This cyber security glossary explains 42 IT and security terms in plain English, from AiTM phishing and XDR to RPO, DMARC and ASD Essentials. Each entry gives a one-sentence definition, why the term matters to an Australian small or mid-sized business and, for most terms, a link to the Key IT page that covers it in depth. Every cited fact was checked against its source on 15 October 2026.
Terms are listed alphabetically, with abbreviations under their short form (look up XDR, not extended detection and response). Where a definition rests on an Australian rule or vendor documentation, the source is linked inline, using the primary document wherever we could reach it.
The list is short on purpose: terms that come up at insurance renewal, in security questionnaires or after a strange sign-in alert. Entries are updated when the rules or vendor documentation behind them change.
The 3-2-1 rule means keeping three copies of your data, on two different types of storage, with one copy off-site. Why it matters: it survives a dead server, a burst pipe or a stolen laptop. Ransomware gangs now hunt for backups first, so the modern version makes one copy immutable or offline. Go deeper: why backups alone don't beat double extortion.
AiTM phishing uses a fake sign-in page that sits between your staff member and the real Microsoft 365 login, copying the password and session cookie as they pass through. Why it matters: because the signed-in session is stolen, ordinary MFA codes don't stop it, and Microsoft saw payment fraud begin as little as five minutes later. Go deeper: the first-hour checklist for a hacked Microsoft 365 account.
ASD Essentials is the Australian Signals Directorate's principles-based cyber security framework, released on 15 October 2026 to replace the Essential Eight over time. Why it matters: it drops the single maturity score, puts identity services and internet-facing edge devices first, and asks for defined board accountability. iTnews reports the transition will likely take a year or two. Go deeper: what ASD Essentials changes for a small business.
Business email compromise is fraud run through a real or convincingly faked business mailbox, usually to change bank details or approve a payment. Why it matters: there's no malware for antivirus to catch; the signs are an overseas sign-in, a new inbox rule hiding replies, or a supplier suddenly "updating" their account. Go deeper: how email security stops spoofed invoices.
Co-managed IT is a shared arrangement where your in-house IT person keeps some responsibilities and a managed service provider takes the rest, such as security monitoring, patching or projects. Why it matters: one internal IT manager can't patch, read alerts, run a migration and take leave all at once. Go deeper: sharing the IT load with Key IT.
Conditional Access is the Microsoft Entra feature that decides whether each sign-in is allowed, using if-then rules about the person, device, location and app. Why it matters: it blocks overseas sign-ins, requires managed devices and switches off risky flows such as device code sign-in. Microsoft says it needs Entra ID P1, and Business Premium customers can use it. Go deeper: locking down Microsoft 365 for your team.
Device code phishing tricks someone into typing a short code into Microsoft's genuine sign-in page, which quietly signs an attacker's device into their account. Why it matters: no password changes hands, so "check the web address" advice fails. In May 2026 ASD warned of device code phishing against Microsoft 365 users, and Microsoft recommends blocking device code flow wherever possible. Go deeper: how to switch device code sign-in off.
DKIM adds a digital signature to every email your domain sends, so the receiving server can confirm it really came from you, unaltered. Why it matters: each service that sends as your domain (Microsoft 365, accounting software, newsletters) needs its own DKIM key switched on. Miss one and its mail is more likely to land in junk or fail DMARC.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record telling receiving servers whether to deliver, quarantine or reject email that fails authentication for your domain. Why it matters: without an enforced policy, anyone can send a fake invoice from your exact address. Gmail requires DMARC from bulk senders, and RFC 9989 replaced the original specification in May 2026. Go deeper: SPF, DKIM and DMARC step by step.
EDR is security software on each laptop and server that records what programs do, flags attack-like behaviour, and can cut the device off the network. Why it matters: it catches new ransomware and misused Windows tools that file-matching antivirus misses. Defender for Business, included in Business Premium, contains EDR, but someone still has to act on its alerts. Go deeper: is Microsoft Defender enough for a small business?
The Essential Eight is ASD's set of eight baseline mitigation strategies, from patching and MFA to restricting admin rights and regular backups, with organisations rated from Maturity Level Zero to Three. Why it matters: insurers and larger customers still ask about it in their security questionnaires, and an ASD official has said Essential Eight investment "will still be relevant" under ASD Essentials. Go deeper: Essential Eight implementation with Key IT.
