Phishing and Security Awareness Glossary

Preview

Use the glossary to align executives, managers, employees, and MSPs on the language of phishing prevention.

Business Email Compromise

A scam where an attacker impersonates a trusted business contact to redirect money, credentials, or sensitive data.

CEO Fraud

A BEC scenario where the attacker poses as an executive and pressures staff to make a payment or share confidential information.

Credential Harvesting

A phishing technique that sends users to a fake login page designed to steal usernames, passwords, and MFA codes.

Display Name Spoofing

Changing the visible sender name so a message appears to come from a colleague, vendor, or executive.

Domain Spoofing

Making an email look like it came from a trusted domain, often by abusing weak email authentication.

Email Authentication

Controls such as SPF, DKIM, and DMARC that help receiving mail systems verify whether a sender is legitimate.

Human Layer

The employees, workflows, and decisions attackers target when technical controls alone are not enough.

Impersonation

Pretending to be a person or company the recipient already trusts.

Malicious Attachment

A file designed to install malware, steal data, or trick the user into enabling dangerous actions.

MFA Fatigue

Repeated login approval prompts sent to a user until they approve one by mistake or out of frustration.

Phishing Simulation

A controlled training campaign that sends realistic but safe test messages to help employees practice detection and reporting.

Quishing

Phishing that uses QR codes to send users to malicious websites.

Reporting Button

An email add-in that lets employees send suspicious messages to the security team for review.

Smishing

Phishing delivered through SMS or messaging apps.

Spear Phishing

A targeted phishing message customized for a specific person, company, or role.

Threat Triage

The process of reviewing reported messages, deciding risk level, and taking containment action.

Typosquatting

Registering a lookalike domain that relies on small spelling differences from a legitimate brand.

Vishing

Voice phishing, usually by phone call or voicemail.

Whaling

Phishing that targets executives or high-value decision makers.

Zero Trust

A security model that verifies users, devices, and actions instead of assuming internal activity is safe.