Cybersecurity Awareness Training Glossary: 100+ Essential Terms for Safer Decisions and Measurable Human Risk

Security language fails at the exact moment it matters most. An employee holding a suspicious invoice, an unexpected verification prompt, or a voicemail from someone who sounds like the chief financial officer has seconds to classify what is happening and choose an action. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, phishing and spoofing generated 191,561 complaints, the highest number of reports in any category.

That volume reaches ordinary employees rather than security analysts. When terminology stays locked inside policy documents, incident tickets, and vendor documentation, hesitation replaces reporting and small mistakes become organizational losses.

A cybersecurity awareness training glossary closes that gap by giving every role the same plain-language definitions, the same verification habits, and the same escalation path. This guide covers:

• Program vocabulary that describes how a cybersecurity awareness training program is designed, delivered, tested, and measured;
• Phishing and social engineering terms employees encounter across email, voice, SMS, QR codes, and collaboration tools;
• Malware, identity, data protection, and network definitions that connect technical controls to daily employee decisions;
• Deepfake AI and generative AI language that explains how synthetic content changes verification requirements;
• Guidance for turning cybersecurity awareness training definitions into role-based practice, human-risk metrics, and governance records.

Employees meet unfamiliar security language during the exact moments cyberattackers engineer for speed, and hesitation converts a recoverable mistake into a reportable loss. Adaptive Security turns definitions into rehearsed decisions.

Take a self-guided tour

What Is Cybersecurity Awareness Training?

Cybersecurity awareness training is an ongoing program that teaches employees to recognize cyber threats, make safer decisions, and report suspicious activity before it becomes an incident. It translates security policies into practical actions across email, messaging, voice, collaboration tools, and daily work. Awareness is a continuous process for building reliable security behavior across the organization, never a one-time compliance course.

The distinctions below separate terms that program owners, managers, and employees often use interchangeably. Each one changes what an organization measures and what it expects people to do under pressure.

Cybersecurity Awareness Versus Cybersecurity Training

Cybersecurity awareness and cybersecurity training pursue the same human-risk objective while operating at different depths. Awareness gives employees context about what cyber threats look like and why a decision matters, while training builds the repeatable skills required to respond correctly under pressure.

An awareness presentation might show how a fake invoice, deepfake video, or urgent password-reset request manipulates trust. Formal training asks employees to inspect the sender, verify the request through a second channel, report the message, or refuse an unauthorized transfer. Awareness changes what people notice, and training changes what they do.

That distinction matters because employees make security decisions while managing deadlines, customers, financial requests, and unfamiliar technology. A policy document cannot rehearse those decisions, and a course that explains phishing without allowing employees to practice reporting it leaves a gap between knowledge and action.

Education is broader than awareness or training. Cybersecurity education develops a deeper technical understanding for roles that require it, so a security analyst might study identity architecture, threat intelligence, or incident response while a software engineer learns secure development practices. General employees need enough practical knowledge to recognize a suspicious request and escalate it quickly.

Policy communication tells employees what the organization allows or prohibits. It might state that sensitive data cannot be pasted into an unapproved AI tool, that payment changes require independent verification, or that credentials must never be shared. Communication creates visibility, while cybersecurity awareness training converts those rules into decisions employees can execute.

Behavior change is the measurable result of effective instruction. It means an employee pauses before approving an unusual payment, checks a link before entering credentials, reports a suspicious text, or challenges a request that appears to come from an executive. Completion rates show that content was delivered, while behavior data shows whether the workforce is making safer choices.

Human risk describes the likelihood that people, through action or inaction, will expose an organization to cyber harm. It carries no judgment about employee character or competence, and it shifts with role, access, workload, public exposure, previous behavior, and attack vector. According to Verizon's 2026 Data Breach Investigations Report, 62% of confirmed incidents involve a human element.

A finance employee handling wire transfers faces different social-engineering pressure than a developer with source-code access, while an executive may face targeted impersonation built from publicly available information. Human risk therefore belongs in a risk register alongside technical exposure rather than in an annual completion report.

Security culture is the shared expectation that protecting information is part of everyone's work. In a healthy security culture, employees report mistakes early, managers reinforce verification practices, and security teams treat reports as useful signals instead of reasons for blame. The goal is to make secure decisions normal, supported, and repeatable across every department.

The 2024 NIST Cybersecurity and Privacy Learning Program guidance frames learning as a lifecycle that encourages behavior change and contributes to a security and privacy culture. That model places awareness inside risk management rather than treating it as an annual administrative task.

The Purpose of a Cybersecurity Awareness Training Program

The purpose of a cybersecurity awareness training program is to help every person recognize risk, choose the safer action, and involve the right team before damage spreads. It creates a human layer of defense against cyber threats that technical controls cannot fully interpret, including business email compromise (BEC), vishing, smishing, spear phishing, malicious QR codes, and deepfake impersonation.

A complete program serves the entire workforce rather than office-based employees alone:

• All employees and contractors: Practical guidance covers phishing, passwords, multifactor authentication, data handling, device security, and incident reporting;
• High-risk teams: Finance, executive assistants, procurement, human resources, legal, and customer support need scenarios tied to payment fraud, sensitive records, impersonation, and account recovery;
• Privileged technical staff: Administrators, developers, and security personnel require role-specific instruction on access management, secrets, cloud environments, secure development, and incident response;
• Managers and executives: Leaders set expectations for reporting and verification, and their public profiles and authority also make them frequent impersonation targets;
• New hires and temporary workers: People entering the organization need security expectations before they receive access rather than months after onboarding.

The delivery format should match the behavior being developed. Awareness presentations introduce a campaign theme or explain a new attack pattern to a department, while formal instruction supports structured learning, policy acknowledgment, and role-based requirements. Online learning gives distributed teams a consistent baseline, and classroom instruction allows discussion of local workflows and sensitive scenarios.

Visual reminders reinforce decisions at the moment employees need them. Posters, desktop messages, chat prompts, newsletters, and short videos can prompt teams to verify payment changes, report suspicious messages, or avoid entering credentials after following an unsolicited link. These reminders keep security cues visible between learning sessions without replacing practice.

Quizzes test recall while phishing simulations test decisions. A quiz can ask whether an email contains warning signs, and a phishing simulation measures whether an employee clicks, reports, or ignores a realistic message. Voice and video exercises rehearse verification when an apparent executive requests urgent action, because knowing the correct answer does not guarantee that a person will recognize the same pressure in a live workflow.

Microlearning turns instruction into short, focused practice. A five-minute module can explain one behavior, such as checking a domain, handling a QR code, or confirming a vendor bank-account change. Short lessons work well after a failed phishing simulation, a reported incident, a role change, or the emergence of a new attack pattern.

Organizations can reinforce these behaviors through security awareness training that connects content to employee behavior instead of assigning identical lessons to everyone. An effective program combines formats: presentations establish shared language, online and classroom sessions build understanding, and visual reminders reinforce memory. Quizzes check comprehension, phishing simulations reveal behavior under realistic conditions, and microlearning closes a specific gap while the event remains relevant.

Why One-Time Training Is Not Enough

One-time cybersecurity awareness training fails because recognition and secure decision-making degrade without reinforcement while the attack environment keeps changing. An annual course can document that an employee completed a lesson, but it cannot prepare that employee for every new form of AI-generated phishing, credential theft, impersonation, or data exposure encountered during the following year.

Ongoing instruction builds a feedback loop in which the organization observes where employees struggle, delivers targeted lessons, and measures whether decisions improve. If a department repeatedly clicks vendor impersonation emails, its targeted lesson should address invoice verification. If executives appear in public videos that cyberattackers can repurpose, impersonation drills should include voice and video verification.

Continuous programs also keep security expectations aligned with organizational change. New software, remote work patterns, acquisitions, regulatory obligations, and AI tools create new decisions for employees, and instruction must follow those changes. A policy written during onboarding cannot explain a collaboration platform introduced six months later or a generative AI tool employees begin using without formal approval.

The 2024 NIST guidance recommends a lifecycle that includes planning, implementation, evaluation, and improvement. That structure moves security leaders beyond completion reporting toward reporting rates, unsafe actions in phishing simulations, time to report, repeat failures, and risk trends by role. Those signals refine the program and direct coaching where it carries the greatest operational value.

Employees should experience instruction as skill-building instead of punishment. A failed phishing simulation identifies a moment for practice, and a reported mistake gives the security team an opportunity to contain harm early. When leaders reward fast reporting and make verification procedures usable, employees become active sensors across the organization.

Cybersecurity awareness training therefore means more than teaching definitions or distributing annual slides. It is a coordinated program connecting awareness, education, practice, measurement, and reinforcement. Its value is determined by what employees do when a convincing request arrives and the pressure to act quickly is highest.

Annual courses satisfy auditors while leaving employees unprepared for cyberattacks arriving between refresher cycles. Adaptive Security delivers continuous lessons built from current attack patterns and reinforces verification behavior.

Explore the platform

How Should Organizations Use a Cybersecurity Awareness Training Glossary?

A cybersecurity awareness training glossary works as an operational reference for daily decisions. Readers should begin with the terms that match their role, connect each definition to a workplace decision or reporting behavior, and revisit high-impact entries whenever policies, cyber threats, or tools change.

Speed decides outcomes in that sequence. According to the CrowdStrike 2026 Global Threat Report, the average adversary breakout time, the window between initial access and lateral movement, dropped to 29 minutes, with the fastest measured at just 27 seconds.

