Technical terms made simple.
Jump to a topic below, or browse every term to better understand your security options as a small business owner or non-profit decision maker.
Jump to a topic
Start here. These are the words you will hear in every security conversation.
Traditional security software that detects and removes known malware threats by comparing files against a database of known threat signatures.
The practice of protecting computers, servers, devices, data, and networks from digital attacks or unauthorized access.
Security strategy that uses multiple layers of protection, ensuring that if one defense fails, others continue protecting your systems and data.
Any device that connects to your business network, including computers, phones, tablets, and servers. Each endpoint is a potential entry point for security threats.
A security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules, acting as a barrier between your trusted internal network and untrusted external networks.
Harmful software designed to damage systems, steal data, or gain unauthorized access to your network. Includes viruses, ransomware, spyware, and trojans.
Fraudulent attempts to obtain sensitive information like passwords or credit card numbers by disguising as a trustworthy entity in emails or messages.
Malicious software that encrypts your data and demands payment for its release. One of the most costly cybersecurity threats facing businesses today.
Unauthorized access to data, applications, networks, or devices that compromises the confidentiality, integrity, or availability of information.
The overall strength of your organization’s cybersecurity defenses, policies, and readiness to prevent and respond to threats.
Who can sign in, from which device, and with what permissions. These controls decide who gets into your business systems.
Security approach that adjusts authentication requirements based on real-time risk assessment, applying stronger controls only when risk is elevated.
Security rules that evaluate user identity, device health, location, and risk factors before granting, limiting, or blocking access to business resources.
Verification that devices meet your security requirements (encryption, updates, antivirus) before allowing them to access business resources.
Special administrative accounts that bypass standard security controls for critical business situations or lockout scenarios.
Systems and policies that ensure the right people have appropriate access to technology resources at the right times and for the right reasons.
Just-in-Time access. Temporary elevated permissions granted only when needed and for a specific duration, reducing the risk of compromised privileged accounts.
Multi-Factor Authentication. Security measure requiring two or more verification methods beyond just a password, such as codes sent to your phone or biometric verification.
A sign-in method that replaces the password with a cryptographic key stored on your device and unlocked with your fingerprint, face, or PIN. A passkey only works on the real website it was created for, so it cannot be typed into or copied by a fake sign-in page.
Privileged Access Management. Security tools that control and monitor the use of elevated permissions on your devices and systems. PAM ensures that administrative actions like software installations require explicit approval, reducing the risk of unauthorized changes or malware gaining control of your systems.
Elevated permissions that allow users to perform administrative functions, access sensitive systems, or make critical changes to your IT environment.
Security approach that applies stronger authentication and controls only when elevated risk is detected, balancing security with user experience.
Security approach that restricts system access based on a person’s role within your organization, ensuring users only access what they need for their job.
Single Sign-On. Authentication system that allows users to access multiple applications with one secure login, improving both security and user experience.
Pre-approved network locations where security requirements may be adjusted for verified users, such as your office network.
Security approach that verifies every user and device attempting to access resources, regardless of whether they’re inside or outside your network. Assumes breach and verifies explicitly.
How your domain proves which email is really yours, and how fake messages and fake sign-in pages get caught.
Adversary-in-the-Middle phishing. A phishing attack that sends you to a fake sign-in page that passes everything you type to the real Microsoft page. The attacker copies your password, your MFA approval, and the sign-in session itself, so they can get in as you even though your MFA code worked. Stopping it takes controls that check the device as well as the person, such as conditional access with device compliance, or passkeys.
Email filtering that checks incoming messages for signs of fraud, such as look-alike sender addresses, display names that copy your own staff, and links to fake sign-in pages. Suspicious messages are quarantined or flagged before anyone acts on them. Also called impersonation protection.
Business Email Compromise. A scam where an attacker uses a hacked or look-alike email account to trick staff, clients, or vendors into sending money or sensitive information. Common examples are a real invoice re-sent with new bank details and an urgent payment request that appears to come from a manager.
DomainKeys Identified Mail. A digital signature added to every email your domain sends. The receiving mail server checks the signature against a public key in your DNS to confirm the message really came from your domain and was not changed along the way.
Domain-based Message Authentication, Reporting and Conformance. A DNS policy that tells receiving mail servers what to do with email that fails SPF or DKIM checks: deliver it, send it to junk, or reject it. DMARC reports also show you who is sending email that uses your domain name.
Sender Policy Framework. A DNS record that lists the mail servers allowed to send email for your domain. Receiving mail servers check it to spot email sent from servers you did not approve.
Every laptop, phone and tablet that touches company data. These terms cover how devices are set up, kept up to date, and protected if they go missing.
Bring Your Own Device. Policy framework allowing employees to use personal devices for work while maintaining security controls that protect business data.
Security verification ensuring devices meet minimum standards (encryption enabled, operating system updated, security software active) before accessing company resources.
