Cybersecurity in Plain Language: A Policymaker's Glossary
Earlier in this series
You cannot regulate what you cannot name.
I have spent most of my working life translating between technical people and everyone else. I did it in B2B sales, where I learned that nobody buys what they do not understand. I did it as a sysadmin in Kuala Lumpur, training end users who just wanted their work to be safe. I did it in a security operations centre at a Nordic telecom, explaining incidents to managers under pressure. Now, studying international relations in Istanbul, I watch smart policy people freeze the moment the vocabulary turns technical.
That freeze has consequences. Laws get written around words their drafters cannot define. So here is my working glossary: the terms I believe a policymaker actually needs, in plain language, one concept per block. I wrote about how states organise around these ideas in Why Isolated States Build Cyber Resilience Differently. This piece gives you the vocabulary underneath.
The core mechanics
Vulnerability
A vulnerability is a weakness in software, hardware, or a process that could be abused. It is not an attack; it is the unlocked window before anyone climbs through it. Policy angle: when a law demands companies "fix vulnerabilities promptly," someone must define promptly — I built a vulnerability management programme at my own startup, and I describe the practical trade-offs in Building a Vulnerability Management Program From Zero.
Exploit
An exploit is the method — usually a piece of code — that actually abuses a vulnerability. If the vulnerability is the unlocked window, the exploit is the technique for climbing through it. Policy angle: some governments buy and stockpile exploits; that is a policy choice with trade-offs, not a neutral technical act.
Patch
A patch is the fix a vendor releases to close a vulnerability. Applying patches sounds trivial and is not: in hospitals, factories, and power grids, updating software can interrupt systems that must not stop. Policy angle: mandating "patch within 30 days" without funding downtime and testing is mandating a fiction.
Zero-day
A zero-day is a vulnerability the vendor does not yet know about, so no patch exists — defenders have had "zero days" to prepare. They are rare, expensive, and prized by intelligence services. Policy angle: most national incidents involve old, unpatched flaws, not zero-days; do not let dramatic vocabulary distort budget priorities.
The threats
Malware
Malware is any software written to do harm: steal data, spy, destroy, extort. It is a category, like "weapon," not one specific thing. Policy angle: a law that treats all malware alike will treat a nuisance and a grid-destroying tool as the same offence.
Ransomware
Ransomware is malware that scrambles an organisation's data and demands payment to unscramble it. It has become a business model, with criminal groups running it like companies. Policy angle: whether to ban ransom payments is a genuine dilemma — bans deter attackers in theory and punish desperate hospitals in practice.
Phishing
Phishing is deception by message: an email or text that impersonates someone trusted to trick a person into clicking, paying, or handing over a password. It is the most common way real attacks begin. Policy angle: awareness campaigns matter, but so does making impersonation technically harder — I will unpack this fully later in the series.
Threat actor
A threat actor is whoever is behind an attack: a criminal group, a state agency, a lone opportunist, an insider. The label matters because motive shapes both the attack and the sensible response. Policy angle: a policy designed against criminals will not stop a state, and vice versa.
The response side
Incident
An incident is a security event that actually causes or threatens harm — a breach, an outage, a theft. Not every alarm is an incident, and deciding which is which is skilled work I did daily as a SOC analyst. Policy angle: mandatory "incident reporting" laws live or die on how the word is defined.
CSIRT / CERT
A CSIRT (Computer Security Incident Response Team), often called a CERT, is the standing team that handles incidents: detecting, coordinating, containing, and helping victims recover. Nations have them, and so do large organisations. Policy angle: a country without a national CSIRT has no fire brigade for its digital infrastructure — a full explainer is coming in this series.
Attribution
Attribution is the act of determining who carried out an attack. Technically it is probabilistic detective work; politically it is a statement with diplomatic consequences. Policy angle: "we are confident it was state X" is an intelligence judgement plus a political decision, never a simple technical readout.
The stakes
Critical infrastructure
Critical infrastructure means the systems a society cannot function without: power, water, hospitals, banking, telecoms, transport. Their compromise is not an IT problem; it is a public safety problem. Policy angle: the hard question is where to draw the list's boundary, because designation brings both protection and regulatory burden.
Encryption
Encryption is mathematics that scrambles information so only intended parties can read it. It protects banking, medicine, journalism, and government alike. Policy angle: proposals to weaken encryption "only for criminals" are proposals to weaken it for everyone; there is no lock that opens only for the honest.
Supply chain attack
A supply chain attack compromises a trusted supplier — a software vendor, a service provider — to reach that supplier's many customers at once. One poisoned update can enter thousands of organisations through the front door. Policy angle: this is why procurement rules and vendor security requirements are security policy, not paperwork.
Resilience
Resilience is the ability to absorb an attack or failure and keep functioning — degraded, perhaps, but alive. It accepts that prevention will sometimes fail. Policy angle: mature national strategy funds recovery, redundancy, and drills, not only walls.
What to do with these words
A closing thought from a teacher's notebook. Do not memorise this list. Instead, next time a briefing paper crosses your desk, check whether its authors could define these terms consistently. In my experience, a document that uses vulnerability, exploit, and incident interchangeably was written by someone guessing.
Language is the cheapest security investment a government can make. It costs a glossary and an afternoon. Everything else in this series — response teams, phishing, zero trust, encryption debates — builds on these fifteen words.
Teaching Cybersecurity to People Who Will Never Write Code →