The cyber security register, in plain English.

Vulnerabilities

Supply chain attack

A supply chain attack is when criminals get at you by compromising a supplier or a product you rely on, instead of attacking you directly.

Social engineering

Spear phishing

Spear phishing is a scam message written for one person or a small team, using real details about them so that it looks like it came from someone they trust.

Credentials and exposure

Secret rotation

Secret rotation means regularly replacing the passwords, keys and tokens that software uses to talk to other systems, so a stolen one stops working.

Social engineering

Quishing (QR code phishing)

Quishing is a phishing scam that hides a dangerous web link inside a QR code, so the victim scans it with their phone instead of clicking a link.

Social engineering

Phishing simulation

A phishing simulation is a safe, fake phishing email sent to your own staff to see who clicks, so you can help them spot the real thing.

Credentials and exposure

Multi-factor authentication

Multi-factor authentication means you need something more than a password to sign in, such as a code from an app, so a stolen password alone is not enough.

Detection and response

Indicators of compromise

Indicators of compromise are the clues left behind by an attack, such as a known bad web address or an odd new account, that tell you someone may have broken in.

Web application security

Cross-site scripting

Cross-site scripting is a website flaw that lets an attacker make your visitors’ browsers run the attacker’s code as if it came from your site.

Social engineering

Business email compromise

Business email compromise is fraud where a criminal uses a hijacked or faked work email account to trick someone into sending money or data.

Credentials and exposure

Brute force attack

A brute force attack is an attacker guessing passwords again and again, usually with software, until one works.

Social engineering

Whaling

Whaling is a scam aimed at the most senior people in a business, such as the managing director or finance director, because their approval is worth the most to a criminal.

Credentials and exposure

Phishing-resistant MFA

Phishing-resistant MFA is a way of signing in, such as a security key or passkey, that cannot be handed over to a fake website even if the user is fooled.

Hacking techniques

Active Directory Certificate Services (AD CS) abuse

AD CS abuse is when a badly set up internal certificate system lets an ordinary user get a certificate that proves they are an administrator and take over the network.

Social engineering

Baiting

Baiting is when attackers leave something tempting, such as a USB stick or free offer, hoping curiosity makes you plug it in or open it and let them in.

Social engineering

Callback phishing

Callback phishing is a scam email with no link, only a phone number, so that you ring the criminals and talk yourself into giving them access or money.

Social engineering

CEO fraud

CEO fraud is when a criminal pretends to be your boss, by email or phone, and tells someone in finance to make an urgent payment to the criminal’s bank account.

Vulnerabilities

Exploited in the wild

A weakness is exploited in the wild when attackers are actually using it against real organisations, so it matters far more than one that is only theoretical.

Social engineering

IT support impersonation

IT support impersonation is when a criminal pretends to be your help desk, by phone, email or Teams, to get a password, a code or control of your computer.

Credentials and exposure

Infostealer malware

Infostealer malware quietly copies saved passwords and login sessions from an infected computer and sends them to criminals, who sell them or use them to log in as you.

Social engineering

Invoice fraud

Invoice fraud is when criminals send a fake invoice, or change the bank details on a real one, so that your payment goes into their account instead of your supplier’s.

Social engineering

MFA fatigue attack

An MFA fatigue attack is when a criminal who already has your password keeps sending login approval requests to your phone until you tap Approve just to make them stop.

Security tools

Nmap

Nmap is a free tool that maps a network by checking which devices and which ports are open, used by IT teams to audit their own systems and by attackers to find a way in.

Security tools

Penetration testing methodology

A penetration testing methodology is the agreed plan for how a tester tries to break into your systems, what is allowed and how the results get reported.

Ports and protocols

Port 22 (SSH)

Port 22 is the network door for Secure Shell, how administrators log in to servers, so exposing it to the whole internet invites constant guessing and scanning.

Ports and protocols

Port 3389 (RDP)

Port 3389 is the network door for Windows Remote Desktop, and leaving it open to the internet is one of the most common ways ransomware gangs get in.

Ports and protocols

Port 443 (HTTPS)

Port 443 is the network door for encrypted web traffic, and the padlock in your browser depends on it being set up and kept up to date properly.

Ports and protocols

Port 445 (SMB)

Port 445 is the network door for Windows file sharing and should never face the internet, because one unpatched flaw in it once let ransomware spread worldwide.

