Glossary

Social Engineering Glossary

Plain-language definitions of social engineering terms, attack techniques, and human risk concepts — with practical defensive guidance for each.

A

Acceptable Use Policy (AUP)

An acceptable use policy defines how employees may use company systems, data, and accounts — the baseline document behind shadow IT, AI, and BYOD rules.

Access control is the discipline of deciding who can reach which systems and data, enforcing those decisions, and revoking access when the need ends.

Account Takeover (ATO)

Account takeover is an attack in which a criminal gains control of a legitimate user account and operates it for fraud, theft, or further attacks.

Advance-Fee Fraud

Advance-fee fraud promises a large payout in exchange for an upfront fee that grows until the victim quits. How the classic 419 scam still works today.

Adversary-in-the-Middle (AiTM)

An adversary-in-the-middle (AiTM) attack proxies a real login page to steal both credentials and the session token issued after MFA is completed.

Adware is software that floods a device with unwanted advertising, often bundled with free downloads — ranging from a nuisance to a gateway for spyware and scams.

Agentic AI is software that acts, not just answers — browsing, clicking, and transacting on a user's behalf — making it a new target for social engineering.

An air gap physically isolates a system or backup from networks so remote attackers cannot reach it — the last line of defense against ransomware.

Alert fatigue is the desensitization that sets in when people receive too many security alerts or prompts, causing real warnings to be ignored, dismissed, or approved on reflex.

Allowlisting permits only approved software, senders, or destinations and blocks everything else — flipping security from default-allow to default-deny.

Angler Phishing

Angler phishing is a social media attack where criminals pose as a brand's customer support account to intercept complaints and steal credentials or payment data.

An attack vector is the specific path an attacker uses to get in — an exploit, a stolen password, or, most often, a message aimed at a person.

Authorized Push Payment (APP) Fraud

APP fraud manipulates a victim into sending a payment themselves — the transfer is authorized, so standard fraud controls and recalls often fail.

B

Badge cloning is copying an employee's access card — often by reading it covertly at close range — to create a duplicate that opens the same doors.

BadUSB is an attack that reprograms a USB device's firmware so it impersonates a keyboard and types malicious commands the moment it is plugged in.

Baiting is a social engineering attack that lures victims with a tempting item — such as a USB drive, free download, or prize — to deliver malware or harvest credentials.

A blue team is the defensive side of security — the people who detect, respond to and harden against attacks, including social engineering.

Bluesnarfing is the unauthorized extraction of data — contacts, messages, files — from a device over a Bluetooth connection the owner never approved.

A botnet is a network of malware-infected devices an attacker controls remotely, rented out to send spam, spread phishing, and disguise credential attacks.

Brand Impersonation

Brand impersonation is an attack that copies a trusted company's name, logo, and design — in emails, websites, ads, or chat — to trick victims into acting.

Browser Hijacking

Browser hijacking is the covert takeover of browser settings or sessions — redirecting searches, tracking activity, and steering users to attacker pages.

Browser-in-the-Browser Attack

A browser-in-the-browser (BitB) attack fakes a single sign-on popup window inside a web page to steal credentials on a pixel-perfect fake login form.

A brushing scam is the delivery of unordered packages so a seller can post fake verified reviews — increasingly paired with QR codes that lead to phishing sites.

Brute-Force Attack

A brute-force attack tries passwords or keys systematically until one works. Weak, reused passwords make it cheap — MFA and passkeys make it pointless.

Business Email Compromise (BEC)

Business email compromise is a targeted attack where criminals impersonate executives or trusted partners via email to trick employees into transferring money or sensitive data.

BYOD (Bring Your Own Device)

BYOD (bring your own device) lets employees use personal phones and laptops for work — expanding productivity and the attack surface at the same time.

C

Callback Phishing

Callback phishing (TOAD) is an attack where an email lures the victim into phoning a fake support line, moving the scam to a live phone call.

Caller ID Spoofing

Caller ID spoofing falsifies the number shown on a phone's display, letting attackers impersonate banks, IT help desks, and executives in vishing calls.

Catfishing is creating a fake online persona to deceive someone into a relationship — the social-engineering engine behind romance scams and honey traps.

CEO fraud is a social engineering attack where criminals impersonate a senior executive to pressure an employee into urgent wire transfers or data disclosure.