ESU is Microsoft's paid program that keeps security patches flowing to Windows 10 PCs after support ended in October 2025. Why it matters: organisations pay US$61 per device for year one, the price doubles yearly for a maximum of three years, and late joiners pay for missed years. It buys time, not features or support. Go deeper: the free and paid ESU routes compared.
An immutable backup is a copy that cannot be edited, encrypted or deleted until its retention period ends, even with an administrator password. Why it matters: it survives ransomware or a stolen admin account. For our dental clients we keep an immutable copy of Dental4Windows servers, and for clinics on Best Practice we run its own backup alongside our immutable copy. Go deeper: IT and backups for dental practices.
Intune is Microsoft's cloud-based endpoint management service for enrolling, configuring, securing and updating company devices, and protecting work data in apps on personal phones. Why it matters: it lets you wipe a lost laptop, push security settings everywhere, and feed device health into Conditional Access so only managed devices reach company data. Go deeper: which Microsoft 365 business plan includes what.
Least privilege means every person, app and service account gets only the access its job needs. Why it matters: a compromised account hands the attacker exactly what it could reach, so a receptionist with global admin rights is an incident waiting to happen. AI raises the stakes: Microsoft Copilot can surface any organisational data a user has permission to view. Go deeper: what the Copilot SearchLeak flaw taught us about permissions.
MDR is a service rather than a product: analysts watch your EDR and other tools around the clock, investigate alerts and contain real threats. Why it matters: plenty of businesses own detection tools, yet nobody reads the alerts at 2am on a Sunday. Closing that gap is the job of Key IT's 24/7 SOC service. Go deeper: Key IT's managed cybersecurity service.
MFA means proving who you are with something extra on top of a password, such as an authenticator app or security key. Why it matters: a stolen password alone no longer gets an attacker in, and MFA is moving into industry rules. ARNECC's draft version 8 conveyancing rules propose MFA for all remote access, Subscriber Administrator accounts and email (consultation closed; not yet final). Go deeper: IT security for Melbourne conveyancers.
MFA fatigue, or push bombing, is when an attacker who already has a password fires off approval requests until a tired staff member taps Approve. Why it matters: it turns MFA into the weak point. Microsoft's counter is number matching, now enabled for all Authenticator push notifications; phishing-resistant MFA removes the approval prompt altogether. Go deeper: how AI changed phishing.
NCE is Microsoft's licensing model for Microsoft 365 and other cloud subscriptions bought through a partner, on monthly or annual terms. Why it matters: per-user licences can be cancelled for a prorated refund only within seven calendar days of purchase, and that window stays shut until renewal. Buy 25 annual seats for 20 staff, miss the window, and you pay for all 25 until the term renews. Go deeper: Microsoft licensing through Key IT.
An MSP is an IT company that runs your technology for a predictable monthly fee: helpdesk, devices, Microsoft 365, backups and patching. Why it matters: you swap call-out bills for a known cost. Melbourne's market range sits around $100–$200 per user each month, with scope driving the price. Key IT works month to month, with a helpdesk open Monday to Friday, 8am to 5pm. Go deeper: managed IT support explained.
An MSSP is a provider that specialises in security operations (monitoring, threat detection and incident response) rather than everyday IT. Why it matters: an MSSP raises the alarm but usually won't patch the server or reset the password, so a business with a separate MSP can end up relaying between two vendors mid-incident. Go deeper: MSP or MSSP: which one you need.
A NASH (National Authentication Service for Health) certificate lets a healthcare organisation's clinical software connect to My Health Record, electronic prescribing, secure messaging and the Healthcare Identifiers Service. Why it matters: certificates expire, and a lapsed one breaks those connections mid-clinic. Key IT tracks NASH, PRODA and HPOS certificate expiry dates for the clinics we look after. Go deeper: IT support for Melbourne medical clinics.
