Glossary

85 terms across post-quantum cryptography, security, identity, and standards.

A

Account takeover: An attack in which an adversary gains unauthorized control of a legitimate user's account, typically through stolen credentials, phishing, or session hijacking.Why it matters: It is a common precursor to fraud, data theft, and lateral movement, and strong MFA is the key defense.See also: credential stuffing, phishing, session token, mfa, aitm
ACVP: The Automated Cryptographic Validation Protocol, a NIST system for automatically testing that cryptographic algorithm implementations conform to their specifications.Why it matters: It underpins validation of correct algorithm implementation, a prerequisite for FIPS 140-3 module validation.See also: fips 140 3, nist, fips
Adversary-in-the-middle (AiTM): An attack in which a malicious proxy sits between a user and a legitimate site, relaying traffic in real time to capture passwords, one-time codes, and session tokens.Why it matters: It bypasses many MFA methods, which is why phishing-resistant MFA and session protections are important.See also: phishing resistant mfa, phishing, session token, account takeover
AES: The Advanced Encryption Standard, a symmetric block cipher standardized by NIST that encrypts data using shared secret keys of 128, 192, or 256 bits.Why it matters: AES remains quantum-safe when used with 256-bit keys, since Grover's algorithm only halves its effective strength.See also: symmetric vs asymmetric cryptography, grovers algorithm, sha 2

B

Business email compromise (BEC): A fraud in which an attacker impersonates an executive, vendor, or partner over email to trick an organization into transferring funds or sensitive data.Why it matters: BEC causes some of the largest financial losses of any cyber-crime category, often without any malware.See also: phishing, spear phishing, social engineering, dmarc, account takeover

C

CBOM: A Cryptographic Bill of Materials, a structured, machine-readable inventory of the cryptographic assets used by a system or application, often expressed as an extension of a software bill of materials (SBOM).Why it matters: It makes cryptographic dependencies discoverable and manageable, supporting crypto-agility and post-quantum migration.See also: cryptographic inventory, crypto agility, post quantum cryptography
Certificate: A digitally signed electronic document (typically X.509) that binds a public key to an identity such as a domain name or organization, issued by a trusted certificate authority.Why it matters: Certificates depend on signature algorithms that must move to post-quantum schemes, and inventorying them is key to migration.See also: pki, digital signature, tls, cryptographic inventory
CISA: The U.S. Cybersecurity and Infrastructure Security Agency, which issues guidance and coordinates national efforts on cybersecurity, including quantum-readiness.Why it matters: Its guidance helps organizations prioritize and plan their post-quantum migration and broader security posture.See also: nist, post quantum cryptography, cryptographic inventory
Code-based cryptography: Cryptography whose security relies on the difficulty of decoding general error-correcting codes, exemplified by the McEliece cryptosystem and the Classic McEliece KEM.Why it matters: It has withstood cryptanalysis since the 1970s, offering a diverse, non-lattice alternative for quantum-safe key exchange.See also: key encapsulation mechanism, post quantum cryptography, lattice based cryptography
Credential stuffing: An automated attack that tries username-password pairs stolen from one breach against many other services, exploiting password reuse.Why it matters: It makes reused passwords a liability everywhere, which MFA and password managers help mitigate.See also: account takeover, password manager, mfa, passphrase
Crypto-agility: The ability of systems to switch cryptographic algorithms, key sizes, and parameters quickly and with minimal disruption, ideally without rearchitecting applications.Why it matters: It is essential for migrating to post-quantum algorithms and for responding rapidly if any algorithm is later broken.See also: post quantum cryptography, cryptographic inventory, cbom, hybrid key exchange
Cryptographic inventory: A catalogue of where and how an organization uses cryptography — algorithms, key sizes, certificates, protocols, and the systems and data they protect.Why it matters: You cannot migrate what you cannot see, so an inventory is the first step of any post-quantum readiness program.See also: cbom, crypto agility, post quantum cryptography, certificate
Cryptographic key: A secret or public value that controls a cryptographic operation such as encryption, decryption, or signing. Key length is a major factor in security strength.Why it matters: Post-quantum algorithms often use larger keys, which affects storage, bandwidth, and performance during migration.See also: symmetric vs asymmetric cryptography, key exchange, aes