Clean Desk Policy

A clean desk policy requires employees to clear sensitive documents, notes, and media from their workspace — closing the oldest data leak there is: paper in plain sight.

ClickFix is a social engineering attack that uses fake CAPTCHAs or error prompts to trick victims into pasting and running malicious commands themselves.

Clone phishing copies a real email the victim already received, swaps its links or attachments for malicious ones, and resends it as a follow-up.

Command and Control (C2)

Command and control (C2) is the covert channel malware uses to receive an attacker's instructions and send stolen data out — the remote hand on the compromised device.

A computer worm is malware that self-replicates across networks without user interaction, exploiting unpatched systems — unlike trojans, it needs no one to invite it in.

Consent Phishing

Consent phishing tricks users into granting a malicious OAuth app access to their cloud account — bypassing passwords and MFA entirely via legitimate consent screens.

Conversation Hijacking

Conversation hijacking is an attack where criminals reply inside a real, ongoing email thread from a compromised account, making their malicious request look routine.

Credential Harvesting

Credential harvesting is the collection of usernames and passwords at scale, usually through fake login pages, phishing kits or infostealer malware.

Credential Stuffing

Credential stuffing is an automated attack that tries username-password pairs stolen from one breach against many other sites, exploiting password reuse.

A crypto drainer is a malicious script or phishing kit that tricks victims into signing wallet transactions that empty their cryptocurrency holdings.

Cryptojacking is the unauthorized use of a victim's computing power to mine cryptocurrency, delivered through malware, malicious ads, and cloud breaches.

Cyber hygiene is the set of routine practices — updates, strong authentication, least privilege, awareness — that keeps users and systems resistant to attack.

Cyber Kill Chain

The cyber kill chain is a model of the stages of an attack, from reconnaissance to impact — break any link early and the whole intrusion fails.

D

The dark web is the part of the internet reachable only through anonymizing networks like Tor, where stolen credentials and criminal services are traded.

A data breach is an incident where confidential data is accessed, stolen or exposed by an unauthorized party — most often starting with a human mistake.

Data Classification

Data classification labels information by sensitivity — public, internal, confidential, restricted — so controls and training can focus where loss actually hurts.

Data Exfiltration

Data exfiltration is the unauthorized transfer of data out of an organization — by external attackers, malicious insiders, or careless employees.

Data Loss Prevention (DLP)

Data loss prevention (DLP) is a set of controls that detect and block sensitive data leaving an organization via email, uploads, AI prompts, or devices.

Data poisoning corrupts the data an AI system learns from or retrieves, planting biased, false, or malicious content that later steers the model's behavior.

A deepfake is AI-generated synthetic media — audio, video, or images — used in social engineering to impersonate trusted individuals convincingly.

Defense in Depth

Defense in depth is layering independent security controls so that when one fails — and one always does — the next layer limits the damage.

Deprovisioning is the removal of a user's accounts, credentials and entitlements when they leave or change roles. Slow deprovisioning leaves doors open.

Device Code Phishing

Device code phishing tricks users into entering an attacker's code on a legitimate login page, handing over OAuth tokens without stealing a password.

Digital Footprint

A digital footprint is the trail of data a person or company leaves online — the raw material attackers mine for targeted phishing and impersonation.

Digital Operational Resilience Act (DORA)

DORA (EU 2022/2554) is the EU regulation making financial entities manage ICT risk — with compulsory security awareness training for all staff and management.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email, letting receivers verify the message really came from the signing domain and was not altered in transit.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication standard that tells receiving servers how to handle messages that fail SPF or DKIM checks, blocking exact-domain spoofing.

Double Extortion

Double extortion is ransomware that steals data before encrypting it, so victims face both an outage and a leak — and backups alone no longer save them.

Doxxing is the deliberate gathering and publication of someone's private information — home address, phone, employer — to intimidate, harass, or enable attacks.

Drive-by Download

A drive-by download infects a device through a compromised or malicious web page, with little or no user action beyond visiting the site.

Dumpster Diving

Dumpster diving is the practice of searching an organization's discarded trash for documents, media, or hardware that reveal sensitive information for attacks.

Dwell time is how long an attacker operates inside a network before being detected — the window in which a foothold becomes a full breach.

E

Eavesdropping Attack

An eavesdropping attack intercepts private communications — network traffic, calls, or conversations — without the participants' knowledge.

Elicitation is the social engineering technique of extracting sensitive information through seemingly casual conversation, without ever asking directly.