1. Choose a Reading Path for Each Audience

A glossary becomes useful when readers begin with terms that affect daily decisions. Beginners should start with phishing, malware, multifactor authentication, social engineering, and data protection, reading each definition in context and following related terms to build connected understanding.

Managers should prioritize terms that shape team procedures and escalation decisions. Business email compromise (BEC), vishing, smishing, insider risk, access control, and incident reporting belong near the top of their reading path because managers approve payments, handle sensitive information, and receive suspicious requests from employees.

Technical staff need stronger connections between attack methods, controls, and response processes. Entries on spear phishing, identity and access management, endpoint detection, security information and event management, vulnerability management, and zero trust clarify how employee behavior interacts with technical safeguards.

Security awareness leaders should read across every role group because their job is to translate technical language into actions employees can apply under pressure. A security awareness training program becomes more effective when its glossary terms match phishing simulation scenarios, policy language, reporting buttons, and manager guidance.

2. Write Accurate, Usable Definitions

Every entry should follow the same plain-language structure so readers can scan it and act correctly. Include the term, its expanded acronym, a concise meaning, a realistic workplace example, related terms, the required employee action, and a link to the relevant internal policy or reporting channel.

An entry for BEC should explain that business email compromise is fraud using a trusted identity or account to influence a payment, data disclosure, or other business action. A workplace example might describe a message that appears to come from a chief financial officer and requests an urgent vendor payment. The required action should be explicit: verify the request through an independently sourced phone number and report the message through the approved channel.

Write the full term before using an acronym unless the abbreviation is already familiar to the intended audience. Use "multifactor authentication (MFA)" before using MFA alone, because unexplained technical abbreviations increase reading friction for new employees, nontechnical teams, and executives.

Separate official terminology from vendor marketing language by identifying who defines the term and what evidence supports it. Regulatory, legal, standards, and government definitions should take priority when a term carries a formal meaning. Product descriptions, campaign names, and promotional labels should never replace a precise explanation of what the technology or behavior does.

3. Connect Terms to Actions and Policies

A definition becomes operational when it tells employees what to do. Link every high-risk term to an approved behavior, such as reporting a suspicious message, pausing a payment, confirming a voice request through another channel, or contacting the security team before sharing data.

Connect related terms deliberately. An entry for vishing should point readers to voice phishing, impersonation, verification procedures, and BEC, while an entry for open-source intelligence (OSINT) should explain how publicly available information personalizes spear phishing and connect to the policy governing public exposure of employee and executive details.

Review definitions whenever policies, tools, or attack patterns change. Add a review date and name the owner responsible for updates, then explain any change in plain language so employees understand why the instruction moved.

Accessibility requires more than translation. Use short sentences, avoid idioms, define one concept at a time, and provide examples that work across regions and roles. For multilingual workforces, publish approved translations, preserve the original English term in parentheses, and have a fluent security or legal reviewer validate the meaning instead of relying on literal machine translation.

Definitions stored in a static reference page rarely reach the employee holding a suspicious invoice on deadline. Adaptive Security embeds that language inside scenarios employees rehearse before pressure arrives.

Book a demo

What Terms Describe a Cybersecurity Awareness Training Program?

A cybersecurity awareness training glossary separates the terms describing a program's purpose, delivery, testing, and outcomes. A security awareness program builds employee judgment across everyday security decisions, while information security awareness training and end user security awareness training describe instruction for people who use organizational systems and data. Mature programs combine education, phishing simulation, measurement, reinforcement, and governance rather than relying on one annual course.

Generic instruction gives everyone the same baseline content. Role-based instruction ties practice to the decisions made by finance teams, executives, administrators, customer support staff, contractors, remote workers, and employees using personal devices. Both belong in a mature program, and the right balance depends on exposure, job responsibilities, access privileges, and the behaviors the organization needs to change.

Core Components of a Cybersecurity Awareness Training Program

A security awareness program is the coordinated framework an organization uses to build safer decisions, measure human risk, and update instruction as cyber threats and business processes change. It includes policy communication, cybersecurity awareness training, phishing simulation, reporting workflows, manager involvement, compliance records, and outcome measurement. The program owner connects these activities to business risk instead of treating course completion as the finish line.

A cybersecurity awareness training program typically includes these terms:

• Information security awareness training: Instruction on protecting information confidentiality, integrity, and availability, covering data handling, access control, passwords, multifactor authentication, device security, privacy, and incident reporting;
• End user security awareness training: Practical instruction for employees, contractors, and other people who interact with organizational accounts, applications, devices, or data, focused on decisions made during live work such as opening an attachment or approving a payment;
• Annual security awareness refresher: A recurring baseline course that renews expectations and documents participation, supporting governance and compliance without reinforcing behavior against cyber threats that change throughout the year;
• Phishing simulation or phishing test: A controlled exercise presenting a realistic but harmless phishing message or request, measuring actions such as clicking, submitting credentials, reporting the message, or verifying through another channel;
• Assessment: Any structured measurement of knowledge, judgment, or behavior, where a quiz measures recall, a phishing test measures response under pressure, and a risk assessment identifies where additional practice is required;
• Microlearning: Short lessons delivered when a learner needs reinforcement, often after a missed signal or risky action, drawing value from timing and relevance instead of brevity alone;
• Scenario-based learning: Practice built around a recognizable work situation, such as a supplier changing bank details or an executive requesting sensitive files from an unfamiliar number;
• Gamification: Progress markers, challenges, scores, or friendly team goals that increase participation, making practice engaging without turning employee mistakes into public punishment;
• Security-conscious culture: A workplace norm in which people verify unusual requests, protect sensitive information, and report concerns without fearing blame;
• Human defense layer: Employees who interrupt cyberattacks by recognizing suspicious behavior and escalating it before damage occurs, applying judgment that often determines whether a social engineering attempt advances.

Generative AI has widened the gap these components must close. According to the National Cybersecurity Alliance's 2025–2026 Oh Behave! The Annual Cybersecurity Attitudes and Behaviors Report, 58% of employed participants reported they have not received any training on the security or privacy risks of AI tools, despite 65% now using AI and 43% admitting to sharing sensitive work information with AI tools. That gap concentrates risk precisely where visibility is lowest.

A strong security awareness training program joins these components into a repeatable cycle. The organization establishes a baseline, assigns relevant learning, runs controlled tests, reviews behavior, reinforces weak areas, and updates scenarios as business processes and attack methods evolve.

How Do Generic, Role-Based, and Microlearning Approaches Differ?

Generic instruction gives every employee the same foundation. It efficiently explains organization-wide policies, reporting channels, password practices, data classification, and common social engineering signals while creating a consistent standard for new hires.

Its limitation is context. A finance employee deciding whether to release a wire transfer faces a different human-risk pattern from a customer support representative verifying an account takeover request. An executive is more likely to receive impersonation attempts involving authority and urgency, while an administrator handles privileged access, recovery workflows, and high-impact configuration changes.

Role-based instruction assigns groups different scenarios, difficulty levels, and reinforcement:

• Finance teams: Business email compromise (BEC), invoice manipulation, vendor impersonation, and payment verification;
• Executives: Voice-based impersonation, deepfake meeting requests, and urgent disclosure demands;
• Administrators: Credential-reset abuse, privileged-access prompts, and suspicious support requests;
• Customer support teams: Account verification and data-disclosure scenarios;
• Contractors and remote workers: External networks, personal devices, shared spaces, and nonstandard communication channels.

Microlearning makes role-based instruction easier to sustain. A short module after a failed phishing simulation can explain the signal the learner missed, show the safer decision, and require a quick retry. Scenario-based learning then transfers that lesson to a new context, which prevents employees from memorizing one obvious template.

Gamification can increase participation through private progress goals or team completion targets. The program should reward reporting and verification rather than celebrating low click rates at an individual's expense. Practice becomes more valuable when employees apply the same judgment across email, voice, SMS, and in-person requests.

Why Are Completion Rates Not Enough?

Completion rates answer an administrative question about whether assigned employees opened and finished the course. They do not answer the security question about whether employees made safer decisions when a cyberattacker created pressure, authority, or uncertainty.

As NIST computer scientist Julie Haney and University of Maryland Associate Professor Wayne Lutters concluded in their peer-reviewed analysis published in Computer (October 2020), compliance metrics do not tell the whole story and fail to measure the effectiveness of the program in a sustained change in employee attitudes and behaviors.

Behavioral outcomes provide stronger evidence. Program owners should compare phishing simulation reporting rates, click or submission rates, time to report, repeat failure patterns, verification behavior, and risk changes by department or role. A completed module followed by repeated unsafe actions indicates that the content reached the learner without changing the decision.

The 2024 NIST SP 800-50 Revision 1 guidance frames a cybersecurity and privacy learning program as a lifecycle that encourages behavior change, supports a security and privacy culture, and uses metrics to improve the program over time. That approach shifts the reporting conversation toward evidence that finance employees report more quickly, repeat failures decline, and high-risk administrators verify requests more consistently.

Assessment should combine knowledge checks with realistic practice. Quizzes establish whether employees understand policy, phishing tests measure recognition and response, and vishing and smishing exercises test whether employees apply verification habits when email safeguards are absent. Follow-up instruction should address the specific behavior and reassess it through a different scenario.

How Does a Positive, Non-Punitive Culture Improve Reporting?

A security-conscious culture depends on trust because employees must report uncertainty before they have complete proof. If a phishing test becomes a disciplinary trap, employees learn to hide mistakes instead of raising concerns. If the organization treats a failed phishing simulation as a coaching signal, employees receive a clear path to improve.