D

Digital signature: A cryptographic value created with a private key that lets anyone verify, using the matching public key, that a message is authentic and unaltered.Why it matters: Signatures authenticate software updates, certificates, and documents, so they must migrate to quantum-safe algorithms too.See also: ml dsa, slh dsa, certificate, pki, symmetric vs asymmetric cryptography
DKIM: DomainKeys Identified Mail, an email authentication method that adds a cryptographic signature to messages so receivers can verify they were sent by the domain and not altered.Why it matters: It provides tamper-evidence and sender validation that, with SPF and DMARC, curbs email spoofing.See also: spf, dmarc, digital signature, phishing
DMARC: Domain-based Message Authentication, Reporting and Conformance, a policy layer that tells receivers how to handle email failing SPF or DKIM and provides reporting on abuse.Why it matters: A strict DMARC policy stops attackers from spoofing your domain, directly reducing phishing and BEC risk.See also: spf, dkim, bec, phishing

E

ECDH: Elliptic Curve Diffie-Hellman, a key-exchange method using elliptic-curve mathematics to establish a shared secret with smaller keys than classical Diffie-Hellman.Why it matters: It is broken by Shor's algorithm, so it is commonly paired with a post-quantum KEM in hybrid key exchange.See also: key exchange, hybrid key exchange, ecdsa, shors algorithm
ECDSA: Elliptic Curve Digital Signature Algorithm, a widely deployed signature scheme based on elliptic-curve cryptography, offering strong security with compact keys.Why it matters: Like RSA, it is vulnerable to Shor's algorithm and must migrate to post-quantum signatures such as ML-DSA.See also: digital signature, ecdh, rsa, ml dsa, shors algorithm
Encryption at rest: The protection of stored data — on disks, databases, or backups — by encrypting it so it is unreadable without the proper key.Why it matters: It defends against theft of physical media or storage, and its long-lived data is a harvest-now-decrypt-later concern.See also: encryption in transit, aes, harvest now decrypt later
Encryption in transit: The protection of data while it moves across networks by encrypting the connection, most commonly with TLS.Why it matters: It prevents eavesdropping and tampering, and its key exchange is a prime target for post-quantum upgrades.See also: encryption at rest, tls, forward secrecy, harvest now decrypt later
Endpoint detection and response (EDR): Security software on endpoints that continuously monitors for malicious activity, alerts responders, and can isolate or remediate compromised devices.Why it matters: It detects and contains threats that slip past preventive controls, shortening attacker dwell time.See also: siem, mdm, zero trust
ETSI: The European Telecommunications Standards Institute, a European standards organization that produces specifications for telecommunications, including quantum-safe cryptography.Why it matters: Its work informs European and international approaches to post-quantum and cybersecurity standards.See also: iso iec, nist, post quantum cryptography

F

FIDO Alliance: An open industry association that develops and promotes authentication standards — FIDO2, WebAuthn, and passkeys — to reduce reliance on passwords.Why it matters: Its standards enable the phishing-resistant, passwordless authentication now available across major platforms.See also: fido2, webauthn, passkey, phishing resistant mfa
FIDO2: An open authentication standard from the FIDO Alliance and W3C comprising WebAuthn and CTAP, enabling passwordless and phishing-resistant login with public-key cryptography.Why it matters: It is the technical foundation for passkeys and security keys, the strongest widely available form of MFA.See also: webauthn, passkey, phishing resistant mfa, fido alliance
FIPS: Federal Information Processing Standards, publicly announced standards developed by NIST for use in U.S. government computer systems, including cryptographic algorithms and modules.Why it matters: FIPS publications define the official post-quantum algorithms (FIPS 203, 204, 205) that vendors implement.See also: nist, fips 140 3, fips 203, fips 204, fips 205
FIPS 140-3: The NIST standard specifying security requirements for cryptographic modules, used to validate that hardware and software implement approved cryptography correctly.Why it matters: Many regulated buyers require FIPS 140-3 validated modules, so post-quantum implementations will need it too.See also: fips, nist, acvp, crypto agility
FIPS 203: The NIST standard that specifies ML-KEM, the module-lattice key-encapsulation mechanism for post-quantum key establishment.Why it matters: It is the authoritative specification implementers follow to deploy quantum-safe key exchange.See also: ml kem, fips, nist, key encapsulation mechanism
FIPS 204: The NIST standard that specifies ML-DSA, the module-lattice digital signature algorithm for post-quantum signing.Why it matters: It defines the primary quantum-safe signature scheme for certificates, code signing, and documents.See also: ml dsa, fips, nist, digital signature
FIPS 205: The NIST standard that specifies SLH-DSA, the stateless hash-based digital signature algorithm for post-quantum signing.Why it matters: It provides a conservative, hash-based signature standard as an alternative to lattice schemes.See also: slh dsa, fips, nist, hash based signatures
FN-DSA / Falcon: FFT over NTRU-Lattice-Based Digital Signature Algorithm, a compact lattice signature scheme derived from Falcon that NIST selected for standardization as a draft FIPS 206.Why it matters: It produces small signatures useful where bandwidth or storage is constrained, complementing ML-DSA.See also: lattice based cryptography, digital signature, ml dsa, slh dsa
Forward secrecy: A property of a protocol in which the compromise of long-term keys does not expose past session keys, because ephemeral keys are used and discarded per session.Why it matters: It limits the damage of harvest-now-decrypt-later attacks by ensuring recorded sessions can't all be decrypted from one stolen key.See also: key exchange, harvest now decrypt later, tls