Email bombing floods a victim's inbox with thousands of messages to bury security alerts or set up a fake IT support rescue call.

Employment Scam

An employment scam uses a fake job offer, recruiter or new-boss message to steal money, personal data or credentials from job seekers and newly hired employees.

Endpoint Detection and Response (EDR)

EDR is security software that continuously records what happens on laptops and servers, detects malicious behavior, and lets responders investigate and contain it remotely.

Evil Twin Attack

An evil twin attack uses a rogue Wi-Fi access point that mimics a legitimate network to intercept traffic and steal credentials from users who connect.

F

Forgetting Curve

The forgetting curve describes how memory decays after learning — steeply at first, then leveling off — and why one-off security training fades within months.

Formjacking is the injection of malicious script into a website's forms — usually checkout pages — to skim card numbers and credentials as users type.

G

Gamification applies game mechanics — points, badges, leaderboards, streaks — to security training. Done well it sustains engagement; done badly it backfires.

The GDPR is the EU's data protection law. Its security, training, and 72-hour breach notification duties make employee behavior a compliance matter.

A gift card scam is a fraud in which attackers impersonate executives or vendors to pressure employees into buying gift cards and sending the redemption codes.

H

Help Desk Fraud

Help desk fraud is a social engineering attack where a caller impersonates an employee to trick the IT service desk into resetting passwords or MFA.

HIPAA sets US rules for protecting health information — including a required security awareness and training program for the entire workforce.

Homograph Attack

A homograph attack uses characters that look identical to others — like Cyrillic 'а' for Latin 'a' — to forge domains and messages that pass visual inspection.

A honey trap is a social engineering attack that builds a fake romantic or personal relationship to extract credentials, secrets, or access from a target.

A honeypot is a decoy system or account planted to attract attackers, revealing intrusions early because no legitimate user should ever touch it.

Human error in security is an unintentional action — a wrong click, a misdirected email, a skipped step — that creates or enables a breach.

A human firewall is a workforce trained and measured to recognize, resist and report social engineering — the defensive layer technology cannot replace.

Human-in-the-Loop

Human-in-the-loop is a control design where a person must review or approve an automated system's consequential actions before they take effect.

I

Identity Provider (IdP)

An identity provider is the central service that authenticates users and vouches for them to every connected app — making it the most valuable door in the company.

Incident Response Plan (IRP)

An incident response plan is the written, rehearsed playbook for detecting, containing, and recovering from a security incident — before the clock starts running.

An infostealer is malware that silently harvests saved passwords, cookies and session tokens from a device and sells them into the criminal economy.

Initial Access Broker

An initial access broker (IAB) is a criminal who breaks into organizations and sells that access to other attackers, such as ransomware groups.

An insider threat is the risk that employees, contractors, or partners with legitimate access cause harm — maliciously, negligently, or after being compromised.

Invoice fraud tricks a company into paying a fake or altered invoice, typically by impersonating a real supplier and changing the bank account details.

ISO/IEC 27001 is the international standard for information security management systems — and it makes security awareness a required, auditable control.

J

Jailbreaking (in AI) is crafting input that tricks a model into ignoring its safety rules — role-play, fake authority, and encoding tricks are common routes.

Juice jacking is an attack that uses compromised public USB charging stations to steal data from or install malware on devices plugged in to charge.

Just-in-Time Training

Just-in-time training delivers a short security lesson at the moment a risky behavior occurs — such as right after a simulated phishing click — instead of in an annual course.

K

A keylogger is software or hardware that secretly records keystrokes to steal passwords, messages, and card numbers, feeding credential-based attacks.

L

A laptop farm is a home where a facilitator runs many corporate laptops so fraudulent overseas remote workers appear to work from inside the country.

Lateral Movement

Lateral movement is how attackers spread from their first compromised account or device to the systems they actually want, reusing stolen credentials and trust.

Living off the Land (LOTL)

Living off the land is an attack technique that abuses legitimate, pre-installed system tools — PowerShell, mshta, admin utilities — so malicious activity looks like normal work.

Lookalike Domain

A lookalike domain is a web domain registered to visually imitate a legitimate one — swapped letters, added words, or alternate TLDs — used for phishing, BEC and brand impersonation.

M

Malvertising is the use of online advertising to spread malware or lead users to phishing pages, often through legitimate ad networks and search ads.

