IT and Cybersecurity Terms Every Small Business Owner Should Know

Attack Surface

The total set of points across your technology environment where an attacker could attempt to gain unauthorized access including devices, email accounts, cloud services, network connections, and public-facing systems. The larger and less monitored your attack surface, the greater your exposure to cyberattacks.

Attack Surface Scanning (External)

Continuous scanning of your publicly visible technology infrastructure, websites, IP addresses, and internet-facing systems to identify what attackers can discover about your business from the outside. External attack surface scanning reveals vulnerabilities before attackers have an opportunity to exploit them.

Backup

The process of creating and storing copies of your business data, files, email, databases, and system configurations so it can be restored if the original is lost, encrypted by ransomware, or accidentally deleted. Effective backup includes scheduled testing to confirm that data is recoverable when needed.

Business Continuity & Disaster Recovery (BCDR)

A combined strategy for keeping business operations running during a major disruption, such as a ransomware attack, hardware failure, or natural disaster, and restoring normal operations as quickly as possible. BCDR typically involves both local and cloud-based backup systems with a documented, tested recovery plan.

Business Email Compromise (BEC)

A cyberattack in which an attacker impersonates a trusted executive, vendor, or colleague via email to trick an employee into transferring money, sharing credentials, or taking other harmful actions. BEC attacks frequently bypass spam filters because they contain no malicious links or attachments, making email security and training critical defenses.

CIS Controls

A prioritized set of cybersecurity best practices developed by the Center for Internet Security, organized into three implementation groups by organizational size and resource level. CIS Controls Implementation Group 1 covers the foundational security measures every organization should have including device inventory, access controls, email security, and patch management.

Compliance (IT Compliance)

The state of meeting the security and privacy requirements established by a regulatory framework, industry standard, or government regulation such as HIPAA, PCI DSS, or NIST. IT compliance requires documented controls, regular risk assessments, access management, audit trails, and continuous evidence that those controls are actively enforced.

Conditional Access

A security policy that controls access to cloud applications and systems based on specific conditions such as user identity, device health, location, or sign-in risk level. Conditional access enforces multi-factor authentication and blocks risky login attempts automatically and is a core security control in your email platform environments.

Credential Exposure

The condition of having usernames, passwords, or other authentication credentials accessible to unauthorized parties typically because they were leaked in a data breach and are circulating on dark web forums or marketplaces. Exposed credentials are a primary entry point for cyberattacks targeting businesses of all sizes.

Cyber Insurance

A business insurance policy that provides financial protection against losses resulting from a cyber incident including ransomware recovery, breach notification costs, legal fees, business interruption losses, and regulatory fines. Most carriers require documented evidence of active security controls including MFA, EDR, backup, and vulnerability scanning before issuing or renewing a policy.

Cyber Risk Score

A quantifiable measure of your organization's current cybersecurity exposure, calculated based on factors including unpatched software, weak access controls, email security gaps, device compliance status, and identity vulnerabilities. A continuously tracked risk score shows whether your security posture is improving or deteriorating over time.

Cybersecurity Posture

The overall security state of your organization's technology environment encompassing devices, identities, cloud services, email, network infrastructure, and policies. A strong cybersecurity posture means threats are monitored continuously, vulnerabilities are remediated proactively, and security controls are consistently enforced rather than relying on reactive or manual processes.

Dark Web Monitoring

Continuous scanning of dark web forums, credential databases, and underground marketplaces for your organization's email addresses, passwords, and sensitive data. When leaked credentials are discovered, dark web monitoring alerts your security team so compromised accounts can be secured before an attacker uses them to access your systems.

Data Loss Prevention (DLP)

Technology that monitors and controls the movement of sensitive data within and outside your organization preventing confidential information such as patient records, financial data, or proprietary documents from being sent via email, uploaded to unauthorized cloud services, or transferred to removable storage devices without authorization.

DNS Filtering

A security control that blocks access to malicious websites and harmful content at the DNS level before a connection to the site is established. DNS filtering prevents employees from reaching phishing sites, malware-hosting domains, and inappropriate content, and can be enforced consistently across office networks and individual devices.

Email Encryption

A security control that encodes email message content so it can only be read by the intended recipient. Email encryption protects sensitive communications including patient records, legal matter information, and financial data from being intercepted or read while in transit between sender and recipient.

Email Security

A set of technologies and controls protecting an organization's email environment from phishing attacks, spam, business email compromise, malware attachments, and impersonation attempts. Effective email security filters threats before delivery, provides advanced threat protection for cloud email platforms, and monitors continuously for signs of account compromise.

Endpoint

Any device that connects to your organization's network or accesses business data including laptops, desktop computers, smartphones, tablets, and servers. Every endpoint is a potential entry point for a cyberattack, making continuous endpoint monitoring and protection a foundational requirement of any cybersecurity program.

Endpoint Detection & Response (EDR)

A cybersecurity technology that continuously monitors every device in your organization for signs of malware, suspicious behavior, and active attacks. Unlike traditional antivirus, EDR identifies threats that have never been seen before using behavioral AI analysis and can automatically isolate an affected device before an attack spreads to other systems.