G

Grover's algorithm: A quantum search algorithm that finds an item in an unsorted set with roughly the square root of the classical effort, effectively halving the security strength of symmetric keys and hash functions.Why it matters: It means symmetric algorithms like AES stay safe by doubling key sizes (e.g. AES-256), rather than being broken outright like RSA.See also: quantum computer, aes, sha 2, symmetric vs asymmetric cryptography

H

Harvest-now, decrypt-later: An attack strategy in which an adversary records encrypted data today and stores it to decrypt once a capable quantum computer becomes available. Also called store-now-decrypt-later or retrospective decryption.Why it matters: Data with a long confidentiality lifetime is already at risk, which is why migration to post-quantum cryptography cannot wait for Q-Day.See also: q day, post quantum cryptography, forward secrecy, shors algorithm
Hash-based signatures: Digital signature schemes whose security depends solely on the collision or preimage resistance of a cryptographic hash function, such as SLH-DSA, LMS, and XMSS.Why it matters: They rest on decades-old, conservative assumptions, making them a trusted fallback if newer math-based schemes are ever weakened.See also: slh dsa, digital signature, sha 2, post quantum cryptography
Hybrid key exchange: A key-establishment approach that combines a classical algorithm (such as ECDH) with a post-quantum KEM (such as ML-KEM), so the shared secret stays safe if either component remains unbroken.Why it matters: It provides a low-risk migration path, retaining proven classical security while adding quantum resistance.See also: ml kem, ecdh, key encapsulation mechanism, crypto agility, tls

I

IETF: The Internet Engineering Task Force, the open standards body that develops and maintains core internet protocols such as TLS, HTTP, and email standards through RFCs.Why it matters: It standardizes how post-quantum algorithms are integrated into protocols like TLS and IKEv2.See also: tls, webauthn, hybrid key exchange, ietf
ISO/IEC: The joint technical committees of the International Organization for Standardization and the International Electrotechnical Commission that publish global standards, including for information security (e.g. ISO/IEC 27001) and cryptography.Why it matters: Its standards provide internationally recognized frameworks for security management and cryptographic algorithms.See also: etsi, nist, fips

J

Joiner-mover-leaver (JML): The identity lifecycle model covering when a person joins, changes roles within, or leaves an organization, and the access changes each stage requires.Why it matters: Mishandled leavers and role changes leave orphaned access that attackers exploit; automating JML closes those gaps.See also: scim, rbac, least privilege, account takeover

K

Key encapsulation mechanism (KEM): A public-key mechanism for securely establishing a shared secret key: the sender encapsulates a random secret to the recipient's public key, and the recipient decapsulates it with their private key.Why it matters: KEMs are the standard building block for post-quantum key establishment, with ML-KEM as the leading example.See also: ml kem, key exchange, hybrid key exchange, code based cryptography
Key exchange: A protocol by which two parties agree on a shared secret key over an insecure channel, for example Diffie-Hellman or ECDH, so they can then encrypt their communication.Why it matters: Classical key exchange is broken by Shor's algorithm, making it a top priority for post-quantum replacement.See also: ecdh, key encapsulation mechanism, hybrid key exchange, forward secrecy

L

Lattice-based cryptography: A family of cryptography whose security is based on the hardness of mathematical problems on high-dimensional lattices, such as Learning With Errors and Module-LWE.Why it matters: It underpins most of NIST's primary post-quantum standards (ML-KEM, ML-DSA, Falcon) and is believed resistant to quantum attack.See also: ml kem, ml dsa, fn dsa, post quantum cryptography
Learning With Errors (LWE): A mathematical problem, believed hard even for quantum computers, of recovering a secret from noisy linear equations. It is the foundation of much lattice-based cryptography.Why it matters: Its presumed quantum-hardness gives ML-KEM and ML-DSA their security guarantees.See also: lattice based cryptography, ml kem, ml dsa
Least privilege: The security principle that every user, process, and system should have only the minimum access needed to perform its function, and no more.Why it matters: It limits the blast radius of a compromised account or system, containing attacker movement.See also: rbac, pam, zero trust, jml