The NDB scheme is the part of the Privacy Act requiring covered organisations to notify affected people and the OAIC of a data breach likely to cause serious harm. Why it matters: a suspected breach must be assessed within 30 calendar days, and a turnover of $3 million or less doesn't exempt health service providers. Go deeper: what the 2026 draft privacy reforms would change.
A passkey is a passwordless sign-in built on two cryptographic keys: a public key held by the service and a private key on your device, unlocked by fingerprint, face or PIN. Why it matters: it only works on the genuine site it was made for, so a lookalike page captures nothing. Microsoft Entra ID supports passkeys, including in Microsoft Authenticator. Go deeper: passkeys for a Microsoft 365 business.
A payment redirection scam is when a criminal posing as a supplier or settlement party gets your business to pay a genuine invoice into the wrong account. Why it matters: it was Australia's second costliest scam type in 2025, with $166.8 million in reported losses in the National Anti-Scam Centre's Targeting Scams report. Confirm any bank detail change by phone, on a number you already hold. Go deeper: anatomy of a payment redirection scam.
A penetration test is a time-boxed exercise where a security specialist, with your written permission, attempts to get into your systems as a genuine attacker would, then reports what worked. Why it matters: it finds chained weaknesses a scanner can't, like a reused password plus an open file share plus an exposed remote-access portal. Go deeper: penetration testing with Key IT.
Phishing is a message (email, text, Teams chat or phone call) built to fool someone into opening a link, sharing a code or sending money. Why it matters: it opens most attacks in this glossary, from BEC to device code phishing, and AI tools now write fluent lures without the spelling mistakes staff were taught to spot. Practice on safe fakes helps. Go deeper: run a phishing simulation for your team.
Phishing-resistant MFA is any sign-in method that can't be relayed through a fake website because the credential is cryptographically tied to the real one, such as passkeys, FIDO2 security keys and certificate-based authentication. Why it matters: AiTM kits relay SMS codes and simple push approvals in real time. Microsoft's AiTM research recommends making MFA "phish-resistant", and ASD's examples for ASD Essentials include requiring it. Go deeper: why insurers and supply chains ask about your Essential Eight level.
Ransomware is malicious software that encrypts your files and systems, usually after attackers have copied your data, then demands payment. Why it matters: paying doesn't guarantee recovery and can trigger a legal reporting duty. The outcome turns on whether you can restore from backups the attackers couldn't touch, and how early someone spotted the intrusion. Go deeper: a ransomware attack, stage by stage.
Ransomware payment reporting is the Cyber Security Act 2024 duty to tell ASD about a ransom or extortion payment within 72 hours of paying, or of finding out someone paid for you. Why it matters: it covers critical infrastructure entities and businesses whose annual turnover exceeds the $3 million threshold in the 2025 Rules, and the duty still applies when someone else, such as an insurer or negotiator, pays for you. Go deeper: the 72-hour ransomware reporting rule explained.
ReportCyber is the Australian Government's online tool for reporting cybercrime and cyber security incidents, reached through cyber.gov.au. Why it matters: reports are assessed and passed to the right police or law enforcement agency. It can't claw back stolen money, so if funds have gone, Victoria Police advises contacting your bank immediately. Go deeper: Key IT's cyber incident response.
RPO (recovery point objective) is how much recent data you can afford to lose, counted back to your last good backup; RTO (recovery time objective) is the longest outage you can tolerate. Why it matters: a nightly backup means an RPO of up to 24 hours: a day of work re-keyed by hand. Agree both numbers first; they shape the backup design. Go deeper: disaster recovery and business continuity.
A SIEM collects logs from firewalls, servers, Microsoft 365 sign-ins and endpoints, and links related events so an attack spread across several systems stands out. Why it matters: a sign-in from an unfamiliar country, then a new inbox rule, then a mass file download only looks like an attack when the events are joined up. Go deeper: the tools in Key IT's security stack.
SMB1001 is a five-level cyber security certification standard for small and medium businesses, published by Dynamic Standards International and badged Bronze to Diamond by its official certifier, CyberCert. Why it matters: it ends in a certificate customers can see, and ARNECC's draft conveyancing rules list it alongside the Essential Eight for deemed cyber compliance. SMB1001:2026 was released on 1 September 2025. Go deeper: SMB1001 vs the Essential Eight.
