Security glossary

Plain definitions for the terms that appear on product pages, including ours. Last updated 24 September 2026.

Adware

Software that injects advertising into pages or redirects searches. Often bundled with free downloads and deliberately awkward to remove.

AMTSO

The Anti-Malware Testing Standards Organization, which publishes the standard that the main independent testing laboratories work to.

Behavioural detection

Identifying malware by what a program does while running, rather than by recognising the file. Catches novel threats; necessarily acts after execution has begun.

Credential stuffing

Automatically replaying address-and-password pairs stolen from one breached service against many other services. It succeeds only where passwords have been reused.

Encryption

Encoding data so that only a holder of the key can read it. It protects content in transit or at rest; it does not conceal the fact that a connection took place.

False positive

Legitimate software wrongly identified as malicious. Independent tests score this against a product, because an over-aggressive scanner is its own kind of problem.

Firewall

A filter controlling which network connections a device accepts or initiates. Every mainstream operating system includes one.

Fingerprinting

Identifying a device from the combination of its characteristics — screen size, fonts, time zone, graphics behaviour — rather than from a cookie. A VPN does not prevent it.

Heuristic analysis

Inspecting a file for structural signs of malice without running it and without an exact match in a signature database.

Infostealer

Malware whose purpose is to collect saved passwords, browser session cookies and wallet files and transmit them to an attacker.

Phishing

A fraudulent message designed to make you hand over credentials or money, usually by impersonating an organisation you trust and imposing a deadline.

PUP / PUA

Potentially unwanted program or application. Not quite malware, not quite legitimate: toolbars, aggressive “optimisers”, bundled extras you did not ask for.

Ransomware

Malware that encrypts files and demands payment for the decryption key. A restorable backup, kept disconnected, is the only reliable defence.

Real-time protection

Continuous scanning of files as they are opened, written or executed, as opposed to a scan you start manually.

Reputation service

A cloud lookup that judges a file by how widely and how long it has been seen across the vendor’s installed base. Rare and recent is treated as suspicious.

Rootkit

Software that conceals the presence of other software from the operating system and from scanners, typically by interfering at a low level.

Sandbox

An isolated environment in which code can run without reaching the rest of the system. Both a detection technique and the security model that iOS applies to every app.

Signature

A pattern — often a file hash or byte sequence — that identifies a specific known piece of malware.

Two-factor authentication (2FA)

Requiring a second proof of identity in addition to a password. An app-based code or a hardware key is stronger than an SMS.

VPN

Virtual private network. An encrypted tunnel between your device and a provider’s server. It hides your browsing from the local network and your address from the site you visit. It does not make you anonymous. See the explanation in our main article.

Zero-day

A vulnerability being exploited before a patch exists. In marketing copy the word is often used more loosely to mean any recent threat.