Exposure Management

The continuous process of discovering, prioritizing, and reducing risk exposure across all digital assets including devices, cloud services, credentials, and public-facing systems. Exposure management provides a comprehensive, always-current view of what attackers can find and exploit, going beyond periodic vulnerability scans to ongoing risk reduction.

Extended Detection & Response (XDR)

An advanced security platform that extends threat detection beyond individual endpoints to cover email, cloud applications, identity, and network infrastructure. XDR correlates data across multiple security layers to detect sophisticated, multi-stage attacks that tools monitoring only one layer would miss providing deeper visibility across the full attack surface.

External Vulnerability Scanning

Automated scanning of your organization's publicly accessible technology infrastructure, internet-facing servers, firewalls, and web properties to identify security weaknesses attackers could exploit. External scanning reveals the same vulnerabilities an attacker would discover when researching your organization from the outside.

Full-Disk Encryption

A security control that encrypts all data stored on a device's hard drive so it cannot be accessed without the correct authentication credentials. Full-disk encryption protects sensitive information if a laptop or workstation is lost or stolen, rendering stored data unreadable even if the drive is physically removed from the device.

Governance, Risk & Compliance (GRC)

An integrated approach to managing organizational policies, cybersecurity risk, and regulatory compliance requirements in one structured framework. GRC platforms track compliance posture against regulatory standards, conduct formal risk assessments, manage third-party vendor risk, generate audit documentation, and enforce security policies replacing manual compliance processes with continuous automated management.

HIPAA (Health Insurance Portability and Accountability Act)

A US federal law establishing national standards for protecting sensitive patient health information known as protected health information or PHI. HIPAA requires covered entities and business associates to implement administrative, physical, and technical safeguards including access controls, audit logs, encryption, breach notification procedures, and a documented security risk assessment.

Identity Threat Detection & Response (ITDR)

A security capability focused on detecting and responding to threats targeting user identities, including compromised accounts, impossible travel sign-ins, privilege escalation attempts, and anomalous access patterns. ITDR continuously monitors identity and access activity across cloud platforms and responds automatically when account behavior indicates potential unauthorized access.

Internal Vulnerability Scanning

Automated scanning of your organization's internal network, servers, workstations, network devices, and applications to identify security weaknesses inside your environment. Internal scanning reveals unpatched systems, misconfigured devices, and exploitable software that an attacker who gains initial network access could use to move deeper into your systems.

Log Aggregation

The process of collecting, centralizing, and storing system and security event logs from across an organization's technology environment including cloud services, firewalls, endpoints, and directory services. Centralized log aggregation enables threat detection, compliance reporting, and provides the audit trail required by frameworks such as HIPAA and PCI DSS.

Managed Detection & Response (MDR)

A cybersecurity service providing 24/7 threat monitoring, detection, and incident response delivered by an external security operations team. MDR combines technology with human security analysts who investigate alerts, confirm threats, and respond to active incidents, giving small businesses around-the-clock security operations without building or staffing an in-house SOC.

Managed IT

A traditional model of technology support in which an external provider manages IT infrastructure and support needs typically through a help desk, remote monitoring, and on-site service. Traditional managed IT is largely reactive, responding after problems occur. Sentinel iQ's Technology Intelligence Platform replaces reactive managed IT with continuous AI-powered monitoring and autonomous operations.

Mobile Device Management (MDM)

A platform for enrolling, configuring, securing, and managing smartphones and tablets across an organization. MDM enforces security policies on mobile devices including encryption, screen lock requirements, application management, and remote wipe capability, ensuring mobile devices meet the same security standards applied to workstations and laptops.

Multi-Factor Authentication (MFA)

A security control requiring users to verify their identity using two or more factors before accessing an account or system, typically something they know (a password) and something they have (a phone or authenticator app). MFA is the single most effective control for preventing unauthorized account access and stopping credential-based attacks.

Network Monitoring (NOC)

Continuous oversight of an organization's network infrastructure including firewalls, switches, access points, servers, and UPS systems to detect performance degradation, device failures, and configuration changes. NOC-level monitoring provides uptime visibility and operational continuity intelligence and is distinct from cybersecurity threat detection focused on malicious activity.

NIST Cybersecurity Framework (CSF)

A voluntary framework developed by the National Institute of Standards and Technology providing guidance for managing cybersecurity risk, organized around five functions: Identify, Protect, Detect, Respond, and Recover. The NIST CSF is widely used as a reference standard for building and assessing cybersecurity programs and is frequently cited in cyber insurance applications.

Patch Management

The process of regularly applying security updates and software patches to operating systems, applications, and firmware across all devices. Unpatched software is one of the most common cyberattack entry points. Effective patch management closes known vulnerabilities on a scheduled basis before attackers can exploit them.

