Glossary
Phishing and training terms, in plain words.
Short definitions for the terms that come up when you run security awareness training. Link to any term with its anchor.
- Advanced Delivery (Microsoft 365)
- A Microsoft 365 Defender setting that lets approved third party phishing simulations reach inboxes without being blocked or rewritten, while normal filtering keeps protecting against real attacks. Setting up Advanced Delivery
- Allow list
- A list of senders, domains or links an email filter is told to let through. Phishing simulation tools need a narrow, documented exception rather than a broad allow list, so real threats aren't let in too.
- Business email compromise (BEC)
- A scam where criminals use a hacked or look-alike email account to trick staff into paying fake invoices, changing bank details or sending sensitive data. It usually relies on trust and timing rather than malware. BEC for small businesses
- CEO fraud
- A form of business email compromise where the scammer poses as a senior leader and asks an employee for an urgent payment, gift cards or confidential information. Gift card requests
- Click rate
- The share of people who clicked the link in a practice phishing email. It is only meaningful once automated link scanners are separated from real people. Why scanners inflate click rates
- Credential phishing
- Phishing aimed at stealing usernames and passwords, usually with a fake sign-in page that copies a real one such as Microsoft 365. Fake sign-in pages
- Cyber insurance
- Insurance that covers costs from cyber incidents such as ransomware, fraud and data breaches. Applications and renewals often ask whether staff are trained and phishing tested. Cyber insurance and training
- Deepfake
- Audio or video generated by AI to imitate a real person. In fraud it's most often a cloned voice of a manager or supplier asking for a payment by phone.
- Display name spoofing
- Setting an email's display name to someone you trust, such as your CEO, while the actual address behind it is a stranger's. Many phones show only the name.
- Look-alike domain
- A web or email domain registered to resemble a real one, using swapped letters, extra words or a different ending, such as invoice-notices.co instead of a supplier's real domain.
- Managed service provider (MSP)
- A company that runs IT for other businesses on an ongoing contract, often including security services such as training and phishing simulation. NetMinder for MSPs
- MFA fatigue
- An attack where someone with a stolen password sends repeated sign-in approval prompts, hoping the victim taps Approve to make them stop. Sign-in approval scams
- Multi-factor authentication (MFA)
- Signing in with something extra beyond a password, such as an app approval or a code. It blocks most password theft, as long as people don't approve prompts they didn't start.
- NFR licence
- Not for resale. A licence a vendor gives a partner to use a product internally, usually free, so they know it before selling it.
- Phishing
- A message that pretends to come from someone you trust so you'll click a link, open a file, share details or send money. It arrives by email, text, phone or chat. How to spot phishing
- Phishing simulation
- A safe practice phishing email sent to staff to see who clicks or reports it, followed by training for anyone who falls for it. What is a phishing simulation?
- PIPEDA
- Canada's federal private sector privacy law. It requires organizations to protect personal information with safeguards that include making employees aware of the importance of confidentiality. PIPEDA and training
- Pretexting
- Inventing a believable story, such as an IT audit or a supplier change, to get someone to share information or take an action they normally wouldn't.
- Quishing
- Phishing with a QR code instead of a link. The code is in an email, letter or poster and leads to a fake sign-in or payment page, often on a phone with fewer protections.
- Report rate
- The share of people who reported a practice phishing email to IT. A rising report rate is often a better sign of a healthy team than a falling click rate alone.
- Safe Links
- A Microsoft Defender for Office 365 feature that checks links in email when they're clicked. Its checks can register as clicks in phishing simulations unless they're filtered out.
- Security awareness training
- Ongoing training that teaches staff to recognize and report scams, protect passwords and handle data safely. Short, regular lessons tend to stick better than a long annual course.
- Smishing
- Phishing by text message. Short, urgent texts with a link or a request, often about deliveries, banks or a manager needing a favour. Scam texts
- Spear phishing
- Phishing aimed at a specific person or business, using real names, suppliers or events to make the message more believable.
- Vishing
- Phishing by phone. A caller poses as IT, a bank or a supplier and talks the victim into sharing codes, installing software or moving money. Phone scams
- White label
- A product sold under the reseller's brand. In security training, clients see their MSP's logo and name on emails, lessons and reports rather than the vendor's. Branding for MSPs
Become a founding partner.
We're onboarding our first MSP partners now. Bring two clients and we'll set them up with you.