Cyber security glossary
Short, plain-English definitions of the security terms that come up when a customer, insurer or regulator asks how you protect your business. Each entry starts with a one or two sentence answer, then explains why it matters for a UK small or regulated business and how it works in Microsoft 365. Every definition links to the official source we checked it against: the NCSC, Microsoft, ISO, the FIDO Alliance or UK law enforcement.
B
- Break-glass account
- A break-glass account is an emergency administrator account kept for when normal admin sign-in fails, for example if MFA devices are lost or a policy locks everyone out. Microsoft recommends at least two, used only in genuine emergencies.
- Business email compromise (BEC) and payment diversion fraud
- Business email compromise (BEC), also called payment diversion or mandate fraud, is when criminals impersonate a supplier, client or colleague by email, then create or change invoices and bank details so that payments go to an account they control.
C
- Conditional Access
- Conditional Access is the Microsoft Entra ID feature that decides whether a sign-in is allowed, using if-then rules: if someone wants to reach Microsoft 365, then they must meet conditions such as passing MFA or using a compliant device.
- Configuration drift
- Configuration drift is when the live security settings in a system, such as a Microsoft 365 tenant, move away from the configuration you agreed and documented, through quick fixes, workarounds or changes nobody reversed.
- Cyber Essentials
- Cyber Essentials is the UK government-backed certification scheme that shows an organisation has five basic technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection.
- Cyber Essentials Plus
- Cyber Essentials Plus is the higher level of the UK Cyber Essentials scheme: the same five controls, but an independent assessor tests your devices, accounts and internet-facing systems to check they work in practice.
D
- DMARC (with SPF and DKIM)
- DMARC is an email security record that tells other mail servers what to do with messages that claim to come from your domain but fail SPF and DKIM checks. Together the three make it much harder for criminals to send email pretending to be you.
I
- Intune (device management)
- Microsoft Intune is Microsoft's cloud service for managing and securing laptops, phones and the apps on them. It sets security settings, keeps devices updated, protects work data and tells Microsoft 365 which devices can be trusted.
- ISO/IEC 27001
- ISO/IEC 27001 is the international standard that sets the requirements for an information security management system (ISMS): a risk-based way of establishing, running, maintaining and continually improving how an organisation protects its information.
- ISO/IEC 42001 (AI management system)
- ISO/IEC 42001 is the international standard for an AI management system. It sets requirements for establishing, running, maintaining and continually improving how an organisation develops, provides or uses AI responsibly.
M
- Managed detection and response (MDR)
- Managed detection and response (MDR) is a security service in which a provider's analysts watch your alerts, investigate suspicious activity and either contain an attack or guide you through the response, usually around the clock.
- Microsoft Defender for Business and Defender for Endpoint
- Microsoft Defender for Business is Microsoft's endpoint security for organisations of up to 300 users. It is built on Microsoft Defender for Endpoint and protects laptops and phones against malware, ransomware and other attacks, then helps investigate and contain them.
- Microsoft Secure Score
- Microsoft Secure Score is a measurement of an organisation's Microsoft 365 security posture, shown in the Microsoft Defender portal. A higher score means more of Microsoft's recommended security actions have been taken.
- Multi-factor authentication (MFA)
- Multi-factor authentication (MFA) means signing in with two or more different kinds of proof, such as a password plus a code or prompt on your phone, so a stolen password on its own is not enough to get into an account.
P
- Phishing-resistant MFA (passkeys and FIDO2 security keys)
- Phishing-resistant MFA is sign-in that a fake website can't capture or replay, such as a passkey or FIDO2 security key. The credential is tied to the real site, so even a convincing phishing page gets nothing it can use.
- Privileged Identity Management (PIM)
- Privileged Identity Management (PIM) is a Microsoft Entra ID service that gives people admin rights only when they need them and only for a set time, with MFA, a reason and optionally an approval required each time the role is switched on.