Glossary: short forms and cyber words

Seen a short form like MFA or XP and wondered what it means? Here’s every one used on this site, explained in plain English.

Short forms (acronyms)

2FA / 2SV Two-factor authentication / two-step verification: Other names for MFA: a second check when you log in, as well as your password. See MFA.
AI Artificial intelligence: Computer programs that learn from huge numbers of examples, so they can chat, answer questions, or make pictures, videos and voices. AI can sound very sure of itself and still be wrong, and it can be used to make fakes.
CEOP Child Exploitation and Online Protection: Part of the National Crime Agency (the UK police). If an adult is talking to you online in a way that makes you feel worried or uncomfortable, you can report it to CEOP.
CTF Capture the flag: A cyber security competition where you solve puzzles and safe, legal hacking challenges to find hidden answers called “flags”. A great way to practise cyber skills.
CV Curriculum vitae: A short document about you, listing your education, skills and experience, that you send when you apply for a job.
DDoS Distributed denial of service: An attack that floods a website, server or gamer’s connection with so much traffic that it stops working. “Booter” sites sell these attacks. Using one is a crime.
DM Direct message: A private message sent to one person (or a small group) inside an app or game, instead of posting it publicly.
EYFS Early Years Foundation Stage: For teachers and parents: the stage of learning in England from birth to the end of Reception.
GCSE General Certificate of Secondary Education: The qualifications most students in England, Wales and Northern Ireland take at about age 16.
GDPR General Data Protection Regulation: The data protection law. In the UK it’s called the UK GDPR, and it works together with the Data Protection Act 2018. It gives you rights over information about you, like asking to see it or asking for it to be deleted.
GG Good game: Something players type at the end of a game to be friendly, whether they won or lost.
GRC Governance, risk and compliance: A cyber security job area: helping organisations understand their risks, set good rules and check they meet standards and laws.
HR Human resources: The team at a workplace that looks after staff: hiring, contracts, pay details and wellbeing.
HTTPS Hypertext Transfer Protocol Secure: The “s” means the connection between your device and a website is scrambled (encrypted), so others can’t read it on the way. You’ll often see a padlock. It doesn’t prove the website is honest: trick websites can use HTTPS too.
ICO Information Commissioner’s Office: The UK’s data protection regulator. You can complain to the ICO if an organisation doesn’t look after your personal information properly.
ID Identification or identity: Proof of who you are, like a passport or driving licence. Keep photos of your ID private, because criminals can use them to pretend to be you.
IP address Internet Protocol address: A number that tells the internet where to send information, a bit like a postal address for your internet connection.
ISO 27001 International Organization for Standardization, standard 27001: A worldwide standard that shows an organisation manages information security properly. Auditors check organisations against it.
KS1 to KS4 Key Stages 1 to 4: For teachers and parents: how schools in England group year groups. KS1 is Years 1 to 2, KS2 is Years 3 to 6, KS3 is Years 7 to 9 and KS4 is Years 10 to 11.
MFA Multi-factor authentication: Logging in with more than one check: something you know (a password), something you have (a phone or security key) or something you are (a fingerprint or your face). Even if someone steals your password, they can’t get in without the second check. Also called two-step verification, 2SV or 2FA.
MFA fatigue Multi-factor authentication fatigue: A trick where someone who has your password sends login approval requests again and again, hoping you’ll tap “Approve” just to make them stop. If you didn’t try to log in, don’t approve it: change your password.
NCSC National Cyber Security Centre: The UK’s cyber security experts, part of GCHQ. They give free advice, like using three random words for passwords.
NI number National Insurance number: Your own personal number for tax and National Insurance in the UK. You give it to your employer once you start a real job. Keep it private otherwise.
PIN Personal identification number: A short secret number, like the code to unlock a phone or use a bank card. Never share it.
QR code Quick response code: A square pattern your phone camera can read to open a website. Scammers stick fake QR codes on posters and parking meters, which is called quishing.
SMS Short Message Service: An ordinary text message on a phone. Phishing by text is called smishing.
SOC Security operations centre: A team that watches an organisation’s computers day and night, spotting attacks and responding to them.
UKCIS UK Council for Internet Safety: For teachers: a group of government, charities and industry that publishes online safety guidance for schools, such as Education for a Connected World.
USB Universal Serial Bus: A type of plug and memory stick for connecting things to computers. Never plug in a USB stick you’ve found: it could carry malware.
VIP Very important person: Someone given special treatment. Scammers promise “VIP” rewards or tasks to make a trick feel exclusive and exciting.
WCAG Web Content Accessibility Guidelines: Rules for making websites usable by everyone, including people who use screen readers or a keyboard instead of a mouse.
XP Experience points: Points you earn in this game (and many video games) for catching Sly’s tricks and finishing missions. Collect enough XP to rank up, from Cyber Cadet upwards.