M

Malware: Malicious software — including viruses, worms, trojans, ransomware, and spyware — designed to damage, disrupt, or gain unauthorized access to systems and data.Why it matters: It is a primary payload of phishing and other attacks, making endpoint defenses like EDR essential.See also: ransomware, phishing, edr
ML-DSA: Module-Lattice-Based Digital Signature Algorithm, the NIST-standardized post-quantum signature scheme derived from CRYSTALS-Dilithium and specified in FIPS 204.Why it matters: It is NIST's primary recommendation for quantum-safe digital signatures, replacing schemes like RSA and ECDSA.See also: digital signature, lattice based cryptography, ml kem, slh dsa, fips 204
ML-KEM: Module-Lattice-Based Key-Encapsulation Mechanism, the NIST-standardized post-quantum KEM derived from CRYSTALS-Kyber and specified in FIPS 203. It is used to establish shared secret keys.Why it matters: It is the primary NIST standard for quantum-safe key exchange and the recommended replacement for classical key-establishment schemes.See also: key encapsulation mechanism, lattice based cryptography, hybrid key exchange, fips 203, ml dsa
Mobile device management (MDM): Software that lets an organization enforce security policies, configuration, and app controls on managed laptops and mobile devices, and remotely wipe lost ones.Why it matters: It ensures devices accessing corporate data meet security baselines, a key input to zero-trust decisions.See also: edr, zero trust, least privilege
Multi-factor authentication (MFA): Authentication that requires two or more independent factors — something you know, have, or are — to verify identity, rather than a password alone.Why it matters: It is one of the most effective controls against account takeover from stolen or guessed passwords.See also: 2fa, passkey, totp, phishing resistant mfa, webauthn

N

NIST: The U.S. National Institute of Standards and Technology, the agency that develops and publishes cryptographic standards, including the FIPS series and post-quantum algorithms.Why it matters: Its standards (ML-KEM, ML-DSA, SLH-DSA) define the algorithms most organizations will adopt for quantum safety.See also: fips, ml kem, ml dsa, nist sp 800 63b, post quantum cryptography
NIST SP 800-63B: The NIST Digital Identity Guidelines volume covering authentication and authenticator management, including requirements for passwords, MFA, and authenticator assurance levels.Why it matters: It shapes modern, evidence-based password and MFA policy, favoring length and phishing resistance over forced complexity.See also: mfa, passphrase, phishing resistant mfa, nist

O

OpenID Connect (OIDC): An identity layer built on top of the OAuth 2.0 authorization framework that lets applications verify a user's identity and obtain basic profile information.Why it matters: It is the modern standard for federated login and SSO in web and mobile applications.See also: sso, saml, session token, scim

P

Passkey: A passwordless credential based on FIDO2/WebAuthn public-key cryptography, where a private key stays on the user's device and unlocks with a biometric or PIN.Why it matters: Passkeys are phishing-resistant and eliminate reused or stolen passwords, making account takeover far harder.See also: fido2, webauthn, phishing resistant mfa, fido alliance, mfa
Passphrase: A long secret made of multiple words or a full sentence, chosen for length and memorability to provide more entropy than a short complex password.Why it matters: Length is the biggest driver of password strength, so passphrases resist guessing and brute-force attacks.See also: password manager, credential stuffing, nist sp 800 63b
Password manager: Software that generates, stores, and autofills strong, unique passwords in an encrypted vault protected by a master password or key.Why it matters: It eliminates password reuse and weak passwords, and its autofill can help resist look-alike phishing sites.See also: passphrase, credential stuffing, passkey, mfa
Phishing: A social-engineering attack that uses fraudulent messages, usually email, to trick people into revealing credentials, installing malware, or transferring money.Why it matters: It is among the most common initial-access techniques, making user awareness and phishing-resistant controls critical.See also: spear phishing, social engineering, bec, smishing, vishing, phishing resistant mfa
Phishing-resistant MFA: Multi-factor authentication that cannot be defeated by tricking a user into revealing credentials or codes, achieved through cryptographic binding to the legitimate site, as in FIDO2/WebAuthn and PKI smart cards.Why it matters: It defeats adversary-in-the-middle phishing kits that can steal passwords, TOTP codes, and session tokens.See also: fido2, webauthn, passkey, aitm, mfa
PKI: Public Key Infrastructure, the framework of certificate authorities, certificates, and policies that binds public keys to identities and enables trust in TLS, code signing, and email.Why it matters: Migrating PKI to quantum-safe algorithms is a large, foundational part of any post-quantum transition.See also: certificate, digital signature, tls, crypto agility
Post-quantum cryptography: Cryptographic algorithms designed to run on today's classical computers while remaining secure against attacks by both classical and future quantum computers. Also called quantum-resistant or quantum-safe cryptography.Why it matters: It is the practical path to protecting data and communications before large-scale quantum computers can break today's public-key cryptography.See also: quantum computer, ml kem, ml dsa, crypto agility, harvest now decrypt later
Pretexting: A social-engineering technique in which the attacker invents a believable scenario or false identity to gain a target's trust and extract information or access.Why it matters: It underlies many BEC and help-desk fraud schemes, defeating controls that rely on human judgment.See also: social engineering, bec, spear phishing, vishing
Privileged access management (PAM): Tools and processes for securing, controlling, and auditing accounts with elevated privileges, such as administrators, often using vaulting, just-in-time access, and session monitoring.Why it matters: Privileged accounts are prime targets, so tightly managing them prevents severe breaches and lateral movement.See also: least privilege, rbac, zero trust, account takeover