Malware-as-a-Service (MaaS)

Malware-as-a-service is the criminal business model of renting ready-made malware, infrastructure and support to attackers on a subscription basis.

Man-in-the-Browser Attack

A man-in-the-browser attack plants malicious code inside the browser itself, silently altering what the user sees and submits — after login and MFA.

Medical Identity Theft

Medical identity theft is the fraudulent use of someone's identity or health coverage to obtain care, drugs, or payouts — a lasting harm of healthcare breaches.

MFA bypass is any technique that defeats multi-factor authentication — from push fatigue and AiTM proxies to help desk resets and SIM swapping.

MFA Fatigue Attack

An MFA fatigue attack bombards a user with repeated multi-factor authentication push notifications until they approve one out of frustration or confusion.

Microlearning delivers training in short, single-topic sessions of two to ten minutes — the format that fits real attention spans and slows knowledge decay.

Mobile Device Management (MDM)

Mobile device management (MDM) is software that enrolls, configures, and secures phones, tablets, and laptops centrally — enforcing policy wherever the device goes.

A money mule moves stolen funds through their own accounts for criminals — knowingly or not. How mule recruitment works and how to keep employees out of it.

Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) requires two or more independent proofs of identity to log in, so a stolen password alone is not enough for account access.

N

Network Segmentation

Network segmentation divides a network into isolated zones so one compromised account or device cannot reach everything — containing breaches by design.

The NIS2 Directive (EU 2022/2555) is the EU cybersecurity law for 18 critical sectors, mandating risk management, training and 24-hour incident reporting.

O

Offboarding (Leaver Risk)

Offboarding is the controlled removal of a departing employee's access and data. Done late or incompletely, it leaves accounts attackers and insiders can use.

One-Time Password (OTP)

A one-time password is a code valid for a single login or transaction, delivered by SMS, app, or token — stronger than static passwords, but phishable.

Orphaned Account

An orphaned account is an active login whose owner has left or whose purpose has lapsed. Unwatched and unowned, it is a favorite entry point for attackers.

OSINT (Open-Source Intelligence)

OSINT is intelligence gathered from publicly available sources. Attackers use it to research targets and build convincing social engineering pretexts.

An OTP bot is an automated calling or texting service criminals use to trick victims into revealing one-time passcodes, defeating SMS and app-based MFA at scale.

P

A passkey is a phishing-resistant FIDO2/WebAuthn credential — a cryptographic key pair bound to one website — that replaces passwords and one-time codes.

A passphrase is a password built from a sequence of words — long enough to resist cracking, memorable enough for the few secrets no tool can store for you.

Password Manager

A password manager generates, stores, and autofills unique credentials — a core defense against credential stuffing, password reuse, and lookalike phishing sites.

Password Spraying

Password spraying is a brute-force technique that tries a few common passwords against many accounts, staying under lockout thresholds while hunting weak credentials.

Patch Management

Patch management is the process of finding, testing, and applying software updates across an organization so known vulnerabilities are closed before attackers exploit them.

Payroll Diversion

Payroll diversion is a business email compromise variant in which an attacker impersonates an employee to redirect their salary to a bank account the attacker controls.

PCI DSS is the security standard for organizations handling card payments. Requirement 12.6 makes ongoing security awareness training mandatory.

Penetration Testing

Penetration testing is an authorized simulated attack that finds exploitable weaknesses — in systems, and increasingly in people and processes.

Pharming is an attack that silently redirects users from legitimate websites to fraudulent copies by corrupting DNS resolution — no click on a bad link required.

Phishing is a social engineering attack that uses fraudulent emails, websites, or messages to trick people into revealing sensitive information or installing malware.

A phishing kit is a ready-made package of fake login pages, scripts and evasion tools that lets low-skill attackers run professional phishing campaigns.

Phishing-as-a-Service (PhaaS)

Phishing-as-a-service sells hosted phishing campaigns by subscription — fake login pages, MFA-bypassing proxies, and a dashboard, no skill required.

Phishing-Resistant MFA

Phishing-resistant MFA is multi-factor authentication that cannot be captured or relayed by a fake login page — in practice, FIDO2 security keys and passkeys bound cryptographically to the legitimate domain.

Pig Butchering Scam

Pig butchering is a long-con investment scam where fraudsters build trust over weeks, then lure victims into fake crypto platforms and drain their funds.

