Quick answer: Cybersecurity is the practice of protecting digital systems, networks, accounts, services, and information from unauthorized access, disruption, manipulation, or destruction. It is not one product. Effective cybersecurity combines governance, people, processes, and technology to reduce risk, detect incidents, respond, and recover.
What cybersecurity protects
Cybersecurity applies to personal devices and accounts as well as business applications, cloud services, operational technology, and critical infrastructure. The desired outcomes are commonly described through confidentiality, integrity, and availability: information is disclosed only to authorized parties, remains accurate and trustworthy, and is accessible when needed. Authentication, accountability, privacy, and safety may also be essential depending on the system.
Information security is a broader term that can cover information in any form, including paper. Cybersecurity focuses on digital environments and the connected technologies that create, process, store, and transmit information.
Threat, vulnerability, exploit, and risk
- Threat: something capable of causing harm, such as a criminal group, malicious insider, software failure, or natural event.
- Vulnerability: a weakness that could be used or triggered, such as an unpatched service, excessive permission, or flawed process.
- Exploit: a method or code that takes advantage of a vulnerability.
- Risk: the potential impact and likelihood of harm in a specific context.
A vulnerability does not create the same risk everywhere. An internet-facing payroll server and an isolated test machine may share a flaw but have different exposure, data, and business impact. Prioritization should consider those differences.
The cybersecurity lifecycle
The NIST Cybersecurity Framework 2.0 organizes outcomes into six functions. Govern establishes strategy, roles, policy, and risk oversight. Identify inventories assets, dependencies, data, and risks. Protect applies safeguards such as access control, updates, training, and backups. Detect discovers anomalies and incidents. Respond contains and manages an event. Recover restores services and improves resilience.
These functions are not a one-time checklist or a strict sequence. Detection findings change priorities; exercises expose recovery gaps; and business changes require governance and inventory updates.
Common cybersecurity threats
Important threats include phishing and social engineering, credential theft, ransomware, software exploitation, supply-chain compromise, malicious or careless insiders, denial-of-service attacks, cloud misconfiguration, and loss or theft of devices. A program should be based on the organization’s assets and plausible scenarios, not only the threat receiving the most news coverage.
Practical security baseline
- Inventory important devices, applications, cloud services, accounts, data, owners, and external dependencies.
- Use unique passwords in a password manager and phishing-resistant MFA for high-value accounts.
- Patch supported operating systems, browsers, applications, firmware, and internet-facing services promptly.
- Apply least privilege, separate administrator accounts, and remove unused identities and access.
- Maintain offline or otherwise protected backups and regularly test restoration, not only backup creation.
- Centralize useful endpoint, identity, email, cloud, and network logs; define who reviews alerts and how quickly.
- Create an incident-response plan with contacts, decision authority, evidence handling, communications, and recovery priorities. Exercise it.
Cybersecurity is risk management
No control makes a system perfectly secure. Controls can also introduce cost, friction, privacy concerns, or new dependencies. A mature approach identifies critical outcomes, selects proportional safeguards, measures whether they work, and accepts or transfers remaining risk explicitly. Compliance can provide a useful minimum, but passing an audit does not prove that current attacks will be detected or that recovery will succeed.
What individuals should do after an incident
If an account or device may be compromised, contain the immediate problem without destroying evidence. Disconnect an actively infected device, use a clean device to change exposed passwords and revoke sessions, verify MFA and recovery methods, and contact the relevant bank or service through independently obtained details. Record what happened and when. Organizations should involve their incident-response and legal teams according to policy.
Source
Definitions and lifecycle structure are based on the NIST Cybersecurity Framework 2.0 and the NIST cybersecurity glossary.