Plain-language definitions of the terms leaders encounter most.

Software that detects and removes known malicious programs, traditionally using signatures of previously seen threats.

Modern endpoint protection has largely absorbed antivirus into broader detection and response capabilities, but the term remains common in policy and insurance requirements.

A defined way for two software systems to exchange data or trigger actions.

APIs power most integrations between business applications — for example, a CRM sending contacts into a marketing tool.

A copy of data kept separately from the original so it can be restored after loss, corruption, or attack.

The value of a backup is measured by how quickly and completely it can be restored, not by whether the copy exists.

The discipline of keeping essential business operations running during and after a disruption.

Business continuity is broader than IT disaster recovery; it includes people, processes, and facilities alongside technology.

The delivery of computing resources — servers, storage, applications — over the internet on a pay-for-use basis.

Common categories include Infrastructure as a Service, Platform as a Service, and Software as a Service.

The practice of protecting systems, networks, and data from digital attacks and unauthorized access.

Encoding data so only authorized parties with the correct key can read it.

Encryption is typically applied to data at rest — such as on a hard drive — and data in transit — such as between a browser and a server.

The IT-specific process of restoring systems and data after a disruption.

Disaster recovery sits inside a broader business continuity program.

The internet's directory service that translates human-readable names like example.com into the numeric addresses computers use.

Any device that connects to a network and is used by a person or process — laptops, desktops, servers, phones, and increasingly, connected devices.

Software on endpoints that detects suspicious behavior, records what happened, and gives responders tools to contain and remediate.

EDR extends beyond signature-based antivirus by watching behavior and enabling investigation.

A device or software that filters network traffic based on defined rules, allowing or blocking connections.

The processes and technologies that determine who can access what, and under which conditions.

A company that delivers ongoing IT services — monitoring, support, security, cloud, and more — under a defined agreement.

Requiring more than one form of proof to sign in — typically a password plus a code, an app approval, or a hardware key.

MFA is the single highest-value control most organizations can deploy against account takeover.

Continuously watching network devices and traffic for availability, performance, and anomalies.

The process of finding, testing, deploying, and verifying vendor updates across an environment.

Fraudulent messages designed to trick recipients into revealing credentials, approving requests, or running malicious content.

A platform that lets an IT team monitor, patch, and manage endpoints and servers remotely at scale.

A team — internal or delivered as a service — that monitors and responds to security events around the clock.

An authentication approach that lets a user sign in once and access multiple applications without re-entering credentials.

Software delivered over the internet on a subscription basis, hosted and maintained by the vendor.

A secure tunnel that lets a device access a private network over the public internet as if it were locally connected.

A weakness in software, configuration, or process that could be exploited to compromise confidentiality, integrity, or availability.

A security model that treats every request as untrusted by default and verifies identity, device, and context before granting access.