Q

Q-Day: A shorthand for the hypothetical future moment when a quantum computer becomes powerful enough to break widely deployed public-key cryptography such as RSA and ECC.Why it matters: Because migration takes years, organizations must prepare well before Q-Day rather than waiting for it to arrive.See also: quantum computer, shors algorithm, harvest now decrypt later, crypto agility
Quantum computer: A computer that uses quantum-mechanical effects such as superposition and entanglement to perform certain calculations that are intractable for classical machines. Qubits are its basic unit of information.Why it matters: A sufficiently large, error-corrected quantum computer could break the public-key cryptography that secures most of today's internet.See also: shors algorithm, grovers algorithm, q day, post quantum cryptography
Quantum key distribution (QKD): A method that uses quantum physics, rather than mathematics, to share encryption keys such that eavesdropping is detectable. It requires specialized hardware and dedicated links.Why it matters: It is distinct from post-quantum cryptography; agencies like NSA and NCSC currently favor PQC over QKD for most uses.See also: post quantum cryptography, key exchange

R

Ransomware: Malware that encrypts a victim's data or systems and demands payment for the decryption key, often combined with threats to leak stolen data.Why it matters: It can halt an entire business, so backups, MFA, and least privilege are crucial defenses.See also: malware, phishing, edr, least privilege
Role-based access control (RBAC): An authorization model that grants permissions to roles rather than individuals, so users receive access by being assigned to appropriate roles.Why it matters: It makes access consistent, auditable, and easier to align with least privilege as people change jobs.See also: least privilege, pam, jml, zero trust
RSA: A widely used public-key algorithm for encryption and digital signatures whose security relies on the difficulty of factoring large numbers.Why it matters: Shor's algorithm can factor efficiently on a quantum computer, so RSA must be replaced by post-quantum algorithms.See also: shors algorithm, ecdsa, digital signature, symmetric vs asymmetric cryptography