Payment Card Industry Data Security Standard (PCI DSS)

A global security standard applying to any organization that accepts, processes, stores, or transmits payment card data. PCI DSS requires documented security controls including encryption, access controls, network segmentation, vulnerability scanning, and ongoing compliance monitoring with assessment requirements that vary based on annual transaction volume.

Phishing

A cyberattack in which an attacker impersonates a trusted entity such as a bank, vendor, or colleague via email, text, or phone to trick the recipient into revealing credentials, clicking a malicious link, or transferring funds. Phishing is the most common initial attack vector against small businesses and the leading cause of ransomware infections.

Privileged Access Management (PAM)

A security discipline controlling and monitoring access to accounts with elevated permissions such as local administrator accounts, system administrator credentials, and service accounts. PAM limits the number of users with privileged access, enforces just-in-time access provisioning, and maintains a full audit log of privileged activity to reduce breach risk and meet compliance requirements.

Ransomware

A type of malware that encrypts an organization's files and systems and demands payment, typically in cryptocurrency, in exchange for the decryption key. Ransomware attacks cost small businesses tens to hundreds of thousands of dollars in downtime, data loss, ransom, and recovery, making prevention through layered security controls essential.

Remote Monitoring & Management (RMM)

A technology platform enabling IT teams to remotely monitor, manage, and support devices, systems, and infrastructure across an organization. RMM platforms provide real-time device health data, enable automated scripting and patch deployment, and allow remote troubleshooting, all without requiring on-site visits to the locations where devices are physically located.

Risk Assessment

A formal evaluation identifying potential threats, existing vulnerabilities, and the likely impact of security incidents across an organization's technology environment. Cybersecurity risk assessments are required by HIPAA, NIST, and PCI DSS, and are increasingly required by cyber insurance carriers as a condition of issuing or renewing coverage.

Risk Intelligence

Continuous, real-time visibility into an organization's cybersecurity risk posture including active vulnerabilities, credential exposure, threat activity, and compliance gaps presented in a way that supports informed decision-making. Risk intelligence provides an always-current picture of security status rather than a point-in-time report generated once a year.

Security Awareness Training

An ongoing educational program teaching employees to recognize and respond to cybersecurity threats including phishing emails, social engineering, password hygiene, and safe data handling. Effective programs include regular phishing simulations that test employees and automatically enroll those who fall for simulated attacks in targeted, remedial training.

Security Information & Event Management (SIEM)

A platform that collects and correlates security event data from across an organization's technology environment including cloud services, endpoints, firewalls, and directory services to detect threats, generate alerts, and produce compliance reports. SIEM provides the centralized log management and audit trail required by frameworks including HIPAA and PCI DSS.

Security Operations Center (SOC)

A team of security professionals responsible for continuously monitoring an organization's technology environment for threats, investigating alerts, and responding to incidents. A managed SOC provides this service as an outsourced function, delivering 24/7 security operations coverage to organizations that cannot justify the cost of building an in-house security team.

Single Sign-On (SSO)

An authentication method allowing users to access multiple applications with a single set of credentials logging in once and gaining access to all connected platforms. SSO improves security by reducing password sprawl and enabling centralized access management, and simplifies the user experience by eliminating repeated login prompts across business applications.

Technology Intelligence Platform

A unified platform that continuously aggregates data from every layer of an organization's technology environment, devices, identities, email, cloud services, and network infrastructure uses AI to correlate signals and detect risks in real time, and takes automated action to remediate issues without requiring a support ticket or human intervention.

Threat Detection

The capability to identify indicators of malicious activity such as unusual login behavior, malware execution, data exfiltration attempts, or lateral movement through a network across an organization's technology environment. Modern threat detection uses behavioral AI analysis to identify attacks that have never been seen before, not just known attack signatures.

USB Device Control

A security control that restricts or monitors the use of USB storage devices including flash drives and external hard drives on organizational endpoints. USB device control prevents unauthorized data exfiltration, reduces the risk of malware introduction through physical media, and enforces data handling policies across the workforce consistently.

Vendor Risk Management

The process of assessing and continuously monitoring the cybersecurity posture and compliance status of third-party vendors and partners with access to your organization's data or systems. Vendor risk management is required by HIPAA, PCI DSS, and most enterprise compliance frameworks, and is increasingly expected by cyber insurance carriers at policy renewal.

Vulnerability

A weakness in software, hardware, or system configuration that an attacker could exploit to gain unauthorized access, disrupt operations, or compromise data. Vulnerabilities are typically addressed through security patches released by software vendors making timely patch management and regular vulnerability scanning critical to any security program.

Vulnerability Scanning

The automated process of scanning an organization's technology environment, both internally and externally, to identify known security vulnerabilities in software, operating systems, and configurations. Vulnerability scanning produces prioritized findings that guide remediation efforts and is required by PCI DSS and strongly recommended under HIPAA security guidance.

Zero Trust

A security framework based on the principle of 'never trust, always verify, requiring all users, devices, and systems to be continuously authenticated and authorized before accessing any resource, regardless of network location. Zero Trust assumes threats can originate from inside or outside the organization and eliminates implicit trust granted by network perimeter.