About this report

Security terms like “attack” and “breach” are often used interchangeably. For clarity and precision, we have used the following definitions throughout this report:

• Attack
  A general term covering any deliberate action toward a system or data that is unauthorized. This may be as simple as attempting to access it without permission.
  
  
• Compromise
  A successful attack that results in a system’s defenses being rendered ineffective. This could involve data loss, downtime, other systems being affected or no detrimental effects at all. It could be malicious or accidental.
  
  
• Data breach
  An incident that results in the confirmed disclosure—not just potential exposure—of data to an unauthorized party.
  
  
• Exploit
  A definition, often in the form of a script or code, of a method to successfully leverage one or more vulnerabilities to access a system without proper authorization.
  
  
• Incident
  This covers any form of security event, malicious or not, successful or not. This could be anything from a failed authentication attempt to a successful compromise and data breach. It includes non-malicious events such as the loss of a device.
  
  
• Risk
  A measure of the likelihood of a threat, an organization’s vulnerability to said event and the scale of the potential damage.
  
  
• Threat
  Any danger that could impact the security of systems or privacy of data. This can apply to a technique, such as phishing, or an actor, such as an organized criminal group.
  
  
• Vulnerability
  A weakness that could be exploited. It may be known or unknown— to the manufacturer, developer, owner or the world.