S

SAML: Security Assertion Markup Language, an XML-based standard for exchanging authentication and authorization assertions between an identity provider and service providers.Why it matters: It is a widely used foundation for enterprise SSO, enabling centralized identity and access control.See also: sso, oidc, scim, saml
SCIM: System for Cross-domain Identity Management, a standard for automatically provisioning and deprovisioning user accounts and attributes across applications.Why it matters: It automates the joiner-mover-leaver lifecycle, ensuring access is granted and revoked promptly.See also: jml, sso, rbac, oidc
Session token: A credential, such as a browser cookie, issued after login to keep a user authenticated without re-entering their password on every request.Why it matters: Stolen session tokens let attackers bypass MFA entirely, which is why token protection and short lifetimes matter.See also: aitm, account takeover, sso, oidc
SHA-2: A family of cryptographic hash functions (including SHA-256 and SHA-512) standardized by NIST that produce fixed-length fingerprints of data.Why it matters: SHA-2 stays secure against quantum attack at sufficient output sizes and underpins hash-based signatures.See also: hash based signatures, grovers algorithm, digital signature
Shor's algorithm: A quantum algorithm that can factor large integers and compute discrete logarithms in polynomial time. It directly undermines RSA, Diffie-Hellman, and elliptic-curve cryptography.Why it matters: It is the specific threat that makes today's public-key algorithms obsolete once large-scale quantum computers exist.See also: quantum computer, rsa, ecdh, ecdsa, post quantum cryptography
SIEM: Security Information and Event Management, a platform that aggregates and correlates logs and security events across an environment to detect, investigate, and report on threats.Why it matters: It gives security teams centralized visibility needed to spot and investigate incidents.See also: edr, zero trust, account takeover
Single sign-on (SSO): An authentication scheme that lets users access multiple applications with one set of credentials and a single login session, typically via SAML or OIDC.Why it matters: It centralizes authentication so MFA and access policy can be enforced consistently across many apps.See also: saml, oidc, mfa, scim, session token
SLH-DSA: Stateless Hash-Based Digital Signature Algorithm, the NIST-standardized signature scheme derived from SPHINCS+ and specified in FIPS 205. Its security rests only on the strength of hash functions.Why it matters: It offers a conservative, well-understood security basis as a backup to lattice-based signatures, at the cost of larger signatures.See also: hash based signatures, digital signature, ml dsa, fips 205
Smishing: SMS phishing — social engineering delivered via text message, often with a malicious link or a request to call a fraudulent number.Why it matters: Mobile users are more likely to trust and tap text links, making smishing an effective attack vector.See also: phishing, vishing, social engineering
Social engineering: The manipulation of people into breaking security practices or divulging confidential information, exploiting trust, authority, urgency, or fear rather than technical flaws.Why it matters: Most breaches involve a human element, so defenses must address people and process, not just technology.See also: phishing, pretexting, spear phishing, bec, vishing
Spear phishing: A targeted phishing attack tailored to a specific individual or organization, using researched personal or business details to appear convincing.Why it matters: Its personalization makes it far more effective than mass phishing, often targeting executives and finance staff.See also: phishing, social engineering, bec, pretexting
SPF: Sender Policy Framework, an email authentication method in which a domain publishes the mail servers authorized to send on its behalf, letting receivers reject unauthorized senders.Why it matters: Together with DKIM and DMARC it helps prevent attackers from spoofing your domain in phishing and BEC.See also: dkim, dmarc, phishing, bec
Symmetric vs asymmetric cryptography: Symmetric cryptography uses one shared secret key for both encryption and decryption; asymmetric (public-key) cryptography uses a public/private key pair, enabling key exchange and signatures.Why it matters: Quantum computers threaten asymmetric cryptography severely but only weaken symmetric cryptography modestly, shaping migration priorities.See also: aes, rsa, ecdh, key encapsulation mechanism, grovers algorithm

T

TLS: Transport Layer Security, the protocol that encrypts and authenticates most internet traffic, including HTTPS. It uses key exchange, certificates, and symmetric encryption to protect a session.Why it matters: TLS is a primary target for post-quantum upgrades, since its key exchange is vulnerable to harvest-now-decrypt-later attacks.See also: pki, certificate, key exchange, hybrid key exchange, forward secrecy
TOTP: Time-based One-Time Password, a six- to eight-digit code generated from a shared secret and the current time, typically shown in an authenticator app.Why it matters: It is a common second factor, but unlike passkeys it can be phished if a user is tricked into entering the code.See also: mfa, 2fa, phishing resistant mfa, aitm
Two-factor authentication (2FA): A form of multi-factor authentication that requires exactly two distinct factors, such as a password plus a one-time code or hardware key.Why it matters: It significantly raises the bar for attackers compared with single-factor password login.See also: mfa, totp, passkey, phishing resistant mfa

V

Vishing: Voice phishing — social engineering conducted by phone call, in which an attacker impersonates a trusted party to extract information or prompt harmful actions.Why it matters: It bypasses email defenses and is increasingly used to reset credentials or defeat help-desk verification.See also: phishing, smishing, social engineering, pretexting

W

WebAuthn: Web Authentication, a W3C standard API that lets websites register and authenticate users with public-key credentials stored on authenticators such as devices or security keys.Why it matters: It enables browsers and sites to support passkeys and phishing-resistant sign-in without passwords.See also: fido2, passkey, phishing resistant mfa, ietf

Z

Zero trust: A security model that assumes no user, device, or network is inherently trusted, and continuously verifies identity, device posture, and context before granting least-privilege access.Why it matters: It reduces reliance on network perimeters, limiting attacker movement after an initial compromise.See also: least privilege, mfa, mdm, pam, rbac