Cybersecurity

Cybersecurity is the practice of protecting computers, networks, programs and data from unauthorized access, damage or disruption, and the broader field of people, policy and technology dedicated to that goal. While the related entry on cybersecurity technology covers the specific tools involved, cybersecurity as a field also includes the professionals, processes and organizational policies that decide how those tools get used, who is responsible for them, and how an organization responds when something goes wrong.

Why cybersecurity matters

Nearly every modern organization, from small businesses to national governments, depends on digital systems to operate, which makes those systems an attractive target for criminals, spies and, in some cases, hostile states. A successful attack can expose sensitive personal data, halt business operations, damage trust with customers, or in the case of critical infrastructure such as power grids and hospitals, put public safety at risk. According to Fortinet, the scale and sophistication of cyber threats has grown steadily as more of daily life and commerce has moved online. [1]

Core areas of cybersecurity practice

Cybersecurity work generally spans several overlapping areas. Network security protects the infrastructure that connects systems together. Application security focuses on finding and fixing weaknesses in software itself. Identity and access management controls who is allowed to reach which systems and data. Incident response plans for how an organization detects, contains and recovers from an attack once one happens, since prevention alone can never guarantee that nothing gets through.

Careers in cybersecurity

Cybersecurity offers a wide range of roles beyond the stereotype of a lone hacker defending a network. Security analysts monitor systems for suspicious activity, penetration testers are hired to find weaknesses before criminals do, security engineers build and maintain protective systems, and chief information security officers set an organization’s overall security strategy. Many roles value hands-on experience and recognized certifications alongside formal education, and demand for skilled cybersecurity workers has generally outpaced the available supply in recent years.

Common threats cybersecurity defends against

Phishing attempts to trick people into revealing credentials or installing malicious software, often through convincing fake emails or messages. Ransomware encrypts an organization’s data and demands payment to restore access. Insider threats come from employees or contractors who misuse their legitimate access, whether maliciously or by accident. Supply chain attacks target a trusted vendor or software component in order to reach its customers indirectly, which has become a growing concern as organizations rely on increasingly complex networks of third-party software and services.

Cybersecurity vs. information security

The two terms overlap heavily but are not identical. Information security is the broader discipline of protecting information in any form, including paper records and verbal communication, while cybersecurity specifically concerns information and systems that exist in digital form. In practice, most organizations use the terms somewhat interchangeably, since the overwhelming majority of sensitive information today is stored or transmitted digitally.

How organizations build a cybersecurity program

Most organizations approach cybersecurity as an ongoing program rather than a single project, since new vulnerabilities and attack techniques appear constantly. A typical program starts with an inventory of systems and data worth protecting, then layers in technical controls such as firewalls, endpoint protection and multi-factor authentication alongside organizational measures like employee security training, incident response plans and regular penetration testing. Many organizations align this work to a published framework, such as the NIST Cybersecurity Framework or ISO/IEC 27001, which gives security teams a shared structure for identifying risks, protecting systems, detecting intrusions, responding to incidents and recovering afterward. Compliance requirements in industries such as healthcare and finance often mandate specific cybersecurity controls, turning good practice into a legal obligation as well.

FAQs

What is cybersecurity? Cybersecurity is the practice, and the broader field of people, policy and technology, dedicated to protecting computers, networks, programs and data from unauthorized access, damage or disruption.

What is the difference between cybersecurity and cybersecurity technology? Cybersecurity technology refers to the specific tools used for protection, such as firewalls and encryption, while cybersecurity as a field also includes the people, processes and policies that decide how those tools are used.

What are common cybersecurity careers? Common roles include security analyst, penetration tester, security engineer and chief information security officer, spanning everything from day-to-day monitoring to setting an organization’s overall security strategy.

What is the difference between cybersecurity and information security? Information security covers protecting information in any form, including physical records, while cybersecurity specifically concerns information and systems that exist in digital form.

Why has demand for cybersecurity professionals grown? As more business and daily life has moved online, the number and sophistication of cyber threats has grown too, and the supply of skilled cybersecurity workers has generally not kept pace with that demand.

Do small businesses need cybersecurity? Yes. Small businesses are frequent targets precisely because they often have weaker defenses than large enterprises, and a single breach can be financially devastating for a company without the resources to recover quickly.

What is a cybersecurity framework? A cybersecurity framework is a published set of best practices, such as the NIST Cybersecurity Framework, that organizations use to structure their security programs around consistent categories like identification, protection, detection, response and recovery.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 9, 2026Researched and drafted with AI assistanceReport an issue