Glossary

Every term used across the six steps, defined in ordinary words. The definitions are grouped by what they describe rather than alphabetically, because the groupings themselves explain a good deal.

Things that go wrong

Malware: The umbrella word for any software written to do harm, covering everything in this group. If a piece of writing uses "virus" as a catch-all, it means malware.
Virus: Strictly, malware that attaches itself to another file or program and spreads when that file is run or shared. The name persists in the category's marketing long after the technique stopped being the main one.
Worm: Malware that spreads by itself across a network without needing anyone to open anything, which is what makes it fast.
Trojan: Malware disguised as something you wanted — a free utility, a game, a document viewer. You install it yourself, which is the point of the disguise.
Ransomware: Malware that encrypts your files and demands payment for the key, often threatening to publish the data as well. A current, disconnected backup is the practical answer, as covered in step five.
Spyware: Software that quietly gathers information about what you do — keystrokes, browsing, credentials — and sends it elsewhere.
Adware: Software that injects advertising or redirects searches. Frequently arrives bundled with something else that was genuinely wanted.
Potentially unwanted program: Software that is not malicious enough to be called malware but was probably not wanted either: toolbars, aggressive cleaners, bundled extras. Security products often list these separately, which is why a scan report can look alarming when nothing serious is present.
Rootkit: Malware that hides itself deep in the operating system to avoid detection and survive restarts. Rare on home machines and difficult to remove once present.
Scareware: A page, pop-up or program designed to convince you that your device is infected so that you buy something or ring a number. No web page can scan your computer; anything that appears to be doing so is this.
Zero-day: A flaw being exploited before the maker has released a fix. The term describes the timing, not the severity, and it is the case that signature-based detection is least suited to.

How the software works

Signature: A fingerprint or pattern identifying a known piece of malware. Matching against a catalogue of signatures is fast and accurate for threats that have already been seen and catalogued.
Definitions: The catalogue of signatures, updated frequently by the vendor. Out-of-date definitions are the most common reason an installed product stops being useful.
Heuristics: Detection based on characteristics rather than exact matches — code that resembles known malicious code closely enough to be worth stopping.
Behavioural analysis: Watching what a program does while it runs and intervening on suspicious sequences, such as a newly downloaded file beginning to encrypt documents.
Real-time protection: Continuous checking of files as they are opened, written or executed. This is the component that prevents infection, as distinct from a scan, which finds what is already there.
On-demand scan: A scan you start or schedule, which inspects existing storage. Useful for a baseline and for machines with an unknown history; no protection between runs.
Quarantine: A holding area where a detected file is stored in a state it cannot run from, so that a mistaken detection can be reversed rather than being a deletion you cannot undo.
False positive: Something harmless flagged as malicious. Common with small, unsigned utilities, and the reason to restore a specific item rather than switch protection off.
Exclusion: A file, folder or process you have told the scanner to ignore. Sometimes necessary, always a deliberate gap; worth writing down and reviewing.
Sandboxing: Running a program in an isolated space so it cannot reach the rest of the system. Mobile operating systems do this by design, which is why they work differently from desktops.
Firewall: A control over which network connections are allowed in and out of a device. Both Windows and macOS include one.
Telemetry: Information a product sends back to its vendor about files seen, sites visited or errors encountered. Some of it is how cloud-based detection works; how much is collected and for how long belongs in the vendor's privacy policy.

Accounts, identity and fraud

Phishing: A message designed to make you hand over a credential or a payment, usually by imitating an organisation you deal with. No malicious software need be involved at any point.
Spear phishing: Phishing aimed at one person, using details about them — their employer, a recent purchase, a colleague's name — to be more convincing.
Smishing and vishing: The same technique delivered by text message and by phone call respectively.
Credential stuffing: Taking usernames and passwords exposed in one breach and trying them automatically against many other services. It works only where passwords have been reused.
Data breach: An incident where information held by an organisation is accessed or disclosed without authorisation. Where serious harm is likely, Australia's notifiable data breaches scheme applies; the Office of the Australian Information Commissioner oversees it.
Multi-factor authentication: Requiring something in addition to a password — a code from an app, a hardware key, an approved prompt. The most effective single control available to a household.
Authenticator app: An app that generates time-limited codes for signing in. Generally stronger than codes sent by text message, which can be intercepted or diverted.
SIM swap: Fraud in which someone has your mobile number transferred to a service they control, so that codes sent by text message reach them instead of you.
Passphrase: A password made of several unrelated words. Longer, easier to remember, and harder to attack than a short string with substituted symbols.
Password manager: Software that generates and stores a distinct password for every account behind one passphrase you memorise. The practical answer to reuse.
Recovery codes: One-time codes issued when you set up multi-factor authentication, for use when the second factor is unavailable. Keep them somewhere physical and separate from the phone.

Network, data and commercial terms

VPN: A service that encrypts your connection to a server it operates, hiding your traffic from the network you are using and your address from the sites you visit. It does not stop malware and does not make you anonymous.
End-to-end encryption: Encryption where only the sender and recipient can read the content, and the service carrying it cannot.
Full-disk encryption: Encryption of everything stored on a device, so that the contents are unreadable to anyone who takes the hardware. Built in to current desktop and mobile platforms under various names.
Patch: An update that fixes a flaw. Published fixes describe the flaw they fix, which is what makes unpatched devices attractive.
End of support: The date after which a product stops receiving fixes. No security software installed over the top restores those fixes.
Tier: A level within a vendor's subscription range. Detection is usually the same engine across tiers; the higher ones add components such as a VPN or a password manager.
Introductory and renewal pricing: A discounted first term followed by a standard ongoing rate. The renewal figure appears in the subscription terms at checkout and is the one worth comparing, as step three sets out.
Affiliate link: A link that pays the publisher a commission if the reader buys after following it. Every one on this site is labelled where it appears and explained on the affiliate disclosure page.