Pretexting is a social engineering technique where the attacker creates a fabricated scenario to gain the victim's trust and extract information or access.

Principle of Least Privilege

Least privilege means every user, process and system gets only the access it needs, for only as long as it needs it — limiting what a compromised account can do.

Privilege Creep

Privilege creep is the gradual buildup of access rights as people change roles and projects without ever losing old permissions — widening breach blast radius.

Privileged Access Management (PAM)

Privileged access management (PAM) secures and monitors the powerful accounts — admins, service accounts, root — that attackers and insiders prize most.

Prompt Injection

Prompt injection is an attack that hides malicious instructions in content an AI assistant processes, manipulating it into leaking data or taking harmful actions.

Protected Health Information (PHI)

Protected health information (PHI) is individually identifiable health data safeguarded under HIPAA — and one of the most valuable targets attackers can steal.

Purple teaming pairs attackers and defenders in one collaborative exercise: attack, observe detection, fix, retest — until defenses provably improve.

Q

Quid Pro Quo Attack

A quid pro quo attack is a social engineering technique that offers a service or benefit — often fake IT support — in exchange for access, credentials, or data.

Quishing (QR code phishing) is a social engineering attack that uses malicious QR codes to direct victims to credential-harvesting sites or malware downloads.

R

Ransomware is malware that encrypts or steals an organization's data and demands payment, most often delivered through phishing and stolen credentials.

A red team is a group authorized to simulate real attackers against an organization, including social engineering, to test defenses end to end.

A refund scam baits victims with a fake refund — an overpayment trick or bogus subscription charge — to steal money, credentials, or remote access.

Remote Access Trojan (RAT)

A remote access trojan is malware that gives an attacker covert, ongoing control of a victim's device — keyboard, files, camera and credentials included.

Rogue Access Point

A rogue access point is an unauthorized Wi-Fi radio on or near your network — planted or naive — that lets attackers bypass the perimeter or harvest traffic.

A romance scam builds a fake online relationship to extract money or information — and increasingly reaches employees through workplace-adjacent platforms.

A rootkit is malware engineered to hide its own presence, burying itself in the operating system or firmware so attackers keep privileged access while evading detection.

S

Sandboxing runs untrusted files and code in an isolated environment to observe their behavior safely — and is a key reason attackers now target people instead.

Scareware is malicious software or fake alerts that frighten victims into installing malware or paying for useless 'security' products by faking an infection.

Security Champion

A security champion is an employee inside a business team who acts as its first point of contact for security, reinforcing good behavior and reporting risk back.

Security Culture

Security culture is the shared attitudes, norms and habits that shape how people in an organization actually behave around security when nobody is checking.

Security Fatigue

Security fatigue is the weariness that builds when security demands too many decisions — leading people to reuse passwords, dismiss warnings, and take shortcuts.

A security nudge is a small, well-timed prompt — a banner, a warning, a reminder — that steers employees toward the safe choice without blocking them or requiring training.

Security Operations Center (SOC)

A security operations center (SOC) is the team that monitors, detects and responds to security events — including the ones people report.

Security Posture

Security posture is an organization's overall readiness to prevent, detect, and respond to attacks — controls, processes, and the human layer combined.

SEO poisoning manipulates search rankings so malicious sites appear as top results, luring users to fake downloads, login pages, and support numbers.

Session Hijacking

Session hijacking is the theft or takeover of an authenticated session — via stolen cookies or tokens — letting an attacker bypass login and MFA entirely.

Sextortion is a form of blackmail in which attackers threaten to release intimate or compromising material unless the victim pays or complies.

Shadow AI is employees' use of AI tools without IT approval — chatbots, assistants, note-takers — creating invisible data leakage and compliance risk.

Shadow IT is technology used without IT approval — unsanctioned apps, accounts, and AI tools that expand attack surface outside security's visibility.

Shoulder Surfing

Shoulder surfing is observing someone's screen or keyboard to steal passwords, PINs, or confidential data — in person or via cameras in public spaces.

SIEM (Security Information and Event Management)

A SIEM is a platform that collects and correlates logs from across an organization's systems to detect, investigate, and document security incidents in one place.

SIM swapping is an attack where criminals socially engineer a mobile carrier into transferring a victim's phone number to their SIM, hijacking SMS codes and accounts.

Single Sign-On (SSO)

Single sign-on lets one identity-provider login open many applications — fewer passwords to steal, but one credential whose compromise opens everything.