Cyber words

Anti-malware: Security software that spots and removes malware. Most computers have it built in. Keep real-time protection on, let it update, and let it scan regularly: a daily quick scan is a good habit. At work it’s often called endpoint protection.
Authenticator app: An app that makes a new login code every 30 seconds or so, for MFA. Safer than codes sent by text message.
Browser warning: A full-page warning from your browser itself, saying a website may be dangerous or that it can’t prove the site is real. It’s real protection: choose “Back to safety”.
Catfishing: Pretending to be someone else online, with fake photos and a fake name, to trick people into trusting you.
Computer Misuse Act: The UK law against hacking. It’s a crime to get into a computer, device or account without permission, or to mess with one. Knowing someone’s password isn’t permission, and it applies to children too.
Cookies: Small files websites save in your browser to remember things, like what’s in a shopping basket. Some cookies track what you do across websites. This site doesn’t use cookies.
Data breach: When information an organisation holds, like emails and passwords, gets stolen or leaked. If you’re told your details were in a breach, change that password.
Deepfake: A fake video, photo or voice made with AI so it looks or sounds like a real person saying or doing something they never did.
Digital footprint: Everything about you that’s online: posts, photos, comments, likes and accounts. It can stay online for a very long time.
Malware: Short for “malicious software”: harmful programs like viruses, spyware and ransomware (which locks your files until you pay).
Money mule: Someone who lets criminals pass stolen money through their bank account, often for an “easy cash” offer. It’s a crime, even if you didn’t steal the money yourself.
Passkey: A newer way to log in without a password, using your phone’s fingerprint, face or PIN. It can’t be phished.
Passphrase: A password made of several random words, like three random words. Long, easy to remember and hard to guess.
Password manager: A safe app that creates and remembers a different strong password for every account, so you only need to remember one.
Phishing: Trick emails or messages that pretend to be from someone you trust, to get you to click a link, log in on a fake page or share details.
Private window: A browser window (also called incognito) that doesn’t keep your history, cookies or logins on that device after you close it. It doesn’t hide what you do from the school, the Wi-Fi owner or websites.
Quishing: Phishing with a QR code. The code takes you to a fake website instead of the real one.
Scam: A trick to get your money, details or account. Warning signs: hurry, secrecy, too good to be true, or asking for codes or payment.
Scareware: Fake alerts inside a web page, like “Your device has 3 viruses! Call now!”, made to scare you into clicking, paying or calling. Close the page.
Shoulder surfing: Watching someone’s screen or keypad, often over their shoulder, to steal a PIN, password or code. Cover the keypad and tilt your screen away.
Signing out: Closing your account on a device so the next person can’t use it. On shared computers, sign out of everything, then close the browser. Closing a tab isn’t enough.
Smishing: Phishing by text message (SMS). Forward scam texts to 7726.
Social engineering: Tricking people, rather than computers, into giving away information or access, for example by pretending to be IT support on the phone.
Update: A new version of an app or device’s software. Updates fix security holes, so install them soon.

Looking for coding words like loop, algorithm or debug? See coding in plain English.