Quick Answer
Cybersecurity is the practice of protecting computers, networks, devices and data from attack, damage and unauthorized access. NIST describes it as protecting information by preventing, detecting and responding to attacks. Its goal is to keep information confidential, accurate and available, using a mix of technology, processes and trained people.
Key Takeaways
- Cybersecurity protects systems and data so they stay confidential, intact and available, a goal known as the CIA triad.
- The FBI’s Internet Crime Complaint Center received 1,008,597 complaints in 2025, with reported losses of $20.877 billion.
- IBM’s 2026 report puts the global average cost of a data breach at $4.99 million, a record high.
- The NIST Cybersecurity Framework 2.0 organizes the work into 6 functions: Govern, Identify, Protect, Detect, Respond and Recover.
- US government agencies write “cybersecurity” as one word, while the UK’s NCSC writes “cyber security.” Both mean the same thing.
Cybersecurity affects everyone who uses a phone, a bank account or an email inbox, not only IT departments. This guide explains what cybersecurity means, why it matters, its main types and threats, and the principles that guide it. Definitions come from NIST, CISA and the UK’s NCSC, and figures come from the latest official reports available as of November 2026.
What is cybersecurity?
Cybersecurity is the protection of computer systems, networks and the information they hold against attack, misuse and damage. The NIST Computer Security Resource Center glossary gives a short version: “The process of protecting information by preventing, detecting, and responding to attacks.” A longer NIST definition adds the restoration of systems after damage and lists the qualities cybersecurity protects, including availability, integrity, confidentiality and authentication.
The US Cybersecurity and Infrastructure Security Agency (CISA) frames it in plainer terms. CISA describes cybersecurity as protecting networks, devices and data from unauthorized access or criminal use, and as ensuring the confidentiality, integrity and availability of information. The UK’s National Cyber Security Centre focuses on the outcome: the NCSC says cyber security helps individuals and organizations reduce the risk and impact of cyber attacks.
The three definitions agree on the main point. Cybersecurity is not a single product or tool. Cybersecurity is a continuing process that combines technology, such as firewalls and encryption, with policies and with people who know how to spot and respond to an attack. This matters because most real incidents involve more than one weakness, so protection has to cover all three layers.
Is it “cybersecurity” or “cyber security”?
Both spellings are correct and mean the same thing. US government bodies, including NIST and CISA, use the single word “cybersecurity,” and that form is standard in American English. The UK’s National Cyber Security Centre and many British and Commonwealth organizations write “cyber security” as two words. Search engines treat the two forms as the same topic, so the choice is a matter of regional style rather than meaning. TechJournal uses “cybersecurity” because it follows US English.
Why does cybersecurity matter?
Cybersecurity matters because cybercrime causes large, measurable financial losses and disrupts the services people depend on. The FBI’s 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in reported losses in 2025, a 26% increase in losses from 2024. Phishing and spoofing produced the most complaints (191,561), while investment fraud caused the largest losses at about $8.65 billion, followed by business email compromise at about $3.05 billion.
The cost to organizations is also high. IBM’s Cost of a Data Breach Report 2026, produced with the Ponemon Institute, puts the global average cost of a breach at $4.99 million, a record and a 12% increase over the previous year.
These figures have limits. IC3 data covers only crimes that victims report to the FBI, so the real total is likely higher, and IBM’s average comes from a sample of breached organizations rather than every company. The practical point is the same in both reports: weak security turns into direct financial harm, whether the victim is a retiree, a small business or a hospital. For a closer look at breach trends, see our 2026 data breach report.
What are the main types of cybersecurity?
There are 8 common types of cybersecurity, each covering a different part of a digital environment. They are:
- Network security: protects the connections between devices, using tools such as firewalls, network segmentation and intrusion detection.
- Endpoint security: protects individual devices, such as laptops, phones and servers, with updates, antivirus and device management.
- Application security: builds and tests software so that attackers cannot exploit coding flaws.
