Ethical Hacking & Cybersecurity Vocabulary

Ethical hacking (also known as penetration testing or white hat hacking) involves attempting to breach systems with the explicit written permission of the system owner, in order to identify and fix vulnerabilities before malicious actors can exploit them. Cybercrime involves attacking systems without authorisation, which is illegal. The key distinction is consent: ethical hackers operate within a defined scope and legal agreement, and their findings are reported to the client to improve security.

White hat hackers are ethical security professionals who test systems with permission to find and fix vulnerabilities. Black hat hackers exploit vulnerabilities illegally for personal gain, data theft, or malicious disruption. Grey hat hackers occupy an ethical middle ground: they may probe systems without explicit permission but typically disclose vulnerabilities to the owner rather than exploiting them maliciously. Grey hat activity is still technically unauthorised and may be illegal depending on jurisdiction.

A zero-day vulnerability is a security flaw in software or hardware that is unknown to the vendor and has therefore not yet been patched. The name refers to the fact that developers have had “zero days” to fix the problem. Zero-day vulnerabilities are particularly dangerous because there is no available defence at the time of exploitation. They are highly valued in both criminal and intelligence communities and may be exploited before the vendor even becomes aware of the flaw.

Social engineering refers to psychological manipulation techniques used to trick individuals into revealing confidential information, granting access, or performing actions that compromise security. Unlike technical attacks that exploit software vulnerabilities, social engineering exploits human psychology — trust, authority, urgency, or fear. Common examples include phishing emails, vishing (voice phishing), pretexting (creating a fabricated scenario), and baiting (leaving infected USB drives for victims to find).

Malware is an umbrella term for any malicious software, including viruses, worms, trojans, ransomware, spyware, and adware. A virus is a specific type of malware that attaches itself to legitimate files and spreads by replicating itself when those files are executed. All viruses are malware, but not all malware is a virus. Ransomware, for example, is malware but does not necessarily replicate in the way a virus does.

Two-factor authentication (2FA) is a security method that requires a user to provide two distinct forms of verification before accessing an account or system. The first factor is typically something the user knows (a password); the second factor is something the user has (a one-time code sent to a phone or generated by an authentication app) or something the user is (a biometric such as a fingerprint). 2FA significantly reduces the risk of account compromise even if a password is stolen.

A Distributed Denial of Service (DDoS) attack is a cyberattack in which multiple compromised systems — often a botnet of thousands of infected computers — simultaneously flood a target server, network, or website with traffic. The volume of requests overwhelms the target’s capacity to respond, rendering it unavailable to legitimate users. DDoS attacks are commonly used against e-commerce sites, gaming platforms, financial services, and critical infrastructure.

A honeypot is a decoy system or resource deliberately designed to attract attackers and distract them from real targets. Honeypots may mimic vulnerable servers, databases, or login portals. When an attacker interacts with a honeypot, their techniques, tools, and behaviour can be observed and logged by the security team, providing valuable threat intelligence. Honeypots also serve as an early warning system, alerting defenders that an attacker is active within the network.

SIEM stands for Security Information and Event Management. It refers to software platforms that collect, aggregate, and analyse log and event data from across an organisation’s IT infrastructure in real time. SIEM systems identify anomalous patterns that may indicate a security incident, generate alerts, and support compliance reporting. They are a central tool in security operations centres (SOCs) and are used to correlate events across multiple systems to detect sophisticated attacks.

Cybersecurity vocabulary is essential for IT professionals, software developers, network engineers, and security analysts working in international or English-language environments. It is also increasingly important for general users who want to protect themselves online and engage critically with news about data breaches, hacking incidents, and digital policy. The global cybersecurity industry operates primarily in English, and mastering this vocabulary enables learners to access certifications, documentation, research, and professional communities that shape the field.