Last updated: 22 September 2026.

How software is described

Malware

The umbrella term for software written to do something you would not agree to: steal data, encrypt your files for ransom, mine cryptocurrency, show advertising, or open a door for someone else. “Virus” is one old subcategory that has become a generic word for all of it.

Signature

A pattern — often simply a cryptographic hash — that identifies a known piece of malware exactly. Fast and essentially certain, but it can only recognise something already catalogued.

Heuristics

Rules of thumb for spotting something suspicious without a signature: unusual packing, functions associated with hiding, structural resemblance to known families. Catches new variants; produces false positives. Modern products usually implement this with machine-learning classifiers.

Behavioural detection

Watching what a program does once it is running, rather than what it looks like, and stopping it when it starts acting like malware — for example rewriting every document in your user folder. This is what usually stops ransomware in time.

Sandbox

An isolated environment where a suspicious file can be run and observed without being able to affect the real system.

Zero-day

A vulnerability being exploited before a patch exists — the vendor has had zero days to fix it. Used loosely in marketing to mean any threat not yet in a signature database. Worth noticing which sense a page is using.

False positive

Something safe wrongly flagged as malicious. The unavoidable cost of the detection methods that catch unknown threats, and the reason independent laboratories report a false-positive count alongside protection scores. A product that never produced one would be catching too little.

Real-time protection (on-access scanning)

The engine checking files as they are opened, written or executed, rather than only during a scheduled scan. This is the part that actually protects you; a scheduled scan mostly finds things afterwards.

Quarantine

A locked store where a detected file is moved rather than deleted, so it can be restored if the detection turns out to be wrong.

How attacks reach you

Phishing

A message impersonating someone you trust in order to get a credential, a payment or a click. “Spear phishing” is a version aimed at you specifically, using real details about you. See the worked example in our main guide.

Ransomware

Malware that encrypts your files and demands payment for the key. The defence that always works is a backup that the ransomware cannot reach — a drive you unplug, or versioned cloud storage.

Malvertising

Malicious code delivered through an advertising network, so it can appear on a legitimate site the site's owner never intended to host it on.

Drive-by download

An infection that requires nothing but visiting a page, exploiting a flaw in the browser or a plug-in. Rare against a fully updated browser, which is the point of automatic updates.

Potentially unwanted program (PUP)

Software that is not quite malware but that you did not really want: toolbars, “optimisers”, bundled extras that arrive with a free download. Security products flag these separately because whether they are unwanted is partly a matter of opinion.

Social engineering

Manipulating a person rather than exploiting a machine. Urgency, authority and fear are the standard levers. No software fully protects against it, which is why the habit of never acting inside an unexpected message matters so much.

Privacy and network terms

VPN

An encrypted tunnel from your device to a server run by the VPN operator. It hides which sites you visit from the network you are on, and hides your network address from the site. It does not make you anonymous and it does not remove the need for trust — it moves that trust to the VPN operator. See the diagram in our main guide.

Fingerprinting

Identifying a browser by the combination of its characteristics — fonts, screen size, graphics behaviour, timezone — rather than by a cookie. Deleting cookies does not defeat it; a VPN does not defeat it.

Telemetry

Data a product sends back to its maker about how it is being used. Often genuinely useful for improving detection, and also the mechanism through which browsing data has been commercialised in the past. Usually switchable in settings, and usually on by default.

End-to-end encryption

Encryption where only the two ends hold the keys, so the service carrying the message cannot read it. Distinct from “encrypted in transit”, which merely means the provider can read it but eavesdroppers cannot.

Two-factor authentication (2FA)

Requiring a second proof besides the password — an app code, a hardware key. The single most effective thing most people can do for their accounts, and it is free. An authenticator app or hardware key is stronger than a code sent by SMS.

Breach monitoring

A service that tells you when your address appears in a published data breach. Useful as a prompt to change a password; it cannot undo the breach, and free services offer the same core function.

Commercial terms worth recognising

Freemium

A genuinely usable free tier that funds itself by prompting you to upgrade. Distinct from a trial, which stops working.

Introductory pricing and auto-renewal

Security subscriptions commonly advertise a low first-year price and renew automatically at a higher one. Note the renewal date and the renewal rate when you buy, not a year later.

Affiliate link

A link that identifies the referring site so it can be paid a commission on a resulting sale. The links on this site marked “partner link” are affiliate links; they never change your price. See our editorial policy.