The process of configuring a new device with the correct security policies, software, user accounts, and network settings so it is ready for use. Automated device provisioning streamlines this process so new computers can be shipped directly to employees and configure themselves on first login, without requiring hands-on IT setup.
Endpoint Detection & Response. Advanced security solution that continuously monitors endpoints, detects suspicious behavior using behavioral analysis, and responds to threats in real time, going beyond traditional signature-based antivirus detection.
Converting data into code that can only be read by authorized parties with the correct decryption key, protecting information even if devices are lost or stolen.
Comprehensive approach to securing and managing all devices (computers, phones, tablets) that connect to your business network.
Mobile Device Management. Centralized security solution for smartphones and tablets, ensuring company security policies are enforced on all mobile devices accessing business data.
Mobile App Protection. Policies that protect work data inside approved apps, such as Outlook and Teams, on phones and tablets, including personal devices. IT can block copying work data into personal apps and can wipe only the work data, without touching personal photos or apps. Microsoft calls these app protection policies.
Microsoft’s cloud-based endpoint management platform that allows IT administrators to manage devices, enforce security policies, deploy software, and ensure device compliance, all without requiring those devices to be on a corporate network. Intune is the engine behind mobile device management (MDM) and device compliance in Microsoft 365 Business Premium and Enterprise environments.
The process of testing, deploying, and verifying software updates and security patches across all devices to protect against known vulnerabilities.
Security capability allowing IT administrators to erase all data from lost, stolen, or compromised devices remotely to prevent data breaches.
How sensitive files and email are found, labelled, and kept from leaving the business by accident.
Information stored on devices, servers, or cloud storage. Requires encryption and access controls to protect against unauthorized access.
The process of organizing and labeling data based on its sensitivity level and business importance to apply appropriate security controls.
Automated scanning process that locates sensitive information across your organization using pattern recognition, machine learning, and predefined rules.
Information actively traveling between systems, applications, or locations. Requires encryption during transmission to prevent interception.
Legal requirement that data must be stored and processed within specific geographic boundaries, important for regulatory compliance.
Data Loss Prevention. Security tools that identify, monitor, and protect sensitive data across email, cloud storage, and endpoints to prevent accidental or malicious data exposure.
Comprehensive approach to discovering, classifying, labeling, and protecting sensitive business information throughout its lifecycle.
Security risks from employees, contractors, or partners who have authorized access but may intentionally or accidentally misuse it.
Microsoft’s information protection and governance platform that helps organizations classify, label, and protect sensitive data across cloud and on-premises environments.
Security controls (encryption, access restrictions, usage limitations) that remain attached to documents even after they leave your organization.
Visual and technical markers applied to documents that enforce encryption, access controls, and usage restrictions. This protection persists even when files are shared externally.
Machine learning models that learn to recognize specific types of documents and content patterns, enabling automatic application of appropriate security classifications.
Microsoft 365, Azure, and the other cloud apps your team uses every day, and the controls that keep them secure.
Cloud Access Security Broker. Security tool that sits between your organization and cloud service providers to monitor activity, enforce policies, and protect data.
Tools and policies that protect and monitor how your organization uses cloud services, preventing unauthorized access and risky behaviors.
Comprehensive approach to protecting data, applications, and infrastructure hosted in cloud services like Microsoft 365, Azure, or Google Workspace.
A review of the third-party apps that staff have allowed to access company email, files, or calendars. A malicious or forgotten app can keep access even after a password is reset, so unused and risky app permissions are removed.
Formerly Azure AD. Microsoft’s cloud-based identity and access management service that controls user access to cloud applications and resources.
A measurement in the Microsoft security portal that rates how closely your Microsoft 365 settings follow Microsoft’s security recommendations, with a list of actions that raise the score.
Documented rules defining how cloud services should be configured, accessed, and used securely within your organization.
Unauthorized cloud applications and services used by employees without IT approval, creating security blind spots and compliance risks.
The office network, Wi-Fi, phones, and remote connections that link your team together.
Network Attached Storage. A dedicated file storage device connected to your office network that allows multiple users and devices to access shared files from a central location. NAS devices are commonly used for shared drives, local backups, and collaboration in office environments.
The hardware and software components (routers, switches, access points, cabling) that enable network connectivity and must be properly secured.
Continuous surveillance of network traffic and activity to detect anomalies, performance issues, and potential security threats.
Practices and tools that protect the integrity, confidentiality, and accessibility of your computer network and the data transmitted across it.
Practice of dividing your network into separate security zones to contain potential breaches and protect sensitive systems.
Traditional security approach focusing on protecting the boundary between your internal network and external threats, though less effective in modern cloud environments.
Voice over Internet Protocol. Technology that delivers phone calls over the internet instead of traditional telephone lines. VoIP phone systems offer business features like call routing, voicemail-to-email, and virtual extensions at lower cost than traditional phone service, and can support remote workers through software-based phone apps.
Virtual Private Network. Encrypted connection that creates a secure tunnel over the internet, allowing remote workers to safely access your business network.