Program owners should communicate that phishing simulations are practice rather than surveillance. Feedback should explain what happened, identify the decision point, and show the verification step that would have interrupted the cyberattack. Managers should receive team-level patterns instead of public rankings that shame individuals, while employees who report suspicious messages should receive recognition for creating an early-warning signal.

A positive program still requires accountability. High-risk roles need additional exercises, managers need visibility into repeated patterns, and access decisions should reflect sustained behavior where policy allows. Accountability should follow coaching, evidence, and fair expectations rather than embarrassment.

Completion dashboards report attendance while concealing whether finance approvers actually verify a bank-detail change under deadline pressure. Adaptive Security measures reporting speed, repeat failures, and verification behavior by role.

Take a self-guided tour

Which Phishing and Social Engineering Terms Should Employees Know in Cybersecurity Awareness Training?

Phishing is the use of deception to make a person click, reply, disclose information, transfer money, or approve access for a cyberattacker. Social engineering is the broader manipulation tactic, while spoofing and impersonation make a message, identity, phone number, website, or voice appear trustworthy. Effective cybersecurity awareness training teaches employees to recognize how these techniques combine across email, SMS, voice, websites, and collaboration tools.

The financial scale explains the emphasis. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, internet crime drove $20.877 billion in reported losses, a 26% jump over the prior year.

Phishing and Impersonation Terms

Phishing is a social engineering cyberattack that uses a fraudulent message or interaction to trigger an unsafe action. An employee might receive an urgent message claiming payroll access will expire unless they sign in immediately. Employee action: Pause, verify the request through a trusted channel, and report the message using the company's approved reporting process.

Email phishing is phishing delivered through email, usually through a malicious link, attachment, reply request, or fake login page. A message appearing to come from a cloud-storage provider asks an employee to review a shared document and enter a corporate password. Employee action: Leave the link and attachment closed, inspect the sender, and report the email.

Spear phishing is targeted phishing personalized for a specific person, role, department, or organization. A cyberattacker uses an employee's public job title and current project details to send a convincing request for a confidential contract. Employee action: Treat unexpected familiarity as a reason to verify rather than proof of legitimacy.

Business email compromise (BEC) is a fraud scheme in which a cyberattacker compromises or impersonates a trusted business account to request money, sensitive data, payroll changes, or access. A fake chief financial officer asks an accounts-payable employee to change a vendor's bank details before a payment deadline. Employee action: Confirm financial or account-change requests using a known phone number or an established internal workflow.

According to the FBI's 2025 Internet Crime Report, released in April 2026, cyber-enabled fraud accounted for almost 85% of all losses reported to IC3, totaling $17.7 billion, and business email compromise remains the persistent risk at the costly center, accounting for $3.046 billion in losses across 24,768 incidents at an average of $123,000 per case.

Spoofing is the falsification of a technical or identity signal so a cyberattacker appears to be a trusted sender, domain, phone number, or service. A message displays the company's name in the sender field even though the actual address uses an unrelated domain. Employee action: Check the complete sender address, reply-to address, link destination, and surrounding context.

Impersonation is the act of pretending to be a specific person or organization. A cyberattacker copies a manager's profile photo and sends a direct message asking an employee to purchase gift cards. Employee action: Contact the supposed sender through a separate, trusted channel before acting.

These terms describe related but distinct parts of a cyberattack. Phishing is the delivery and deception strategy, spoofing makes the source appear authentic, and impersonation adopts a trusted identity. Social engineering supplies psychological pressure, such as urgency, authority, fear, curiosity, or helpfulness.

One BEC campaign can use all four techniques in sequence. CISA's phishing guidance emphasizes slowing down, checking the message, and reporting suspicious activity instead of rewarding urgency with immediate action.

Credential harvesting is the collection of usernames, passwords, authentication codes, session tokens, or other access data. An employee follows a fake Microsoft 365 sign-in page and enters a password that the cyberattacker captures in real time. Employee action: Never enter credentials after following an unsolicited link, and open the service through a saved bookmark or approved application.

Clone phishing is a copy of a legitimate message modified to include a malicious link, attachment, or request. A cyberattacker resends a real invoice thread with a replacement attachment that installs malware or redirects payment. Employee action: Confirm unexpected changes to a familiar thread, attachment, or payment instruction with the original sender.

Social Engineering Techniques

Social engineering is the manipulation of human judgment to obtain information, access, money, or a specific action. A caller claims to be from IT and asks an employee to read out a verification code. Employee action: Refuse to share passwords or codes and contact IT through the official support channel.

Baiting uses an attractive offer, physical item, file, or promise to create curiosity and prompt unsafe behavior. An employee finds a USB drive labeled "2026 Salary Review" in the office and plugs it into a company laptop. Employee action: Leave unknown devices unconnected and hand them to IT or security for inspection.

Double-barrel phishing combines two messages or channels so the second interaction appears to confirm the first. An employee receives a fake invoice by email, followed by a phone call from an alleged supplier who references the invoice and presses for payment. Employee action: Verify both contacts independently instead of treating one message as confirmation of the other.

Angler phishing uses social media, comments, or fake customer-support accounts to target people who publicly complain or ask for help. An employee posts about a locked account and receives a direct message from a fraudulent support profile requesting login details. Employee action: Use the company's bookmarked support page and never send credentials through social media.

Watering-hole attacks compromise a website or online resource that a target group regularly visits. An industry association's event page is altered so visitors receive a malicious download. Employee action: Avoid unexpected downloads from familiar sites and confirm software updates through the IT-managed process.

Links, QR Codes, Calls, and Messages

URL obfuscation hides a destination or makes a malicious address resemble a legitimate one. A link displays the company's name but resolves to a misspelled domain or a string of encoded characters. Employee action: Hover over links on a computer, inspect the full destination, and navigate manually when the address is unclear.

URL shortening replaces a long web address with a compact redirect link. A message from an unknown sender uses a shortened URL to conceal a fake benefits portal. Employee action: Leave shortened links from unsolicited messages unopened, then request the full destination or use a trusted bookmark.

Homograph attacks use visually similar characters from different alphabets to create a deceptive domain. A fake payroll site substitutes a Cyrillic character for a Latin letter in the company name. Employee action: Check the registered domain carefully and use password managers or phishing-resistant sign-in methods that bind authentication to the legitimate site.

QR-code phishing, or quishing, uses a QR code to direct someone to a fraudulent website or download. A printed notice in the break room claims employees must scan a code to confirm benefits enrollment. Employee action: Treat QR codes as links, preview the destination before opening it, and access benefits through the official portal.

Caller ID spoofing falsifies the number or name shown on a phone display. A call appears to come from the company help desk while the caller requests a remote-access code. Employee action: End the call and dial the help desk using a number from the company directory.

Vishing is voice phishing, in which a cyberattacker uses a phone call, voicemail, voice message, or synthetic voice to obtain information or trigger an action. A caller claiming to be an executive asks an employee to approve an urgent wire transfer. Employee action: Treat a familiar voice or caller ID as unproven and verify the request through a separate channel.

Smishing is phishing delivered by SMS or another text-messaging service. An employee receives a text claiming that a corporate package is delayed and asking them to enter work credentials. Employee action: Refuse to reply, click, or call the number in the message; report it and delete it.

Out-of-band authentication checks verify a high-risk request through a different, trusted communication channel from the one that delivered it. An employee receives a payment request by email and confirms it with the requester through the company directory's phone number. Employee action: Use contact details sourced independently of the suspicious message.

NIST's 2025 digital identity guidance distinguishes ordinary out-of-band codes from phishing-resistant authentication because a cyberattacker can relay manually entered codes to the legitimate service. NIST Special Publication 800-63B recommends phishing-resistant authentication when practical.

A voice phishing simulation is an authorized exercise that recreates a suspicious phone call, voicemail, or voice-based request without collecting real credentials or transferring funds. An employee receives a controlled call imitating an urgent manager request and practices verification. Employee action: Treat the exercise as skill-building, identify the pressure tactic, and report it through the normal process.

An SMS phishing simulation is an authorized text-message exercise that tests whether employees recognize malicious links, fake delivery notices, account alerts, or urgent requests. An employee receives a simulated benefits message and uses the reporting workflow instead of opening its link. Employee action: Report the message, complete the assigned coaching, and apply the same behavior to personal-looking texts sent to a work device.

A practical phishing simulation program should cover email, voice, SMS, QR codes, and impersonation together because cyberattackers move between channels when one route fails. Employees do not need to memorize every label before acting safely. They need one durable response: stop, verify independently, report quickly, and ask for help without fear of blame.

Cyberattackers rotate between email, voice, SMS, and QR codes faster than annual content can describe the newest variant to employees. Adaptive Security rehearses recognition across every channel criminals actually use.

Take a self-guided tour

Which Malware and Cyberattack Terms Belong in a Cybersecurity Awareness Training Glossary?

Malware is software intentionally created to disrupt systems, steal information, gain unauthorized access, or damage data. In a cybersecurity awareness training glossary, these terms give employees the vocabulary to recognize suspicious behavior and report it before a technical incident becomes a business crisis. Malware does not always look like an obvious virus, and ransomware is only one malware category among several.

Smaller organizations absorb most of that damage. According to Verizon's 2026 Data Breach Investigations Report, 96% of ransomware victims were small and medium-sized businesses, which typically present unpatched devices, compromised credentials, and limited recovery capabilities.

Malware Families and Delivery Methods

Malware families describe what malicious software does after it reaches a device or account. Ransomware encrypts files or systems and demands payment, often while threatening to publish stolen data. A remote access Trojan (RAT) hides inside a seemingly legitimate file or application and gives a cyberattacker covert control over a device.