Ports and protocols

Port 80 (HTTP)

Port 80 is the network door web servers use for ordinary, unencrypted pages, and it should normally only send visitors on to the secure version of your site.

Social engineering

Pretexting

Pretexting is when someone invents a believable story and false identity, such as a new starter or IT engineer, to get you to hand over information or access.

Social engineering

Quick Assist abuse

Quick Assist abuse is when a criminal posing as IT support talks you into opening Windows’ built-in remote help tool, which then gives them full control of your computer.

Social engineering

Tailgating (piggybacking)

Tailgating is walking into a secure area by following an authorised person, and piggybacking is when that person knowingly lets the visitor in.

Security tools

Vulnerability scanning

Vulnerability scanning is an automated check of your systems and websites for known weaknesses, such as missing updates and risky settings, that gives you a list to fix.

Vulnerabilities

CISA KEV catalogue: Known Exploited Vulnerabilities

The CISA KEV catalogue is a public list of software flaws that attackers are known to be using right now, so you can fix those first.

Cloud and infrastructure

Cloud shared responsibility model: who secures what

The shared responsibility model says the cloud provider secures the underlying platform, but you are always responsible for your own data, accounts and settings.

Credentials and exposure

What is credential stuffing? How account takeover works

Credential stuffing is when attackers take email and password pairs stolen from one breach and automatically try them on other sites, hoping you reused the password.

Vulnerabilities

What is a CVE? Common Vulnerabilities and Exposures

A CVE is a unique reference number, such as CVE-2023-34362, given to a publicly known security flaw so everyone can talk about the same problem.

Vulnerabilities

What is CVSS? The scoring system explained

CVSS is a standard 0 to 10 score that tells you how severe a software flaw is in general, so you can compare flaws, but not how much risk it poses to your business.

Compliance

What is Cyber Essentials? The UK scheme and its controls

Cyber Essentials is a UK government-recommended certification showing your organisation has five basic technical protections in place against common internet attacks.

Malware and ransomware

What is double extortion ransomware? Explained

Double extortion is when ransomware attackers both lock your files and steal your data, then threaten to publish it, so backups alone cannot make the problem go away.

AI security

What is indirect prompt injection? Hidden AI attacks

Indirect prompt injection is when an attacker hides instructions in an email, web page or document, and an AI assistant that reads it obeys the attacker instead of you.

Web application security

What is the OWASP Top 10? Web risks explained

The OWASP Top 10 is a widely used list of the ten most serious types of weakness in web applications, written by a non-profit so developers and buyers share one checklist.

Credentials and exposure

What is password spraying? How it works and how to stop it

Password spraying is when an attacker tries one or two very common passwords against many accounts, instead of many passwords against one account, so they avoid being locked out.

Credentials and exposure

ICO 72-hour rule: personal data breach guide for UK firms

If you have a personal data breach that is likely to put people at risk, UK law says you must tell the ICO as soon as possible and, where feasible, within 72 hours of finding out.

Social engineering

What is phishing? How to spot it and protect your business

Phishing is a fake email, text or call designed to trick you into clicking a bad link, opening a bad file or giving away a password or payment.

AI security

What is prompt injection? How AI tools get manipulated

Prompt injection is when someone writes text that tricks an AI tool into ignoring its instructions and doing something its owner did not intend.

Malware and ransomware

What is ransomware? How it works and how to protect

Ransomware is malicious software that locks your files or systems, and often steals your data, then demands payment to give them back.

Social engineering

What is smishing? SMS phishing explained for staff

Smishing is phishing by text message: a fake SMS that tries to get you to click a link or hand over a password, code or payment.

Social engineering

What is social engineering? How attackers trick people

Social engineering is when a criminal tricks a person, rather than a computer, into handing over access, information or money.

Web application security

SQL injection: what it is, real cases and prevention

SQL injection is when an attacker types database commands into a website form or link and the website runs them, letting the attacker read or change data they should never see.

Malware and ransomware

What is a Trojan? How Trojan malware works

A Trojan is malicious software that pretends to be something harmless, such as an invoice or a document, so you let it in yourself.

Social engineering

What is vishing? Voice phishing and how to defend

Vishing is phishing by phone call: a caller pretends to be someone you trust to get a password, a code or a payment from you.

