Security glossary

By Karen Taylor, responsible editor Published 23 September 2026 Published by Burksled s.r.o.

Security marketing uses a lot of words loosely. These are the ones that come up most often on product pages, defined as precisely as we can manage in a sentence or two. No partner links on this page.

Adware

Software whose purpose is to show you advertising you did not ask for, usually by injecting it into web pages or changing your default search engine. Often arrives bundled with something you did want. Usually a browser-extension problem before it is an antivirus problem.

Antivirus engine

The component that decides whether a file or process is malicious. Modern engines combine signature matching, static heuristics, cloud reputation and behavioural monitoring; none of these alone is sufficient.

Behavioural detection

Judging a program by what it does when it runs — mass file rewriting, deleting shadow copies, injecting into other processes — rather than by what it looks like. Catches things no signature exists for, at the cost of occasional false positives.

Breach monitoring (“dark web monitoring”)

A service that checks your e-mail address against collections of already-leaked data and tells you where it appears. Necessarily reactive: the alert comes after the breach and after the data has surfaced. No service sees everything.

Cloud reputation

Asking the vendor’s servers what is known about a file, typically by its hash. A file signed by a known publisher and seen on millions of machines is treated differently from one seen four times this week. Means your security software is in regular contact with its vendor about the files on your machine — a real privacy trade-off, and how much of the detection works.

False positive

A clean file wrongly flagged as malicious. The reason detection rates alone tell you nothing: a scanner that blocks everything detects everything and makes the machine unusable. Independent test reports publish both columns; read both.

Fingerprinting

Identifying a browser from its characteristics — fonts, screen size, hardware, installed features — rather than from anything stored on the device. Notable because it works without cookies, and therefore cannot be defeated by clearing them.

Firewall

A filter on network connections, deciding what may reach the machine and what the machine may reach. Windows and macOS both include one. A firewall does not inspect files for malware.

Heuristics

Rules that score a file as suspicious from its structure — unusual packing, obfuscation, imports no ordinary program needs — without needing a signature for that specific sample.

Infostealer

Malware that copies saved passwords, session cookies and authentication tokens and sends them away. Designed to leave no visible sign. Because tokens can bypass a password change alone, recovery means changing passwords and signing out of all sessions.

Malware

The umbrella term for software written to act against the interests of the device’s owner. “Virus” is one historical subtype and is now used loosely to mean all of it.

Phishing

Fraud that persuades you to hand over credentials or payment details, usually by imitating an organisation you trust and imposing a deadline. Technical filters catch much of it; the reliable defence is to reach the provider through a route you chose yourself.

PUP / PUA (potentially unwanted program or application)

Software that is not straightforwardly malicious but that few people would install knowingly: bundled toolbars, aggressive “system cleaners”, trialware installed alongside something else. Products differ in how aggressively they flag these, which is one reason detection results differ between tests.

Ransomware

Malware that encrypts your files and demands payment for the key, now often combined with threatening to publish the data. The control that actually recovers files is a backup the malware could not reach.

Real-time protection

Scanning continuously as files are created, opened and downloaded, as opposed to an on-demand scan you start yourself. Run exactly one real-time scanner: two interfere with each other and the result is slower and less reliable, not safer.

Sandbox

An isolated environment where a suspicious program can be run and observed without reaching the real system. Used by security products, and by browsers to contain individual tabs.

Signature

A pattern extracted from a known malware sample, used to recognise it again. Fast and precise, and useless against anything not yet analysed — which is why it is no longer used alone.

SmartScreen

Microsoft’s reputation-based filter in Edge and Windows, which warns about downloads and sites with little or bad reputation. Included with Windows at no extra cost.

Trojan

Malware that arrives disguised as something legitimate. Describes the delivery method, not the payload: a trojan may install ransomware, an infostealer or a remote access tool.

Two-factor authentication (2FA / MFA)

Requiring something beyond the password — a generated code, a hardware key, a prompt on a device you hold. The single most effective account protection available to an ordinary user. A code app or hardware key is materially stronger than SMS, which can be defeated by hijacking your phone number.

VPN (virtual private network)

An encrypted tunnel between your device and a server, which then makes requests on your behalf. Hides traffic content and destinations from the local network and your internet provider, and hides your home IP from the sites you visit. Does not make you anonymous, does not remove malware, does not stop phishing, and moves your trust to the VPN operator rather than removing the need for it.

Zero-day

A vulnerability being exploited before a fix exists, leaving defenders zero days of warning. Frequently used in marketing to mean “new malware”, which is not the same thing.