A botnet is a group of compromised devices controlled together for fraud, disruption, credential theft, or additional malware delivery.

The delivery method often matters more to employees than the malware's technical name. A malicious file can arrive through a phishing email, a fake invoice, a smishing message, or a vishing call that persuades someone to install remote-support software. Unsafe downloads, pirated applications, browser extensions, compromised accounts, infected removable media, and unpatched software create additional entry points.

CISA's 2025 Medusa ransomware advisory connects ransomware risk with exploited vulnerabilities and directs organizations to patch operating systems, software, and firmware promptly. The practical employee rule is direct: use approved software and storage media, verify unexpected requests through a trusted channel, and report anything that bypasses normal processes through phishing simulations and security awareness training.

Four additional terms describe how cyberattackers find and hide their opportunities:

• Zero-day vulnerability: A security flaw unknown to the vendor or without an available fix, creating exposure before defenders can apply a standard patch;
• Zero-day exploit: The code, technique, or activity that takes advantage of that vulnerability, where the vulnerability is the weakness and the exploit is the method used against it;
• Advanced persistent threat (APT): A patient, well-resourced intrusion in which a cyberattacker maintains access over time to gather intelligence, steal data, or influence operations, which makes unusual account activity and repeated access prompts reportable signals;
• Steganography: The concealment of a message or malicious code inside an ordinary-looking image, document, audio file, or video, because a familiar file can still be unsafe when it arrives unexpectedly or asks the user to enable content.

Cyberattack Techniques Employees May Encounter

Cyberattack techniques explain how an intruder abuses access, trust, authentication, or business workflows. A man-in-the-middle attack places a cyberattacker between two parties so communications or credentials can be intercepted or altered. Employees reduce this risk by using approved networks, checking unexpected login prompts, verifying payment changes independently, and refusing to enter credentials after following an untrusted link.

A brute-force attack repeatedly tries many password combinations until one works, while a dictionary attack is a narrower form that tests words, common phrases, leaked passwords, and predictable variations. Unique passwords stored in an approved password manager and multifactor authentication make these methods harder to convert into account access, though employees must still report unexpected authentication notifications.

Pass-the-hash cyberattacks use a stolen password hash instead of the original password to authenticate to another system. That distinction matters because changing one password does not automatically remove every active session or revoke every stolen credential. Report suspected credential theft immediately so the security team can invalidate sessions, rotate credentials, and investigate related accounts.

A business process compromise manipulates a legitimate workflow without breaking a technical control. A cyberattacker might alter vendor bank details, redirect payroll, change an approval chain, or exploit a procurement exception. The request can appear to come from a real account and follow normal business language, so high-risk changes require independent verification through a known phone number or previously trusted channel.

These techniques frequently overlap. A compromised account can send convincing phishing messages, a phishing link can install a RAT, and stolen credentials can support ransomware deployment. Employees are most effective when they report the first irregular signal, before the cyberattacker has time to combine access methods.

What to Do After a Suspected Infection

A suspected infection is an incident rather than a test of technical skill. Stop interacting with the message, file, website, or device immediately. Avoid clicking additional prompts, deleting suspicious files, restarting the computer repeatedly, attempting self-directed cleanup, or negotiating with a ransomware demand.

Refusal has become the majority response at an organizational level. According to Verizon's 2026 Data Breach Investigations Report, 69% of victims refused to pay ransoms in 2025, up from 65% the prior year, and the median payment fell to $139,875 from $150,000.

Preserve evidence by leaving the message, alert, filename, time, and visible screen state intact when safe to do so. Record what happened in plain language, including whether credentials were entered, a file was opened, a payment was approved, or an external drive was connected. Disconnect from the network only according to organizational policy, because an unplanned shutdown can destroy useful evidence or interrupt approved containment procedures.

Report the incident immediately through the organization's designated channel, such as a phish alert button, service desk, security hotline, or manager. If the device is unsafe to use, report from another approved device. The security team can then isolate systems, revoke sessions, preserve forensic data, scan related accounts, and notify affected parties.

One unapproved download or reused password can hand cyberattackers the access they need to encrypt files across an entire department. Adaptive Security trains employees to report the first irregular signal.

Explore the platform

Which Identity and Access Terms Should a Cybersecurity Awareness Training Glossary Define?

A cybersecurity awareness training glossary defines the identity and access terms employees need to protect accounts and use business systems safely. Authentication proves who a user is, authorization determines what that user can do, and access control enforces those decisions. Multifactor authentication strengthens authentication with multiple evidence types without stopping phishing, social engineering, or approval of fraudulent requests.

Credentials remain the currency of intrusion. According to Verizon's 2026 Data Breach Investigations Report, stolen credentials were involved in 13% of all breaches.

Proving Identity

Authentication verifies that a person, device, or service is the identity it claims to be. A password, security key, fingerprint, authentication app code, or device certificate can serve as an authenticator.

Multifactor authentication (MFA) requires two or more independent factor types, such as a knowledge factor, a possession factor, or an inherent biometric factor. A password combined with an authenticator app approval qualifies as MFA, while two passwords do not.

MFA protects accounts because a stolen password alone does not satisfy the second verification step. NIST's 2025 Digital Identity Guidelines separate authentication requirements by assurance level and address passwords, one-time codes, cryptographic authenticators, and phishing-resistant methods. Security teams should prioritize phishing-resistant security keys or passkeys for administrators, finance staff, and other high-impact roles.

MFA does not guarantee protection against account takeover. Cyberattackers can use spear phishing to capture credentials and session information or manipulate employees into approving an unexpected verification prompt. Push-bombing attacks exploit repeated MFA requests until a tired or confused user accepts one.

An unexpected verification request is a security signal that deserves a response. Employees should deny it, report it, and contact the security team through a trusted channel.

Deciding What an Identity Can Access

Authorization begins once authentication succeeds, and it answers a different question about what the authenticated identity is allowed to view, change, download, or approve. An employee can authenticate successfully and still lack authorization to reach payroll records, production databases, executive mailboxes, or payment systems.

Access control is the broader system of rules, policies, and technical mechanisms that grant or deny access. An access control list (ACL) is a specific set of permissions attached to a file, application, folder, network resource, or other object. An ACL might allow the finance group to read an invoice directory, permit managers to edit it, and deny access to everyone else.

Least privilege limits each identity to the minimum access required for current duties. It reduces the damage caused by stolen credentials, accidental disclosure, malware, or a cyberattacker moving from one compromised account to another. Apply least privilege through role-based groups, time-limited administrative access, regular entitlement reviews, and immediate access removal when an employee changes roles or leaves.

A digital signature uses cryptography to verify the signer's identity and show whether a document or message changed after signing, which makes it different from an image of a handwritten signature. Employees should validate the signing workflow, certificate details, and business context before approving sensitive documents, because cyberattackers can still trick a legitimate user into signing a fraudulent request.

Password and MFA Behaviors

Password security is a daily behavior instead of a one-time setup task. Employees should use a long, unique password for every important account and never reuse a corporate password on personal services. Credential reuse turns one unrelated breach into a business access incident because cyberattackers test exposed usernames and passwords against corporate email, VPNs, cloud applications, and administrator portals.

A password manager generates and stores unique passwords, which reduces the pressure to memorize credentials or write them in unsafe locations. Organizations should provide an approved manager, protect its master account with MFA, and train employees to identify fake login pages before entering credentials. Password resets should use verified recovery methods, never links supplied in unexpected emails or chat messages.

Strong identity segmentation, privileged access controls, endpoint protections, and rapid response to credential theft limit how far a stolen hash or session token can travel. Those controls work only when employees escalate the first sign of compromise, because response time determines whether one account or an entire directory is affected.

Employees should treat every unexpected MFA prompt, password-reset notice, recovery-code request, or device-enrollment alert as suspicious. Deny the request, capture relevant details, change the password from a trusted device if compromise is possible, revoke unfamiliar sessions, and report the event through the organization's approved channel.

Security awareness training for employees should rehearse these decisions with realistic account-recovery and MFA scenarios, because knowing a definition is weaker protection than practicing the correct response. Identity security depends on turning those signals into consistent, confident action.

Stolen credentials travel through corporate email, VPNs, and cloud consoles long before anyone files a help desk ticket. Adaptive Security rehearses the MFA and recovery decisions that interrupt account takeover.

Book a demo

Which Data Security and Privacy Terms Belong in Employee Cybersecurity Awareness Training?

Data security and privacy terms describe how information is protected, handled, exposed, and recovered throughout its lifecycle. In cybersecurity awareness training, these definitions give employees a practical vocabulary for recognizing risky actions, such as pasting confidential text into a generative AI tool or sharing a document through a public link. A security incident does not always involve a confirmed breach, though accidental disclosure still requires prompt reporting.

The CIA Triad and Information States

The CIA triad is a foundational model for protecting information. Confidentiality means only authorized people can access data, integrity means information remains accurate, complete, and unaltered, and availability means authorized users can reach systems and data when business operations require it. The 2025 NIST Cybersecurity Framework Profile for Artificial Intelligence applies these principles to AI-related data risks, which makes them directly relevant to employee instruction.

Information also exists in three states:

• Data-in-use is information being viewed, edited, processed, or copied in an application, such as payroll records open in a browser;
• Data-in-transit is information moving between systems, such as an email attachment sent to a supplier or a file uploaded to a cloud service;
• Data-at-rest is stored information, including files on a laptop, records in a database, or documents in cloud storage.

Protection must follow information across all three states. A confidential file does not become safe merely because it leaves the company network, and a screenshot, copied paragraph, or browser upload can create a new exposure even when the original system remains secure.