SOAR is technology that automates the repetitive steps of responding to security alerts, such as disabling an account or isolating a laptop, using pre-written playbooks. Why it matters: routine threats get the same response at any hour. Microsoft notes SOAR is increasingly built into SIEM products such as Microsoft Sentinel, and small businesses usually get it inside a managed SOC service.
A SOC is the team, tools and processes that watch an organisation's systems for signs of attack around the clock and respond. Why it matters: intrusions don't keep business hours, and running a SOC yourself is beyond a small business budget. Key IT's 24/7 SOC service, included for managed clients, covers endpoints, Microsoft 365 sign-ins and email; our security-certified engineers handle remediation. Go deeper: 24/7 SOC monitoring with Key IT.
SPF is a DNS record listing the servers and services allowed to send email using your domain. Why it matters: receivers check it to spot forgeries, and Gmail requires every sender to use SPF or DKIM. The SPF standard, RFC 7208, caps a record at ten DNS lookups, so a business that keeps adding sending tools can silently break it. Pair it with DKIM and DMARC.
Token theft is when an attacker steals the digital pass your device receives after sign-in, then replays it to use your account. Why it matters: Microsoft's playbook notes a stolen token works even after the real user passed MFA, so a password reset isn't enough; sessions must be revoked too. Watch for new MFA methods and mail forwarding rules. Go deeper: cyber security services for Melbourne businesses.
A vCIO is a senior technology adviser who does the strategic part of a CIO's job (roadmap, budget, risk and vendors) for a fraction of a full-time hire's cost. Why it matters: a growing business still needs someone planning device refreshes, licence spend and obligations like the move to ASD Essentials, without carrying an executive salary. Go deeper: Key IT's fractional CIO service.
A vulnerability scan is an automated check of your network and internet-facing systems for known weaknesses such as missing patches, outdated firmware and risky settings. Why it matters: scans are broad and should run continuously; a penetration test is narrow, deep and periodic. You need both. Key IT's managed scanning starts from $149 a month. Go deeper: managed vulnerability scanning.
XDR is a detection platform that ingests data from endpoints, networks, cloud, email and identities, so an attack moving between them shows up as one incident instead of five unrelated alerts. Why it matters: EDR sees one device; XDR sees the phishing email, the risky sign-in and the infected laptop together, but it still needs people watching. Go deeper: EDR, MDR, XDR, SIEM and SOC compared.
Zero trust is a security model that grants no automatic trust to a person or device because it sits inside the office network, and checks every access request instead. Why it matters: staff work everywhere now. NIST set out the model in SP 800-207 in 2020; for a small business it mostly means MFA, Conditional Access, managed devices and least privilege. Go deeper: the security principles behind every Key IT service.
EDR is software that watches individual devices. XDR is a broader platform joining signals from devices, email, identities and cloud apps. MDR is neither: it's a service, where analysts watch those tools around the clock and act on what they find. A small business usually needs EDR or XDR plus MDR; unwatched tools just produce unread alerts.
Yes, gradually. ASD released ASD Essentials on 15 October 2026, but the Essential Eight stays published alongside it and no date has been settled for the new framework becoming mandatory. Check existing controls against ASD Essentials rather than assuming they're equivalent, starting with our free Essential 8 self-assessment.
Not quite. A passkey is one type of phishing-resistant MFA; the category also includes FIDO2 security keys and certificate-based authentication. Each binds the credential to the genuine website, so a fake login page captures nothing reusable. SMS codes and push approvals beat a password alone, but can be phished.
It depends. If the Privacy Act covers you (health service providers are covered at any size), a breach likely to seriously harm people must be notified under the NDB scheme. A ransom payment must be reported to ASD within 72 hours if your annual turnover exceeds $3 million or you run critical infrastructure. For most small businesses, reporting other cybercrime through ReportCyber isn't compulsory, but it's worth doing.
Start with identity and email, where many of the attacks in this glossary begin; identity is also where ASD Essentials says to start. That means MFA on every account (moving towards passkeys), Conditional Access blocking device code sign-in and overseas logins, and an enforced DMARC record. Then confirm an immutable backup. A free 30-minute cybersecurity health check shows what you already have.
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.