Vulnerabilities

What is a zero-day vulnerability? Meaning and risk

A zero-day is a flaw in software that attackers use before the maker has a fix, so there is no patch to install yet.

Vulnerabilities

What is an access bypass vulnerability?

An access bypass is a flaw that lets someone reach a page, system or action without passing the login or permission check that is meant to stand in front of it.

Malware and ransomware

What is data exfiltration? How data is stolen and how to spot it

Data exfiltration is the theft of information out of your business, where an attacker copies your files, emails or databases to somewhere they control.

Vulnerabilities

What is a denial of service (DoS) attack?

A denial of service attack tries to overload a website, network or system so that real customers and staff cannot use it.

Hacking techniques

How DNS spoofing works and how to stop it

DNS spoofing tricks a computer into believing a forged answer about where a website or mail server lives, so people are sent to the attacker’s address instead of the real one.

Hacking techniques

How subdomain takeover works and how to prevent it

A subdomain takeover happens when a company forgets to delete a web address that still points to a service it no longer uses, and an attacker claims that service and starts speaking in the company’s name.

Cloud and infrastructure

Microsoft 365 security basics: the settings to check first

Microsoft 365 security basics are a short list of settings, mostly free, that stop the most common attacks on your email, files and staff accounts.

Vulnerabilities

What is missing authorization (CWE-862)?

Missing authorization means a system knows who you are but never checks whether you are allowed to do what you are asking, so people can reach functions or data that were meant for someone else.

AI security

OWASP Top 10 for LLM applications (2025): the ten risks explained

The OWASP Top 10 for LLM applications is a public list of the ten most important security risks in software built on large language models, the technology behind AI chatbots and assistants.

Vulnerabilities

What is patch management? How to keep software updated safely

Patch management is the routine of finding, testing and installing the fixes that software makers release, so attackers cannot use known flaws to get in.

Ports and protocols

Port 110 (POP3): what it is, how it is attacked and how to secure it

Port 110 is the door that older email programs use to download messages from a mail server, and its plain version sends the password unprotected.

Ports and protocols

Port 143 (IMAP): what it is, how it is attacked and how to secure it

Port 143 is the door that email programs use to read and manage mail that stays on the server, and its plain version sends the login unprotected.

Ports and protocols

Port 1433 (Microsoft SQL Server): what it is, how it is attacked and how to secure it

Port 1433 is the door that applications use to talk to a Microsoft SQL Server database, and it should almost never be open to the internet.

Ports and protocols

Port 161/162 (SNMP): what it is, how it is attacked and how to secure it

Ports 161 and 162 are the doors that network management tools use to ask routers, switches and printers how they are doing, and a weak setup lets an attacker ask the same questions or change settings.

Ports and protocols

Port 20/21 (FTP): what it is, how it is attacked and how to secure it

Port 21 is the door that the File Transfer Protocol (FTP) uses to send files between computers, and it is an old design that sends passwords and files without encryption.

Ports and protocols

Port 23 (Telnet): what it is, how it is attacked and how to secure it

Port 23 is the door for Telnet, an old way of controlling another computer from a keyboard over the network, which sends everything including passwords in plain view.

Ports and protocols

Port 25 (SMTP): what it is, how it is attacked and how to secure it

Port 25 is the door that mail servers use to pass email to each other across the internet.

Ports and protocols

Port 3306 (MySQL): what it is, how it is attacked and how to secure it

Port 3306 is the door that applications use to talk to a MySQL database, and the manufacturer itself says it should not be reachable from untrusted computers.

Ports and protocols

Port 53 (DNS): what it is, how it is attacked and how to secure it

Port 53 is the door for the Domain Name System, the internet’s address book that turns a website name into the number a computer needs.

Compliance

What is the UK GDPR? A plain English guide for small businesses

The UK GDPR is the main UK law on how organisations must look after personal information about customers, staff and anyone else they hold data on.

Security tools

What is Wireshark and how do defenders use it?

Wireshark is a free program that records the traffic on a network and shows it in detail, so an IT person can see exactly what devices are saying to each other.

Hacking techniques

How SQL injection works: the mechanism, a UK fine and how to stop it

SQL injection is when a website passes what a visitor types straight into a database question, so the visitor can change the question and read or alter data they should never see.