Several terms describe how data changes during handling. Plaintext is readable information before protection, ciphertext is unreadable output produced by encryption, and encryption uses an algorithm and key to convert plaintext into ciphertext so unauthorized users cannot understand it. Hashing converts data into a fixed-length value used primarily to verify integrity or store passwords in a one-way format, and unlike encryption, a properly designed hash is not intended to be reversed.

Metadata is information about a file or communication instead of its primary content. It can include an author's name, document revision history, location, timestamps, hidden comments, or the device used to create a photograph. Data remanence is residual information left behind after a file appears to be deleted, a drive is reformatted, or a device is retired.

Employees should remove comments, inspect document properties, use approved storage, and return removable media through authorized disposal channels. Those habits address the exposure that classification labels alone cannot prevent.

Protecting Data Throughout Its Lifecycle

Data protection depends on the action taken at each stage more than on the sensitivity label attached to a document. Sensitive information includes personal, financial, health, authentication, confidential business, and regulated data that could harm people or the organization if exposed. Instructions should show employees how to classify information, who can receive it, which tools are approved, and when to notify the security team.

Data loss prevention (DLP) refers to policies and technical controls that identify, restrict, or alert on unauthorized movement of sensitive information. DLP can flag a credit card number sent to a personal email address, though employees still need to recognize risky context that automated controls cannot interpret reliably. Before sharing information, they should verify the recipient, confirm the access level, remove unnecessary data, and use company-approved channels.

Three incident terms require clear distinctions:

• A data breach commonly means unauthorized access to or disclosure of protected information, such as a cyberattacker obtaining customer records from a compromised corporate account;
• A data leak is information exposed unintentionally or through weak controls, such as an internal spreadsheet published through a link set to anyone with the link;
• Data exfiltration is the unauthorized transfer of information out of an environment, such as a cyberattacker copying customer records to an external server or an insider uploading proprietary files to a personal cloud account.

The appropriate response begins at the first credible signal. Stop sharing, preserve the relevant message or link, avoid deleting evidence, and report the event through the approved channel. Employees should not investigate recipients, confront suspected insiders, or forward sensitive material to make a report.

Data security and privacy guidance from the UK Information Commissioner's Office in 2025 stressed that people must be able to trust how their information is protected as generative AI develops. That expectation now shapes regulator questions after any disclosure involving AI tools.

Shadow IT and Accidental Disclosure

Shadow IT is the use of hardware, software, cloud services, browser extensions, or applications without the organization's approval or security review. Employees often create this exposure while trying to complete legitimate work faster. Examples include pasting a contract into an unapproved generative AI tool, transferring files through a personal account, storing work on a removable USB drive, installing an unauthorized application, or using a public collaboration link.

Generative AI creates a specific privacy risk because prompts can contain customer records, source code, legal advice, credentials, or internal strategy. A screenshot can expose more than the visible text through notifications, browser tabs, or document names. Document metadata can identify an executive, client, location, or revision history even after the main content is edited.

Personal accounts and removable media also bypass corporate retention, access, and monitoring controls. Instruction should replace vague warnings with a simple decision rule: if the data is not approved for external sharing, it should not be pasted, uploaded, screenshotted, downloaded, or forwarded into an unapproved tool.

Employees should use sanctioned applications, verify link permissions before sharing, remove sensitive metadata, encrypt approved removable media, and report accidental disclosure immediately. A modern security awareness training program can reinforce these behaviors with short, scenario-based exercises tied to the information each role handles.

Employees form the strongest line of defense when they can distinguish a suspicious event from a confirmed incident and know what to do next. A cybersecurity awareness training glossary turns abstract privacy language into decisions that protect confidentiality, preserve integrity, and keep business data available to the people who need it.

Sensitive records leave organizations through personal accounts, public share links, and AI prompts that no data loss prevention rule catches. Adaptive Security teaches employees where approved handling actually ends.

Take a self-guided tour

What Email, Network, and Physical Security Terms Should Staff Understand in a Cybersecurity Awareness Training Glossary?

A cybersecurity awareness training glossary should explain the controls and behaviors that protect messages, connections, devices, information, and workplaces. Controls reduce exposure, though none proves that every message, network, person, or request is trustworthy. Staff need to understand what each control does, what it cannot verify, and which decisions remain a human responsibility even when every technical check passes.

Email Authentication Terms

Email authentication checks whether a message is authorized to use a sending domain. SPF (Sender Policy Framework) lists the mail servers allowed to send messages for a domain, and DKIM (DomainKeys Identified Mail) adds a cryptographic signature that helps verify the message came from an authorized system without alteration in transit. DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving mail systems how to handle messages that fail SPF or DKIM checks and provides reports to the domain owner.

These controls make domain impersonation harder without making every authenticated email safe. A cyberattacker can send malware from a compromised legitimate account, use a lookalike domain that passes its own checks, or persuade a trusted employee to approve a fraudulent request. CISA's ransomware guidance warns that DMARC protects an organization's domain from spoofing without protecting employees from incoming messages sent through another domain.

Email spoofing is the falsification of a sender address or message identity so an email appears to come from a trusted person or organization. Staff should inspect the complete sender address, treat unexpected payment or credential requests as high risk, avoid unrequested attachments, and verify sensitive instructions through a separate trusted channel. A familiar display name is not proof of identity.

Networks and Remote Work

A firewall filters network traffic according to defined rules. It can block unauthorized connections between networks or devices, though it cannot determine whether an employee should trust every website, attachment, or request that passes through. A firewall controls traffic instead of replacing human judgment.

A VPN (virtual private network) encrypts traffic between a device and a VPN service or organizational network. It protects data while staff use an untrusted connection, though it cannot make a compromised device safe, prevent phishing, or guarantee that a destination website is legitimate. Employees still need approved devices, current software, multifactor authentication, and careful credential handling.

An evil twin wireless network is a fraudulent Wi-Fi access point built to imitate a legitimate network, such as a hotel, airport, or coffee shop connection. Once connected, a victim can expose browsing activity, credentials, or device traffic to a cyberattacker. Public Wi-Fi risk comes from unknown network operators, weak access controls, malicious hotspots, and nearby cyberattackers attempting to intercept or manipulate traffic.

When the network name, login page, or connection behavior looks unfamiliar, staff should avoid connecting and ask the venue or IT team to confirm the exact network. Use cellular tethering or an approved VPN when available, disable automatic Wi-Fi connections, avoid sensitive transactions on unknown networks, and forget the network afterward. These habits complement phishing simulations that train employees to recognize social engineering signals, including fraudulent login pages delivered through compromised connections.

Physical Security and Workplace Policies

Shoulder surfing occurs when someone observes a screen, keyboard, badge, or printed document without authorization, which can happen in an airport lounge, shared office, elevator, or video call. Staff should position screens away from public view, use privacy filters where appropriate, lock devices whenever they step away, and avoid discussing confidential matters where strangers can listen.

Tailgating, also called piggybacking, occurs when an unauthorized person follows an authorized individual through a secured door. It can be deliberate or disguised as convenience, such as someone carrying boxes or claiming to have forgotten a badge. Employees should leave secure doors closed behind them, direct visitors to reception, and report unusual access requests without confrontation.

A clean-desk policy requires employees to secure sensitive papers, removable media, notes, and devices when they are not in use. It reduces casual exposure in offices, meeting rooms, shared workspaces, and home work areas. Printed documents should be collected immediately, stored in approved locations, and destroyed using designated disposal methods rather than ordinary bins.

An acceptable-use policy defines how company devices, accounts, networks, applications, and data may be used. It typically covers personal browsing, software installation, removable media, cloud storage, password sharing, and confidential information handling. The policy provides a practical boundary for decisions, though it cannot replace judgment when a situation falls outside its written examples.

Physical security protects people, facilities, devices, and information from unauthorized access, theft, damage, or observation. Staff should secure laptops and badges, keep visitors accompanied, remove sensitive papers from shared areas, and report lost equipment or suspicious behavior immediately. A locked door and a written policy reduce opportunity, while informed employees close the gap between those controls and everyday behavior.

Authentication records and firewalls filter traffic without judging intent, leaving the final decision with whoever opens the message. Adaptive Security prepares that person for requests no control can classify.

Explore the platform

Which Incident Response Terms Should a Cybersecurity Awareness Training Glossary Define?

Incident response vocabulary decides how quickly an organization learns that something went wrong. Employees who cannot distinguish a cyber threat from a vulnerability, or an incident from a confirmed breach, hesitate at exactly the point where minutes matter. A cybersecurity awareness training glossary should therefore define these terms alongside the reporting behavior each one requires.

Cyber Threat, Vulnerability, Cyberattack, Incident, and Risk

The table below separates concepts that employees and security teams often use interchangeably, with a practical example for each.

A security incident response plan is the documented playbook for detecting, containing, investigating, recovering from, and learning from incidents. It assigns decision-makers, escalation paths, evidence-handling rules, communication duties, and recovery actions before pressure sets in.

CISA's 2024 Cybersecurity Incident and Vulnerability Response Playbooks instruct responders to collect and preserve information relevant to prevention, detection, response, and investigation. Evidence preservation is therefore an employee responsibility as well as a security-team task.

Other terms connect prevention to measurement. A phishing susceptibility framework is a consistent method for measuring how people respond to simulated or real phishing across roles, channels, and behaviors, examining clicks, credential submissions, reporting speed, repeat patterns, and near misses without reducing one mistake to a permanent label. A post-completion error occurs when a person finishes required instruction but later repeats risky behavior, which shows that completion records do not equal retained skill.

