Security terms, in plain English.

An email scam where a criminal poses as someone the victim trusts, such as the CEO, a supplier or the finance lead, to get a payment sent or data handed over.

Watching sign-ins and account activity for signs that someone other than the real person is using an account, and acting fast when they are.

Software on laptops and servers that watches how programs behave, not just whether a file is known to be bad, and can stop an attack on the machine.

EDR plus an outside team that watches the alerts for you and responds to them.

Any account that can reach company data without a person signing in: service accounts, API keys, connected apps and, increasingly, AI agents.

AI tools that people use at work without IT knowing, such as pasting client data into a public chatbot or connecting an AI app to company files.

Apps, accounts and services that people use for work without IT approving them, such as a free file-sharing site, a personal cloud drive or an app connected to their work mailbox.

Continuously checking the settings, permissions and connected apps of SaaS platforms such as Microsoft 365 and Google Workspace, so risky misconfigurations are found and fixed before an attacker uses them.

A risk that comes from someone who already has legitimate access, such as an employee, contractor or partner, misusing it on purpose or by mistake.

Two sign-ins to the same account from places too far apart for one person to have travelled between them in the time.

An attack where someone who already has the password sends prompt after prompt to the user's phone until they tap approve just to make it stop.

Software that does work on its own with real access, such as a Copilot or Gemini agent that reads mail, files or the directory and acts on them.

The permission a user or admin gives an app to reach company data, such as reading every mailbox or every file.

A phishing trick that sits between the user and the real sign-in page and captures the session after MFA succeeds.

When an attacker gets control of a real user's account, usually email, and uses it as if they were that person.

Trying a few common passwords against many accounts at once, slowly enough to avoid lockouts.

A domain registered to look like a real one, such as a swapped letter or an added word, used to send convincing fake email.

Malware that locks a business out of its files or systems, usually by encrypting them, and demands payment to unlock them.

A security operations setup where AI does the first pass of the work, triaging alerts, joining related signals and adding context, while people keep the decisions.

Running many separate security tools, each with its own console, alerts and blind spots.

When an attacker copies the session token a user gets after signing in, then uses it to act as that user without a password or MFA.

Taking over a session someone else already started, so the attacker is treated as the signed-in user.

Microsoft Entra rules that decide whether a sign-in is allowed, based on who the user is, their device, location and risk.

MFA that will not work on a fake website, such as passkeys and FIDO2 security keys, so a relayed login fails.

A scam where the attacker gets a person to type a sign-in code on the real Microsoft page, which signs the attacker in as that person, MFA included.