- Cloud security: protects data and workloads hosted by cloud providers, where security duties are shared between the provider and the customer.
- Identity and access management: controls who can sign in and what they can reach, using passwords, passkeys and multi-factor authentication.
- Data security: protects the information itself through encryption, backups and access rules.
- Operational technology and critical infrastructure security: protects industrial control systems in power grids, water plants, factories and hospitals.
- Security awareness and operations: trains people to recognize attacks and runs the monitoring and incident response that catch problems early.
The categories overlap in practice. A single phishing email can lead to a stolen password (identity), malware on a laptop (endpoint) and copied files (data). That overlap is the reason organizations treat cybersecurity as a layered program rather than a set of separate tools.
What are the most common cyber threats?
The most common cyber threats are social engineering such as phishing, ransomware, exploitation of software vulnerabilities, fraud and attacks that come through third parties. The table below summarizes each threat category at a high level.
| Threat | What it is | Recent data point |
|---|---|---|
| Phishing and social engineering | Messages or calls that trick people into sharing passwords, money or access | Top IC3 complaint type in 2025 (191,561 complaints) |
| Ransomware | Malware that encrypts or steals data and demands payment | Present in 48% of breaches in the 2026 Verizon DBIR |
| Vulnerability exploitation | Attacks on unpatched flaws in software and devices | The top way breaches started (31%) in the 2026 DBIR |
| Third-party and supply chain attacks | Breaches that come through a vendor, partner or supplier | Involved in 48% of breaches in the 2026 DBIR |
| Fraud and business email compromise | Impersonation used to redirect payments or steal funds | About $3.05 billion in reported BEC losses in 2025 (IC3) |
| Denial-of-service (DDoS) | Floods of traffic that knock websites and services offline | 51.3% of recorded activity in ENISA’s 2026 EU threat report |
The 2026 Verizon Data Breach Investigations Report, which examined more than 22,000 confirmed breaches in 145 countries, found that a human element was present in 62% of breaches. A human element means a person was involved, for example by clicking a phishing link, reusing a password or making a configuration error. The report also found that vulnerability exploitation (31%) has overtaken credential abuse (13%) as the most common way attackers get in.
In Europe, the ENISA Threat Landscape 2026 groups threats into cybercrime, state-linked activity, hacktivism and foreign information manipulation. ENISA reports that DDoS attacks (51.3%) and unauthorized access (39.5%) made up a large share of recorded activity affecting EU organizations. The practical response to these threats, such as patching and stronger sign-in methods, is covered in our cybersecurity and data privacy protection guide.
What is the CIA triad in cybersecurity?
The CIA triad is the set of 3 core goals of cybersecurity: confidentiality, integrity and availability. NIST’s definition of information security, drawn from FIPS 200, describes protecting information and systems “in order to provide confidentiality, integrity, and availability.” CISA uses the same three goals in its definition of cybersecurity.
| Principle | What it means | Example of a failure |
|---|---|---|
| Confidentiality | Only authorized people can see the information | Customer records leaked after a breach |
| Integrity | Information is accurate and has not been altered without permission | An attacker changes bank details on an invoice |
| Availability | Systems and data work when people need them | Ransomware locks a hospital’s records system |
The triad is useful because it turns a broad topic into three plain questions: who can see the data, can it be trusted, and can people reach it. Security decisions often trade these goals against each other. Strict access controls improve confidentiality, for example, but can reduce availability if legitimate users are locked out, so organizations balance the three according to their risks.
What frameworks guide cybersecurity?
The most widely used cybersecurity framework in the US is the NIST Cybersecurity Framework (CSF) 2.0, published on February 26, 2024. NIST says the CSF 2.0 can be used by any organization regardless of its size, sector or maturity. The framework describes outcomes to achieve rather than specific products to buy, and it organizes those outcomes into 6 functions:
- Govern: set the organization’s cybersecurity strategy, expectations and policy, and monitor them.