Security teams also use controlled environments to improve detection. A honeypot is a deliberately monitored decoy system, account, or file created to attract suspicious activity and reveal cyberattacker behavior. A security information and event management (SIEM) platform collects and correlates logs from systems, applications, and security tools so analysts can investigate patterns, and employee reports supply the context that platform cannot generate by itself.

How Should Employees Report a Security Incident?

Incident reporting works when employees have one obvious channel, a short reporting path, and clear expectations. Report suspicious emails, unexpected MFA prompts, unusual login notifications, requests for passwords or payment changes, lost devices, misdirected files, suspected malware, unauthorized data sharing, unusual browser behavior, and messages that impersonate an executive, vendor, or colleague.

Report the near miss as well. A blocked link, a suspicious call that was verified, or a message deleted before interaction reveals which attack patterns reached the organization and gives security teams a chance to remove similar attempts.

Report immediately, ideally within minutes of discovery and before deleting, replying to, or forwarding the message. Waiting to prove that an event is malicious costs response time, and the security team can classify a report as safe, spam, or malicious during triage. Employees protect the organization more effectively when they escalate uncertainty and leave classification to the security team.

Preserve the original email, sender address, subject line, timestamps, phone number, message headers, links, attachments, screenshots, and relevant conversation history. Avoid opening an attachment, altering the message, or contacting the suspected cyberattacker for confirmation. For a suspected account compromise, use the approved reporting channel from a trusted device and follow the response team's instructions for password changes, session revocation, and device isolation.

Out-of-band verification means confirming a sensitive request through a separate, trusted channel, such as calling a known number from the company directory rather than the number in the message. This control matters most for payment changes, credential resets, wire transfers, and requests involving confidential data.

A clear reporting process should connect the employee to triage, containment, and feedback. Employees need confirmation that a report was received, guidance on whether further action is required, and a short explanation of the final classification. A CISA 2024 incident-reporting resource emphasizes who should report, when to report, and what to report, reinforcing that speed and useful context matter more than certainty at the point of escalation.

Organizations can strengthen this process through a phish alert button, mobile reporting, and automated classification. Phish triage workflows can route employee submissions for analysis while preserving the signal security teams need to identify coordinated campaigns.

How Do Alert Fatigue and Human Behavior Affect Incident Response?

Alert fatigue develops when repeated warnings, low-value notifications, or unclear classifications overwhelm the people expected to respond. Employees stop distinguishing urgent signals from routine noise, while analysts face larger queues and less time for genuine cyber threats. The result is weaker reporting behavior instead of weaker employees, because the reporting system has taught people that escalation produces delay, confusion, or no visible outcome.

Security leaders can reverse that pattern by reducing unnecessary prompts, prioritizing alerts by risk, making the reporting channel available in every work context, and closing the feedback loop. Triage should quickly separate safe, spam, and malicious submissions, explain the decision in plain language, and escalate high-impact cases to the right owner. Instruction should rehearse the difference between a suspicious signal and a confirmed incident, including voice, SMS, and collaboration-platform scenarios.

Non-punitive handling is essential. A person who reports a near miss should receive recognition for stopping and escalating, even when the message was harmless, and a person who clicked a phishing simulation should receive targeted coaching and another opportunity to practice, never public blame. That approach increases future reporting, preserves trust, and turns uncertain interactions into useful human-risk data.

A mature incident-response culture measures reporting rate, time to report, report accuracy, repeat errors, and near-miss volume alongside completion. The strongest signal is an employee who notices uncertainty and acts before the incident grows, which gives the response team better information while there is still time to contain the damage.

Slow reporting hands cyberattackers the hours they need to move from one mailbox into finance systems. Adaptive Security shortens time to report and routes employee submissions straight into triage.

Book a demo

Which Deepfake AI and Generative AI Terms Belong in a Cybersecurity Awareness Training Glossary?

A cybersecurity awareness training glossary should define deepfake AI, generative AI, impersonation, and governance terms employees encounter in modern social engineering. These terms explain how cyberattackers create convincing messages, voices, videos, and identities while giving teams a shared vocabulary for verifying unusual requests. AI improves a cyberattacker's speed and polish, though human verification still determines whether a fraudulent request succeeds.

Synthetic media moved from novelty to volume quickly. According to Sumsub's Identity Fraud Report 2024, deepfake fraud incidents grew four times year over year.

How AI Changes Social Engineering

Generative AI creates new text, images, audio, video, code, or other content from a prompt. Cyberattackers use it to draft AI-generated phishing emails that match a company's tone, imitate an executive's writing style, remove obvious spelling errors, and personalize messages for specific recipients. AI-assisted phishing is broader, describing any phishing operation in which AI supports reconnaissance, message creation, translation, target selection, conversation management, or campaign scaling.

This shift changes the signals employees should check. Grammar, awkward phrasing, and generic greetings no longer work as reliable indicators, because generative AI produces polished language in seconds. Employees should verify the request's context, consequence, and channel, since a familiar tone does not prove identity and a correct signature does not prove authorization.

OSINT means open-source intelligence, or information collected from publicly available sources. Cyberattackers use OSINT from company websites, professional profiles, conference recordings, social media, job listings, and public filings to identify reporting relationships, current projects, suppliers, travel schedules, and communication habits. That information supports rapid personalization, particularly in spear phishing and business email compromise (BEC).

Public biographies, conference videos, and organizational charts explain why a message can sound unusually credible. Discussing OSINT exposure gives organizations a practical basis for reducing unnecessary public detail about executives, finance staff, and other high-risk roles.

Organizations should connect these definitions to modern phishing simulations that rehearse email, voice, SMS, and video scenarios. A defensive phishing simulation is authorized, controlled, and measured for learning, while a cyberattacker's use of AI is covert and built to cause financial, operational, or privacy harm. The technology can look similar on the surface, though the purpose, authorization, safeguards, and response process differ fundamentally.

Deepfakes, Voice Cloning, and Impersonation

A deepfake is synthetic or manipulated audio, video, or imagery created to make a person appear to say or do something that did not happen. Deepfake AI refers to the artificial intelligence methods used to generate or alter that content. AI voice cloning creates an artificial voice resembling a real person from recorded speech, while synthetic video can reproduce facial movement, expressions, and conversational timing.

Deepfake phishing uses those capabilities in a social engineering cyberattack. A criminal might send an email from a supposed chief financial officer, follow it with an AI-generated voice call, and join a video meeting as the executive. The objective is making a high-risk request feel familiar enough that the target skips independent verification.

The $25 million Arup wire fraud in Hong Kong demonstrated the financial consequences. In 2024, an employee joined a video conference populated by deepfake participants and transferred funds after believing the instruction came from company leaders, according to Reuters' 2024 report on the incident. The required response is procedural, because employees must treat video, voice, caller ID, and familiar writing style as supporting signals rather than proof of identity.

A synthetic identity combines real and fabricated personal information to create a person who does not fully exist as represented. An impersonation cyberattack uses a false or stolen identity to appear to be a real executive, supplier, customer, regulator, or colleague. The distinction matters because synthetic identities can support longer fraud campaigns, while impersonation often targets an immediate decision such as a payment, password reset, payroll change, or data release.

Detection quality has fallen behind generation quality. According to Sumsub's 2025–2026 Identity Fraud Report, sophisticated fraud surged 180% year over year, including deepfakes, synthetics, and telemetry tampering.

Verification should match the consequence of the request:

• Executives: Establish a standing rule that urgent payment, legal, payroll, or data requests receive confirmation through a separately known channel, because a new phone number, meeting invite, or reply address does not qualify as independent verification;
• Finance teams: Validate beneficiary changes, invoice instructions, and wire transfers against approved vendor records, calling the known number in the vendor-management system rather than a number supplied in the request;
• Customer support teams: Treat a familiar voice, account detail, or emotional appeal as insufficient authentication and use approved identity checks before changing account access or disclosing customer information;
• Employees handling payments or sensitive data: Pause when a request combines urgency, secrecy, authority, and an unusual channel, then report it before complying even when the message appears technically flawless.

Vishing is voice phishing delivered through a phone call, voicemail, or voice message, and smishing is phishing delivered through SMS or another messaging service. These channels matter because employees often apply less scrutiny to a phone notification or conversation than to an email. A glossary should place vishing and smishing beside deepfake phishing, since cyberattackers increasingly combine channels and rarely rely on one message.

The AI impersonation of Ukraine's former foreign minister in a call with U.S. Senator Ben Cardin illustrated the same trust problem in a public-sector setting, according to NBC News' 2024 report. A convincing voice and video interaction can create confidence before the recipient checks whether the communication was scheduled, independently authenticated, and appropriate for the information requested.

Using Generative AI Safely at Work

AI governance consists of the policies, ownership rules, technical controls, and review processes an organization uses to manage how AI is selected and used. It covers approved tools, acceptable data, access permissions, human review, retention, vendor risk, incident reporting, and accountability for AI-generated outputs. The NIST AI Risk Management Framework Generative AI Profile, published in 2024, gives organizations a structure for identifying and managing generative AI risks.

Safe generative AI use begins with a clear prohibition. Employees must not paste passwords, authentication tokens, customer records, payment details, protected health information, confidential contracts, source code, unreleased financial information, or other sensitive data into an unapproved AI tool. Prompts can expose information through storage, logging, sharing, browser extensions, or account configuration, and redaction, data classification, approved enterprise accounts, and human review reduce that exposure without blocking legitimate productivity work.