Smart Contract Scam

Smart contract scams hide theft inside blockchain code — fake tokens, malicious approvals, rug pulls. How they work and how to protect employees.

Smishing (SMS phishing) is a social engineering attack that uses text messages to trick recipients into clicking malicious links or sharing sensitive information.

SOC 2 is an audit framework for how service organizations protect customer data. What the Trust Services Criteria cover and where the human layer fits.

Social Engineering

Social engineering is the practice of manipulating people into giving up confidential information, access, or taking actions that compromise security.

Spaced Repetition

Spaced repetition schedules reviews at increasing intervals to beat memory decay — the evidence-based way to make security awareness training stick.

Spear phishing is a targeted phishing attack that uses personalized information about the victim to increase its effectiveness.

SPF (Sender Policy Framework) is an email authentication standard that lets a domain publish which servers may send mail on its behalf, helping receivers reject forged senders.

Spoofing is the falsification of an identity signal — sender address, caller ID, domain, or website — to make an attack appear to come from a trusted source.

Spyware is malicious software that covertly monitors a device — harvesting credentials, messages, and activity — and feeds social-engineering attacks.

Supply Chain Attack

A supply chain attack compromises a trusted vendor, software update, or service provider to reach that supplier's customers — trust as the attack vector.

Synthetic Identity Fraud

Synthetic identity fraud combines real and fabricated personal data into a new, fake identity used to open accounts, pass checks, or get hired.

T

Tailgating (Piggybacking)

Tailgating is a physical social engineering attack where an unauthorized person follows an employee through a secured door into a restricted area.

A task scam is a job fraud where victims perform small paid online tasks, then are pressured to deposit their own cryptocurrency to unlock higher earnings that never materialize.

Tech Support Scam

A tech support scam impersonates IT or vendor support to gain remote access or payment, often via fake virus pop-ups, cold calls, or search ads.

Threat Intelligence

Threat intelligence is analyzed information about attackers — their tools, infrastructure, and methods — used to anticipate, detect, and respond to attacks before and as they happen.

A trojan horse is malware disguised as legitimate software, relying on the user to install it — deception rather than self-replication.

Typosquatting registers look-alike domains — misspellings or swapped characters — to catch mistyped URLs and lend fake emails and sites credibility.

U

USB Drop Attack

A USB drop attack seeds infected flash drives where targets will find them, exploiting curiosity to get malware or keyloggers inside a network.

User Access Review

A user access review is a periodic audit confirming that every account and permission maps to a current person and a current need — and revoking the rest.

User Behavior Analytics (UBA)

User behavior analytics (UBA) baselines how each account normally behaves and flags anomalies — a key control for spotting insider risk and account takeover.

V

Vendor Email Compromise (VEC)

Vendor email compromise hijacks a supplier's real email account or thread to redirect customer payments — BEC's hardest-to-spot variant.

Virtual Private Network (VPN)

A virtual private network (VPN) encrypts traffic between a device and a trusted network, protecting remote work from snooping and rogue Wi-Fi hotspots.

Vishing (voice phishing) is a social engineering attack conducted over phone calls to manipulate victims into revealing sensitive information or taking harmful actions.

Voice cloning uses AI to replicate a person's voice from a short audio sample, letting attackers impersonate executives and colleagues over the phone.

Vulnerability Management

Vulnerability management is the continuous cycle of finding, prioritizing, and fixing security weaknesses — technical flaws and the human layer alike.

W

Wardriving is scanning for Wi-Fi networks from a moving vehicle to map targets. How attackers use it and how to keep your wireless edge off the map.

Watering Hole Attack

A watering hole attack compromises a website a target group already trusts and visits, infecting visitors instead of approaching them directly.

Whaling is a spear phishing attack specifically targeting senior executives or high-value individuals within an organization.

Wire Transfer Fraud

Wire transfer fraud manipulates a person or process into sending an irrevocable bank transfer to an attacker-controlled account.

Z

Zero trust is a security model that grants no implicit trust based on network location or identity claims — every access request is verified. Where the human layer fits.

Zero-Click Attack

A zero-click attack compromises a device or account with no victim interaction at all — no click, no download — by exploiting flaws in software that processes data automatically.

A zero-day is a vulnerability unknown to the software vendor, exploitable before any patch exists — the vendor has had zero days to fix it.