Hacking techniques

How CSRF works: cross-site request forgery explained and how to prevent it

CSRF is when a malicious web page tricks your browser, while you are logged in somewhere else, into sending a request that site treats as coming from you.

Ports and protocols

Port 389 (LDAP): what it is, how it is attacked and how to secure it

Port 389 is the door that Windows computers, apps and devices use to ask your company directory, Active Directory, who a user is and whether their password is right.

Security tools

What is Burp Suite? How web penetration testers use it, explained for defenders

Burp Suite is a software toolkit that sits between a web browser and a website so a security tester can see, pause and change the traffic, to find weaknesses in how the site handles it.

Compliance

Cyber Essentials Plus: what the technical audit tests, and do you need a penetration test?

Cyber Essentials Plus is the version of the UK government-backed Cyber Essentials scheme where an independent assessor tests your systems to prove the five basic security controls really work.

Ports and protocols

Port 636 (LDAPS): what it is, how it is attacked and how to secure it

Port 636 is the door that a staff directory uses when it talks over an encrypted connection, and it is the safer sibling of plain LDAP on port 389.

Ports and protocols

Port 135 (MSRPC): what it is, how it is attacked and how to secure it

Port 135 is the reception desk for Windows remote management: it does not do the work itself, it tells other computers which side door to use.

Compliance

What is ISO 27001? A plain-English guide for UK businesses

ISO 27001 is an international standard that shows a customer you run information security as a managed, checked and improving system, not as a set of one-off fixes.

Hacking techniques

How server-side request forgery (SSRF) works and how to stop it

SSRF is when an attacker tricks your web application into making a request on their behalf, so they can reach systems that are hidden from the internet but trust your server.

Security tools

What is Metasploit? A defender’s guide to the penetration testing framework

Metasploit is a toolkit that packages known attack methods into reusable modules, so a security tester can show whether a weakness is really exploitable and an attacker can do the same thing without permission.

Ports and protocols

Port 2049 (NFS): what it is, how it is attacked and how to secure it

Port 2049 is where the Network File System shares folders between Linux and Unix machines, and its default trust model assumes every machine on the network tells the truth.

Ports and protocols

Port 111 (RPCbind): what it is, how it is attacked and how to secure it

Port 111 is the reception desk for a group of older Linux and Unix network services, and it should never be reachable from the internet.

Ports and protocols

Ports 137 to 139 (NetBIOS): what they are, how they are attacked and how to secure them

Ports 137, 138 and 139 belong to NetBIOS, an old Windows way of finding and sharing computers, and they should be blocked at your internet edge.

Hacking techniques

How cross-site scripting (XSS) works: the three types and how developers stop it

Cross-site scripting happens when a website shows text from a user as if it were part of the page’s own code, so a visitor’s browser runs something the site owner never wrote.

Security tools

What is Nessus? How the vulnerability scanner works and what it cannot tell you

Nessus is a widely used program that checks computers and network devices for known weaknesses, such as missing updates, and produces a list for someone to fix.

Ports and protocols

SMB signing: what it is, how it is attacked and how to secure it

SMB signing is a setting that makes Windows file sharing prove each message came from the right machine and was not altered, which stops an attacker on your network passing off someone else’s login as their own.

Ports and protocols

Port 873 (rsync): what it is, how it is attacked and how to secure it

Port 873 is the door a file-copying and backup service called rsync uses when it runs as a network server, and if that door is open to the internet, strangers may be able to list, read or even change your files.

Ports and protocols

Port 993 (IMAPS): what it is, how it is attacked and how to secure it

Port 993 is the encrypted door that email apps use to read mail stored on a server, and the risk is rarely the encryption itself but who is allowed to sign in through it, and how.

Ports and protocols

Port 5985 and 5986 (WinRM): what it is, how it is attacked and how to secure it

Ports 5985 and 5986 let administrators run commands on Windows machines from another computer, which is useful for IT teams and equally useful to an attacker who has found a working login.

Hacking techniques

How session hijacking works: stolen cookies, tokens and how to stop them

Session hijacking is when an attacker steals the small token that proves you are already signed in, then uses it to act as you without needing your password or your MFA code.

Ports and protocols

Port 995 (POP3S): what it is, how it is attacked and how to secure it

Port 995 is the door email programs use to download your mail over an encrypted connection, so if it is open to the internet, it is also a door someone can try to guess passwords against.