Shadow AI is the unsanctioned use of generative AI tools, plug-ins, browser extensions, or automated agents outside an organization's approved process. It creates two risks at once, because security leaders cannot assess a tool they cannot see, and employees can unintentionally disclose sensitive information while summarizing a document, writing code, analyzing a spreadsheet, or answering a customer.

A practical AI governance glossary should define the actions employees must take:

1. 1Use only AI tools approved for the relevant data classification and business purpose.
2. 2Remove names, account numbers, credentials, contract terms, and other identifying details before drafting a prompt.
3. 3Treat AI output as unverified material and check facts, citations, calculations, code, images, and instructions before use.
4. 4Escalate suspicious AI-generated messages, cloned voices, synthetic videos, and unusual requests through the organization's reporting process.
5. 5Record material AI use where policy requires it, especially for regulated, customer-facing, financial, legal, or safety-related work.

Cybersecurity awareness training should distinguish defensive phishing simulation from criminal use without making employees fear the technology. An authorized deepfake phishing simulation teaches recognition, pause behavior, independent verification, and reporting in a controlled environment, and it does not request real funds, collect real credentials, or expose employees to uncontrolled tools.

The strongest glossary connects each term to a decision rule: polished language requires context checks, a cloned voice requires a separate channel, realistic video requires independent authorization, and public information requires careful scrutiny of personalization. Shared definitions give executives, finance teams, support staff, and everyday employees the same response pattern when an AI-assisted request arrives.

Synthetic voices and video now carry payment requests that pass every instinct an annual course taught employees to trust. Adaptive Security rehearses verification against realistic deepfake and voice scenarios.

Take a self-guided tour

How Should a Cybersecurity Awareness Training Glossary Become Role-Based Security Training?

A cybersecurity awareness training glossary becomes useful when each definition leads to a decision employees must make under pressure. Programs should start with a shared onboarding baseline, then map terms to job-specific scenarios, recurring refreshers, and higher-risk workflows. Keep the program accessible, translated, and privacy-conscious while measuring whether employees pause, verify, report, and recover rather than simply remembering terminology.

1. Build the Onboarding Minimum

Onboarding should teach the small set of terms every employee needs before receiving access to company systems. Define phishing, spear phishing, business email compromise (BEC), vishing, smishing, multifactor authentication, malware, data classification, and incident reporting in plain language. Each definition should answer three practical questions about what the cyberattack looks like, what action the cyberattacker is trying to trigger, and what the employee should do next.

Convert each term into a short scenario, never a vocabulary test. A new employee might receive a fake human resources message requesting tax documents, an SMS asking them to confirm a delivery, or a voice call claiming to be an executive. The lesson should require the learner to pause, inspect the request, verify it through a trusted channel, and report it through the approved process.

This structure makes security awareness training part of safe work rather than a compliance checkbox. Assign the onboarding minimum before access to email, finance systems, customer records, or administrative consoles, then repeat the core behaviors in short refreshers during the first 90 days.

Accessibility determines whether instruction reaches the entire workforce. Provide captions and transcripts for video, keyboard navigation, screen-reader-compatible content, sufficient color contrast, and alternatives to audio-only exercises. Translate instructions, scenarios, and answer choices in addition to navigation labels, because a translated module that leaves the reporting workflow in an unfamiliar language still creates delay when a real cyber threat arrives.

2. Map Glossary Terms to High-Risk Role Pathways

Role-based instruction should connect each term to the decisions a person controls. Finance and accounts payable teams need practice with invoice fraud, vendor impersonation, bank-detail changes, and BEC. Executives need to verify urgent payment, data, and access requests that appear to come from senior leaders, while IT administrators need scenarios involving privileged-account resets, MFA fatigue, remote-access requests, and fake support calls.

Developers should rehearse secrets exposure, malicious packages, repository invitations, and requests to paste proprietary code into unapproved tools. Customer support teams need practice identifying account-takeover attempts, identity manipulation, and callers seeking exceptions to verification rules. Human resources teams require scenarios involving payroll changes, employee records, and fake recruiting or benefits communications.

Contractors and remote workers need the same decision standards, adapted to personal workspaces, unmanaged networks, and unfamiliar business contacts. Employees using personal devices should practice separating personal and corporate accounts, avoiding sensitive data entry into unapproved applications, and reporting suspicious mobile messages. These scenarios should clarify policy boundaries without monitoring private activity unrelated to company risk.

A role pathway should increase practice where the consequence of a mistake is highest without punishing people for working in exposed roles. Finance may receive more payment-verification exercises, while administrators receive more privileged-access scenarios. Content mapped to NIST CSF, ISO 27001, HIPAA, or PCI DSS can document coverage, though completion records do not prove that employees can apply the behavior.

Privacy boundaries must be explicit before behavioral data is collected. Tell employees what phishing simulations measure, how results inform instruction, who can view individual records, and when data is aggregated for leadership reporting. Avoid inspecting personal messages, inferring sensitive personal traits, or using security scores for unrelated employment decisions, because clear boundaries increase reporting when employees understand that the program builds skill.

3. Test Understanding Through Behavior

Behavioral testing should measure whether employees recognize and handle pressure across the channels cyberattackers use. Phishing simulations test email decisions, including whether a person checks the sender, questions urgency, and reports a suspicious request. Quizzes can confirm that employees understand terms such as BEC or smishing, though a correct definition alone does not demonstrate safe action.

Assessments should present ambiguous situations with more than one plausible response. Ask employees to choose whether to approve a payment, open an attachment, share a code, call a known number, or escalate the request, then follow each choice with immediate coaching that explains the missed signal and provides a repeatable next step.

Vishing simulations test whether employees resist authority and urgency in a live conversation, while smishing simulations test how they handle short, convincing messages on a phone outside the office. Microlearning should follow the observed gap, such as a brief lesson on verifying vendor changes after an employee engages with an invoice scenario. The objective is application under realistic conditions rather than recognition of familiar instructional language.

Use a positive response model after every mistake. Employees should pause the action, verify the request through a trusted channel, report the event with enough context, and recover by changing exposed credentials, notifying the right team, or reversing an unsafe action. Avoid shame-based messages and public rankings, and reinforce employees who report suspicious messages, including phishing simulations, because early reporting gives security teams time to contain risk.

Review results by role, channel, scenario type, and time to report. A glossary has done its job when employees transfer a definition into a safe decision during an unfamiliar email, call, or text. Those decisions also reveal where content, workflows, and policies need to evolve as attack patterns change.

Generic lessons treat finance approvers, developers, and support agents as one audience while cyberattackers study each separately. Adaptive Security assigns scenarios matched to the decisions every role actually controls.

Explore the platform

How Should Organizations Measure and Update a Cybersecurity Awareness Training Glossary?

Measure a cybersecurity awareness training glossary by testing recognition, decision-making, and real-world reporting rather than counting page views. Compare search behavior, quiz accuracy, scenario decisions, and phishing outcomes, then update definitions when cyber threats, policies, regulations, incidents, generative AI tools, or language needs change. Treat completion and search volume as activity signals, since neither proves that employees can apply terms under pressure.

1. Distinguish Recognition From Understanding

Separate recognition, understanding, and application. Search terms show what employees need clarified without showing whether they can act correctly, so track searched terms, failed searches, repeated searches, and the time between searching and completing related learning. A spike in searches for BEC, vishing, or MFA identifies a knowledge gap, while repeated searches for the same term indicate that its definition, examples, or policy link needs revision.

Test understanding with short quizzes asking employees to define a term, distinguish related concepts, and identify the correct response. Record accuracy by term, role, department, language, and attempt number. High completion paired with low accuracy means the glossary is being visited without being retained, and high quiz scores paired with poor scenario decisions show recognition without practical understanding.

Scenario testing provides the strongest measure. Present an employee with a realistic request, such as a supplier asking for a payment change, an executive requesting secrecy over voice, or a message containing a suspicious link, then measure whether the employee pauses, verifies, reports, or proceeds.

According to the UK Department for Science, Innovation and Technology's Cyber Security Breaches Survey 2025, 43% of businesses reported a cyber security breach or attack in the previous 12 months, with phishing the most common type. Glossary entries must therefore connect terms to specific decisions and reporting actions.

2. Track Metrics That Show Behavioral Change

Build a dashboard that separates activity metrics from outcome metrics. Activity metrics include glossary visits, search volume, quiz attempts, completion, and time spent on entries, while outcome metrics show whether employees behave differently when exposed to risk.

Track phishing susceptibility, reporting rate, time to report, repeat failures, and near-miss reporting. A declining click or submission rate matters most when paired with a rising reporting rate and shorter time to report. Repeat failures identify employees or teams that need targeted practice, and near-miss reporting captures suspicious events employees stopped before they became incidents.

Board attention follows those measures. According to the World Economic Forum's 2026 Global Cybersecurity Outlook, 30% of highly resilient organizations reported that board members hold personal liability in the event of cyber breaches, compared with 9% of organizations with insufficient resilience.

Connect these measures to human risk trends over time by comparing baseline results with post-training performance at 30-, 60-, and 90-day intervals, using consistent scenarios where possible. Segment results by role and channel, because finance staff face different decisions from developers, and email behavior does not predict responses to vishing or smishing. Organizations can connect glossary performance with broader security awareness training reporting to show whether knowledge gains correspond with reduced exposure.

3. Establish a Review and Governance Cycle

Assign ownership to security awareness, security operations, legal, compliance, human resources, and communications. Review the glossary at least quarterly, and trigger an immediate review after a material incident, near miss, major change in attack patterns, policy revision, regulatory update, or deployment of a new generative AI tool. Each review should confirm the definition, examples, reporting path, policy references, translation, and accessibility.

