Security glossary
Plain-English definitions of phishing and email-security terms: SPF, DKIM, DMARC, BEC, smishing, spear phishing, whaling and more.
- Allow-listing
- Configuring email or security systems to always accept messages from approved senders, such as a phishing simulation platform, so tests reach inboxes.
- Angler phishing
- A scam where attackers pose as a company’s customer-support account on social media to trick people who have posted complaints.
- Business email compromise (BEC)
- Fraud in which an attacker impersonates or takes over a real business email account to redirect payments or request sensitive data.
- Clone phishing
- Resending a copy of a genuine email the victim already received, with the link or attachment swapped for a malicious one.
- Credential harvesting
- Collecting usernames and passwords through fake sign-in pages, usually reached from a phishing link.
- Display-name spoofing
- Setting the visible sender name to someone trusted (e.g. your CEO) while the actual email address is unrelated.
- DKIM
- DomainKeys Identified Mail: a cryptographic signature added to outgoing email so receivers can check it wasn’t altered and came from an authorised server.
- DMARC
- A DNS policy telling receiving mail servers what to do with messages that fail SPF or DKIM alignment for your domain: nothing, quarantine, or reject.
- Domain spoofing
- Forging the sender address so an email appears to come from a domain the attacker doesn’t control.
- Lookalike domain
- A domain registered to resemble a real one, using swapped letters, extra words, or different endings, such as paypa1.com.
- Malware
- Malicious software, including ransomware, spyware and trojans, often delivered through phishing attachments or links.
- MFA
- Multi-factor authentication: requiring a second proof of identity, such as an app prompt or security key, in addition to a password.
- MFA fatigue
- Bombarding someone with sign-in approval prompts until they accept one just to make them stop.
- Pretexting
- Inventing a believable scenario (a pretext) to persuade someone to share information or take an action.
- QR-code phishing (quishing)
- Phishing that uses a QR code to send the victim to a malicious site, often bypassing link scanning in email.
- Ransomware
- Malware that encrypts files or systems and demands payment to restore access.
- Report rate
- The share of recipients who report a phishing email, real or simulated. Rising report rates are a key sign of a healthy security culture.
- Smishing
- Phishing delivered by SMS or messaging apps.
- Manipulating people, rather than technology, into breaking normal security practices.
- Spear phishing
- A targeted phishing attack tailored to a specific person or role using researched details.
- SPF
- Sender Policy Framework: a DNS record listing which mail servers are allowed to send email for a domain.
- Typosquatting
- Registering misspelled versions of popular domains to catch people who mistype an address.
- Vishing
- Voice phishing: scams carried out over phone calls, increasingly using AI-generated voices.
- Whaling
- Spear phishing aimed at senior executives, whose access and authority make them high-value targets.