Ports and protocols

Port 88 (Kerberos): what it is, how it is attacked and how to secure it

Port 88 is where a Windows domain controller hands out the digital passes that let staff sign in to file shares, databases and servers, so it should be reachable from your own network and not from the internet.

Ports and protocols

Kerberos authentication: how it works, how it is attacked and how to secure it

Kerberos is the system a Windows network uses to prove who you are without sending your password around, by giving you short-lived digital passes (tickets) that servers accept.

Ports and protocols

NTLM authentication: what it is, why it leaks and how to reduce it

NTLM is an old Windows way of proving who you are, and because it can be tricked into handing over a reusable scrambled copy of your password (a hash), Microsoft is retiring it.

Hacking techniques

How privilege escalation works: from ordinary account to administrator

Privilege escalation is when someone who can only do small things on a system finds a way to do bigger things, such as acting as an administrator.

Cloud and infrastructure

RMM tool abuse: how attackers use remote management software and how to protect your business

Remote monitoring and management (RMM) software lets an IT provider see, update and control every computer you own from one console, so an attacker who gets into that console, or who installs a copy of the same tool, can control all of them too.

Hacking techniques

How XML external entity (XXE) attacks work and how to stop them

An XXE attack tricks software that reads XML files into fetching a local file or a web address the attacker chooses, because the software was set up to follow instructions hidden inside the file.

Ports and protocols

Port 5900 (VNC): what it is, how it is attacked and how to secure it

Port 5900 is the door that VNC remote desktop software listens on, and if it faces the internet, anyone can try to take control of that computer’s screen, keyboard and mouse.

Credentials and exposure

What is least privilege and how do you apply it in a small business?

Least privilege means every person, account and piece of software gets only the access it needs to do its job, so that when one account is stolen, the thief can do as little as possible.

Security tools

What is BloodHound? How defenders use it to find Active Directory attack paths

BloodHound is a free tool that draws a map of who can reach whom inside a company’s Windows user directory, so you can see, and cut, the routes an attacker would use to become an administrator.

Ports and protocols

Port 6379 (Redis): what it is, how it is attacked and how to secure it

Port 6379 is where Redis, a very fast in-memory data store used for caching and sessions, listens, and it should only ever be reachable by your own application servers, never by the internet.

Ports and protocols

HTTP/2 and Apache mod_http2: what they are and the CVE-2026-119618 flaw

HTTP/2 is the faster, newer way browsers talk to web servers, and a critical bug in the Apache web server’s HTTP/2 module means any server running an affected version with HTTP/2 switched on needs updating now.

Hacking techniques

How SAML authentication bypass works, and why MFA can be skipped

SAML is the system that lets you sign in once to many services, and a SAML authentication bypass is any flaw that lets someone get in without the identity checks, including multi-factor authentication, that the system was meant to enforce.

Credentials and exposure

API key exposure: why secrets in environment variables get stolen and how to rotate them

API key exposure is what happens when an API key, a password that lets software use a paid service, leaks, and anyone holding it can spend your money and read your data until you cancel it at the provider.

Security tools

What is a honeypot? How decoy systems give early warning of an attacker

A honeypot is a fake system, file or login that no real employee has any reason to touch, so anything that touches it is worth a look.

Compliance

Do I need a penetration test for Cyber Essentials Plus?

No, Cyber Essentials Plus does not require a penetration test, because its technical audit uses scans and sampled device checks instead, but the two answer different questions and many businesses end up wanting both.

Compliance

Cyber Essentials 14-day patch rule explained

Under Cyber Essentials, any software update that fixes a serious security flaw must be installed within 14 days of its release, on every device and cloud service in your scope.

Ports and protocols

Is RDP open to the internet dangerous? Port 3389 explained for business owners

Yes: leaving Remote Desktop reachable from the internet gives anyone in the world a login screen to your Windows machines, and government agencies in the UK and US both tell you to close it or put it behind a VPN with multi-factor authentication.

Security tools

How to check which ports are open on your business network

An open port is a door on a computer that listens for connections, and checking which doors your business has open to the internet means comparing three lists: what your firewall allows, what you think you run, and what the outside world can actually reach.

Security tools

What are canary tokens? Free tripwires that warn you when someone is snooping

A canary token is a fake file, link or password that nobody in your business has a reason to touch, set up so that you get an alert the moment someone does.