Use incident learnings to add the language employees actually encountered, including cyberattacker terminology and misleading labels. Review entries when voice-cloning, deepfake, or generative AI tools change attack patterns. Check plain-language readability, screen-reader compatibility, and all supported languages, then retire obsolete terms so conflicting definitions do not remain searchable.

Record each change with an owner, approval date, source, affected policy, and review date, then re-test updated entries with a small employee group before publishing them broadly. This cycle keeps the glossary accurate, usable, and tied to behavior, so employees can recognize changing cyber threats and act decisively when pressure makes familiar language harder to trust.

Search volume and quiz scores describe activity while leaving leadership without evidence that behavior improved. Adaptive Security tracks reporting speed, repeat failures, and human-risk trends by department.

Take a self-guided tour

How Do Cybersecurity Awareness Training Glossary Terms Connect to Standards and Organizational Practice?

A cybersecurity awareness training glossary creates shared language for turning security expectations into repeatable employee actions. Inconsistent definitions produce conflicting advice, weak reporting, and policy gaps across departments. The NIST Cybersecurity Framework 2.0, published in 2024, and CISA resources show why terminology must connect to governance, protection, detection, response, and recovery rather than sitting as an isolated reference page.

Governance attention makes that alignment easier to fund. According to the World Economic Forum's 2026 Global Cybersecurity Outlook, 52% of organizations indicate that board members receive regular cybersecurity updates, and 48% report that board members are actively engaged with cybersecurity issues.

Using Authoritative Definitions

Authoritative definitions give security teams a defensible starting point for explaining authentication, incidents, data classification, phishing, and least privilege. NIST's Cybersecurity Framework 2.0 glossary and core guidance connects terminology to organizational outcomes and includes awareness and training within broader cybersecurity risk management. CISA's Project Upskill Glossary provides plain-language explanations for concepts employees encounter in practical defense work.

Use NIST terminology when a program must align with the NIST Cybersecurity Framework, risk registers, or control documentation. Use CISA terminology when translating cyber threat concepts into employee-facing lessons, reporting instructions, and response playbooks. Where sources differ, record the preferred organizational definition, the authoritative reference, and the reason for choosing it.

That decision prevents one department from treating a security incident as any suspicious email while another reserves the term for confirmed compromise. The same discipline applies to specialized terms such as business email compromise (BEC), vishing, smishing, spear phishing, multifactor authentication, and generative AI, which should be defined in language employees can act on.

Define open-source intelligence (OSINT) when it appears in guidance about publicly available information used to personalize cyberattacks. Connect each definition to a realistic behavior, such as verifying a payment request through a trusted channel or reporting an unexpected login prompt.

Connecting Terms to Policy and Compliance

A glossary becomes operational when every important term points to a policy requirement and an employee decision. An acceptable-use definition should link to approved applications, prohibited activity, and handling rules. Password and authentication terms should link to credential creation, password-manager, and multifactor authentication requirements, while clean-desk and data-classification terms explain what employees must secure, label, store, or dispose of.

Incident-reporting terminology should identify what requires immediate escalation, which reporting channel to use, and what information to preserve. Remote-work definitions should connect to device, network, privacy, and physical workspace expectations. Generative AI terms should point to the organization's rules for approved tools, confidential data, prompt handling, output review, and human accountability.

These links make compliance instruction more precise. GDPR content can connect personal data and breach-reporting terms to privacy obligations, HIPAA content can connect protected health information to handling and disclosure rules, and PCI DSS can anchor cardholder-data language and payment-security behaviors. SOX can connect access, records, and change-control terms to financial reporting controls.

DORA can organize terminology around ICT risk management, incident reporting, resilience testing, and third-party risk in financial entities. FISMA can align federal information-security language with agency risk-management responsibilities, while ISO 27001 and CMMC provide control-oriented vocabulary for information-security management and protection of controlled information.

None of these frameworks turns a glossary into proof of compliance. Organizations still need approved policies, assigned owners, risk assessments, documented procedures, learning records, and evidence that controls operate.

Mapping content to GDPR, HIPAA, PCI DSS, SOX, DORA, FISMA, ISO 27001, NIST CSF, and CMMC must also match the organization's scope and control interpretation. A security awareness training program should show employees how terms affect daily decisions rather than displaying definitions.

Keeping Terminology Accurate Across Jurisdictions

Legal, privacy, and regulatory definitions vary by jurisdiction, sector, and contract. Personal data, personal information, security incident, breach, and sensitive information do not carry identical obligations everywhere, so the glossary owner should route disputed language to the appropriate legal, privacy, compliance, or regulatory owner before publication.

Maintain version control for definitions, policy links, framework mappings, and review dates. Assign owners for high-impact terms, review them when laws or frameworks change, and retire language that no longer matches operational practice. This process keeps employees, auditors, and incident responders working from the same vocabulary while preserving the flexibility required across countries and regulated industries.

Conflicting definitions across legal, security, and business teams delay escalation and weaken the audit evidence regulators request. Adaptive Security aligns compliance instruction with the behaviors auditors and incident responders expect.

Book a demo

How Adaptive Security Turns a Cybersecurity Awareness Training Glossary Into Measurable Behavior

Definitions change nothing until employees rehearse them against the requests cyberattackers actually send. Adaptive Security builds a cybersecurity awareness training platform around that gap, converting current attack patterns into role-relevant lessons, phishing simulations across email, voice, SMS, and video, and coaching that arrives while a missed signal is still fresh. Terminology becomes a practiced decision instead of a page employees visit once.

The product suite extends that practice into the places where cyber threats and obligations now concentrate. Phishing Simulations and Phish Triage rehearse recognition and route employee reports into fast analysis, Cloud Email Security addresses messages that reach the inbox after authentication checks pass, and AI Governance gives security leaders visibility into how generative AI tools are used and where sensitive data could travel. Compliance Training connects the same vocabulary to documented obligations under frameworks such as HIPAA, PCI DSS, and ISO 27001.

Measurement holds the program together. Risk Monitoring and reporting show reporting rate, time to report, repeat failures, and human-risk trends by role and department, which gives security leaders defensible evidence of behavior change alongside completion records. A cybersecurity awareness training program built this way tells leadership which decisions improved, where exposure remains concentrated, and which scenarios deserve the next cycle of practice.

Human risk shifts weekly as cyberattackers adopt new channels, while static libraries describe yesterday's campaigns. Adaptive Security keeps instruction, phishing simulations, and reporting aligned with current attack patterns.

Explore the platform

Frequently Asked Questions About a Cybersecurity Awareness Training Glossary

What Is the Difference Between Cybersecurity Awareness and Cybersecurity Training?

Cybersecurity awareness is understanding security risks and the behaviors that reduce them, while cybersecurity training is structured instruction that builds those behaviors. NIST defines awareness training as foundational learning for all personnel who protect information, cybersecurity, and privacy assets. Awareness explains why a suspicious request matters, and training shows an employee how to inspect a link, verify a payment change, use MFA safely, or report an incident. An effective program combines plain-language awareness with role-based practice, feedback, and reinforcement.

How Often Should a Cybersecurity Awareness Training Glossary Be Updated?

A cybersecurity awareness training glossary should receive a formal review at least quarterly and an immediate update whenever cyber threats, policies, regulations, tools, or incident lessons change. NIST SP 800-50 Rev. 1 treats cybersecurity and privacy learning as a managed program instead of a one-time activity. Assign an owner, record each definition's source and review date, and flag terms affected by generative AI, deepfake tactics, new authentication methods, or revised reporting procedures. Retire duplicate entries and test plain-language clarity with representative employees.

What Cybersecurity Awareness Training Topics Should Every New Employee Learn During Onboarding?

Every new employee should learn phishing, spear phishing, vishing, smishing, MFA, password security, data handling, incident reporting, physical security, and safe generative AI use during onboarding. Onboarding should teach employees to pause before clicking, verify unusual requests through a separate channel, protect sensitive information, reject unexpected MFA prompts, secure devices and workspaces, and report mistakes or near misses quickly. Use short scenarios for email, messaging, phone calls, QR codes, public Wi-Fi, removable media, and payment requests, then add deeper role-based practice for finance, executives, administrators, human resources, and customer support.

How Can Organizations Measure Whether Employees Understand Cybersecurity Awareness Training Glossary Terms?

Organizations can measure understanding by testing whether employees make safer decisions in realistic scenarios rather than relying on completion rates. Track quiz accuracy, scenario decisions, suspicious-message reporting rate, time to report, repeat errors, near-miss reporting, and glossary searches that produce no useful result. Compare results by role, channel, and risk pattern while protecting employee privacy, then pair metrics with feedback so learners understand the correct action. Sustained improvement in recognition, verification, reporting, and recovery behavior is stronger evidence than attendance.

Which Cybersecurity Awareness Training Terms Matter Most for Employees Who Use Generative AI Tools?

Employees who use generative AI tools should understand sensitive data, data leakage, shadow AI, prompt injection, hallucination, deepfake, AI-assisted phishing, vishing, impersonation, and open-source intelligence (OSINT). NIST's 2024 Generative AI Profile identifies risks organizations should manage when deploying generative AI. Employees need a clear rule for what information they may enter, how to verify AI-generated output, and where to report an unsafe tool or suspicious request. They should treat polished text, cloned voices, realistic video, and personalized context as unverified signals.

Terminology protects an organization only when employees have practiced the decision each definition describes, under the pressure cyberattackers manufacture. Adaptive Security turns a shared vocabulary into measurable, repeatable behavior.

Take a self-guided tour