to get in: systems, accounts, people and AI agents. Cybersecurity fundamentals
B
- Baiting Social engineering that offers something tempting, such as a free download or a found USB drive, to get malware installed or credentials entered. Social engineering and simulation
- Business email compromise (BEC) Fraud that impersonates a colleague, executive or supplier by email to redirect payments or steal data. Social engineering and simulation
C
- Callback phishing An email or text with no link that asks the target to call a phone number, where an attacker takes over. Social engineering and simulation
- Cloud access security broker (CASB) A security control between users and cloud services that shows which apps are used and enforces policy on them. Cybersecurity fundamentals
- Credential phishing Phishing that leads to a fake sign-in page to capture usernames, passwords and sometimes MFA codes. Social engineering and simulation
D
E
H
- Human Risk Index (HRI) A score for every person and AI agent, built from threat, access and behavior signals, that shows where human risk is building. Human and AI agent risk
- Human risk management (HRM) A security discipline that measures the risk people and their AI agents bring to an organization, acts on it, and proves it went down. Human and AI agent risk
- Human risk quantification (HRQ) Measuring the security risk people create in numbers a security team and a board can act on. Human and AI agent risk
- Human risk signal One observable piece of evidence about a person’s or an AI agent’s security risk, such as a real phish delivered or a privileged role held. Human and AI agent risk
I
- Identity and access management (IAM) The policies and tools that control who can sign in to what, and with which permissions. Cybersecurity fundamentals
- Incident response (IR) The plan and process an organization follows to detect, contain, recover from and learn from a security incident. Cybersecurity fundamentals
- Insider risk The risk that someone with legitimate access, through mistakes, negligence or intent, causes harm to an organization. Human and AI agent risk
J
L
M
- Malware Software written to harm, spy on or take control of a device or network. Cybersecurity fundamentals
- MFA fatigue Flooding a person with MFA push prompts until they approve one, often with a call posing as IT. Cybersecurity fundamentals
- Multi-factor authentication (MFA) Signing in with two or more kinds of proof, such as a password plus a phone prompt or a security key. Cybersecurity fundamentals
N
P
- Phishing A social engineering attack that uses a fraudulent message to trick someone into clicking, sharing credentials or sending money. Social engineering and simulation
- Phishing simulation A safe, realistic phishing message sent to employees to practice spotting and reporting attacks. Social engineering and simulation
- Phishing-resistant MFA MFA that cannot be relayed by a fake sign-in page, such as passkeys and FIDO2 security keys. Cybersecurity fundamentals
- Preemptive security Acting on risk before an attack lands, instead of responding after it does. Human and AI agent risk
- Pretexting Social engineering built on a made-up scenario that gives the attacker a believable reason to ask for something. Social engineering and simulation
Q
R
S
- Secure behavior management (SBM) Gartner’s term for moving past awareness training to programs that measure and change security behavior. Human and AI agent risk
- Security awareness training (SAT) Training that teaches employees to recognize and respond to threats such as phishing, social engineering and data mishandling. Human and AI agent risk
- Security culture The shared attitudes, habits and norms that shape how people in an organization act on security. Human and AI agent risk
- Security information and event management (SIEM) A platform that collects and correlates security logs from across an organization to detect and investigate threats. Cybersecurity fundamentals
- Security nudge A short, timely message that steers a person toward a safer choice at the moment it matters. Human and AI agent risk
- Security operations center (SOC) The team, and its tools, that monitors an organization around the clock to detect and respond to threats. Cybersecurity fundamentals
- Security orchestration, automation and response (SOAR) Tools that automate security workflows and connect security products so incidents are handled faster and consistently. Cybersecurity fundamentals
- Security playbook A defined set of steps that turns a security finding into action, with an owner and a way to measure the result. Human and AI agent risk
- Shadow AI AI tools and agents that employees use without the security team’s knowledge or approval. Human and AI agent risk
- SMS phishing (smishing) Phishing by text message, with a link or a request to reply or call back. Social engineering and simulation
- Social engineering Manipulating people into giving up information, access or money, by exploiting trust, urgency or authority. Social engineering and simulation
- Spear phishing A phishing attack aimed at a specific person or group, using details about them to look genuine. Social engineering and simulation
T
U
V
W
Z
See which people and AI agentsare driving your risk.
A live walkthrough with our team, on the tools you already run.
- 68%Less time in a risky state after targeted action (2026 Human Risk Report)
- LeaderNamed Leader in the Forrester Wave™: Human Risk Management Solutions, Q3 2024