- Identify: understand the organization’s assets, suppliers and current cybersecurity risks.
- Protect: use safeguards that prevent or reduce the impact of attacks.
- Detect: find and analyze possible attacks and compromises.
- Respond: take action on a detected incident to contain its effects.
- Recover: restore affected assets and operations.
The Govern function is new in version 2.0 and reflects NIST’s view that cybersecurity is a leadership and risk-management issue, not only a technical one. Small organizations do not need to adopt a full framework at once, and using the 6 functions as a checklist is a sensible starting point.
How do individuals and businesses approach cybersecurity?
Individuals focus on protecting their own accounts and devices, while businesses manage risk across people, systems and suppliers. The basic personal steps are well established: use strong, unique passwords stored in a password manager, turn on multi-factor authentication, install updates promptly, back up important files and verify unexpected requests for money or codes. Our step-by-step protection guide explains each of these in detail, and you can check whether your email appeared in a data breach.
Businesses add structure on top of those basics. A typical program includes an inventory of systems and data, access controls, staff training, monitoring, an incident response plan and checks on vendors. The vendor step has grown in importance, since the 2026 DBIR found third-party involvement in 48% of breaches. Report cybercrime to the FBI at ic3.gov and, for a business, contact an incident response professional if you suspect an active attack, because rushed DIY fixes can destroy evidence or leave attackers inside the network.
How is AI changing cybersecurity?
AI is changing cybersecurity on both sides: attackers use it to scale fraud and malware, and defenders use it to detect and contain attacks faster. IBM’s 2026 report says AI-driven attacks rose 56%, led by deepfake impersonation and AI-enabled malware. The FBI’s 2025 IC3 report counted 22,364 complaints tagged as AI-related.
On the defense side, IBM reports that organizations using security AI and automation extensively saved an average of $1.93 million per breach compared with organizations that used none. Those savings are averages from IBM’s sample, not a guarantee for any single organization. AI tools also introduce their own risks, such as staff pasting sensitive data into unapproved services, so they need the same governance as any other system.
What careers are available in cybersecurity?
Cybersecurity careers include security analyst, penetration tester, security engineer, incident responder, cloud security specialist and governance or compliance roles. The US Bureau of Labor Statistics reports that information security analysts earned a median of $129,180 a year in May 2025. BLS projects employment to grow 21% from 2025 to 2035, much faster than average, with about 14,100 openings a year. The typical entry-level education is a bachelor’s degree.
Employers increasingly look for specific skills rather than headcount alone. The 2025 ISC2 Cybersecurity Workforce Study, based on 16,029 respondents, found that 95% of teams have at least one skills need and 59% have critical or significant needs. AI (41%) and cloud security (36%) were the most cited skills gaps. For degrees, certifications and entry routes, see our guide to cybersecurity programs.
FAQ
What is cybersecurity in simple words?
Cybersecurity is the protection of computers, phones, networks and data from hackers, scams and damage. It combines technology, rules and trained people to keep information private, accurate and available when needed.
What are the 3 main principles of cybersecurity?
The 3 main principles of cybersecurity are confidentiality, integrity and availability, known as the CIA triad. They mean that data is seen only by authorized people, is not altered without permission and can be reached when needed.
Is cyber security one word or two?
Both forms are correct. US agencies such as NIST and CISA write “cybersecurity” as one word, while the UK’s National Cyber Security Centre writes “cyber security” as two words.
What is the biggest cybersecurity threat?
Phishing and other social engineering are the most reported threats, with 191,561 phishing and spoofing complaints to the FBI in 2025. For organizations, the 2026 Verizon DBIR found ransomware in 48% of breaches and vulnerability exploitation as the top way breaches started.
Is cybersecurity a good career?
Cybersecurity is a growing field with above-average pay in the US. The Bureau of Labor Statistics reports a median salary of $129,180 for information security analysts in May 2025 and projects 21% job growth from 2025 to 2035.