How attacks get spotted and stopped, and what happens when something gets through.
Service that scans dark web marketplaces and forums for your organization’s compromised credentials or sensitive data being sold or traded.
Structured approach to handling security breaches or cyberattacks, including detection, containment, eradication, and recovery.
Identity Threat Detection and Response. Security tools and processes focused on detecting and responding to attacks that target user identities and authentication systems. ITDR monitors for suspicious sign-in behavior, compromised credentials, and privilege escalation attempts to stop attackers from exploiting stolen or misused identities.
Managed Detection and Response. Outsourced security service that combines advanced threat detection, real-time monitoring, and expert-led response to identify and contain cyber threats across your environment. MDR goes beyond automated alerts by providing human analysts who investigate suspicious activity and take action on your behalf.
Education programs that teach employees to recognize and respond appropriately to security threats like phishing emails and social engineering.
Continuous observation of systems, networks, and user activities to identify suspicious behavior or security incidents requiring response.
Security Information and Event Management. Security technology that collects and analyzes log data from across your IT environment (devices, cloud services, network equipment) to detect suspicious patterns and potential security incidents. SIEM provides a centralized view of security activity and creates an audit trail for investigations and compliance.
Systems and processes that identify potential security threats through monitoring, analysis, and correlation of security events.
Systematic review of systems to identify security weaknesses that could be exploited by attackers.
How your data comes back after a deletion, ransomware, or a hardware failure, and how fast.
Copies of data stored separately from primary systems to enable recovery after data loss, system failure, hardware damage, or cyberattack.
Business Continuity and Disaster Recovery. Combined approach addressing both operational continuity and IT recovery to minimize downtime and data loss.
Comprehensive strategies and procedures to maintain or quickly resume business operations during and after significant disruptions.
Automated copies of your data stored in secure cloud infrastructure, kept apart from your office and your primary systems. Cloud backup protects against local disasters, ransomware, and hardware failures, gives you geographic redundancy, and makes recovery easy without maintaining physical backup hardware.
Specific IT-focused processes and technologies for restoring systems, applications, and data after catastrophic events.
A separate backup of your Microsoft 365 email, OneDrive, SharePoint, and Teams data, kept outside Microsoft. Microsoft 365 on its own is not a full backup: deleted items are kept for a limited time only. A separate backup gives you longer retention and many restore points after an accidental deletion, ransomware, or a hacked account.
Data backups stored in a different physical location from your primary systems, protecting against local disasters like fire, flood, or theft.
Ability to restore data to a specific moment before corruption, deletion, or ransomware encryption occurred.
Regular verification that backup systems work correctly and data can be successfully restored when needed, ensuring backup reliability.
Recovery Point Objective. Maximum acceptable amount of data loss measured in time: how far back you can afford to restore from backups.
Recovery Time Objective. Maximum acceptable time your business can be without specific systems or processes before the impact becomes unacceptable.
The laws, frameworks, and records that show clients, insurers, and regulators how your data is protected.
Chronological record of system activities documenting who accessed what information, when, and what actions they performed. Audit trails are critical for compliance and investigations.
Meeting security and privacy standards required by laws, regulations, or industry frameworks relevant to your business operations.
Documentation and evidence demonstrating how your organization meets regulatory requirements and security standards.
Policies defining how long different types of business data must be kept and when it should be securely deleted.
Organizational policies, procedures, and controls governing how business information is created, stored, accessed, shared, and disposed of.
International standard for information security management systems, providing a systematic approach to managing sensitive information.
Comprehensive cybersecurity framework developed by the US National Institute of Standards and Technology, widely adopted by Canadian organizations.
Ontario’s Personal Health Information Protection Act, protecting patient privacy and governing how health information is collected, used, and disclosed.
Canada’s federal Personal Information Protection and Electronic Documents Act, governing how private sector organizations collect, use, and disclose personal information.
Comprehensive review of your security measures, policies, and technical controls against regulatory requirements or industry standards.
Security standards and documentation that suppliers or clients require you to meet before doing business together.
How IT support is promised, and how staff get access on their first day and lose it on their last.
Service Level Agreement. A documented commitment between an IT service provider and a client that defines expected response times, resolution times, and support availability. SLAs set clear expectations for how quickly issues will be acknowledged and resolved based on their severity.
The process of setting up a new employee’s technology access, including creating user accounts, assigning software licenses, configuring security groups, provisioning devices, and scheduling orientation. Proper IT onboarding ensures new staff are productive and secure from day one.
The process of securely removing a departing employee’s access to company systems, including disabling accounts, revoking licenses, recovering devices, transferring data ownership, and updating security groups. Timely IT offboarding is critical to preventing unauthorized access after an employee leaves.
Book a free discovery call to review your fully managed IT needs. If we’re a good fit, we’ll send you a tailored proposal and quote.
Book a free Discovery Call. We’ll ask about your team, your tech, your pain points, and your security requirements. Then we’ll build your IT plan and quote.
No generic packages, no pressure.
