Cybersecurity is the practice of keeping digital systems and the information in them available when you need them, private from people who shouldn't see them, and unaltered by anyone who shouldn't change them. That's it. Everything else — the products, the frameworks, the acronyms — exists to serve those three goals.
Most writing on this subject opens with a frightening statistic. We won't, because you already think the topic matters, or you wouldn't be here. What's actually useful is knowing which parts matter most, and most of those are simpler than the industry's vocabulary suggests.
The three goals, and why they conflict
Security people call these the CIA triad, which has nothing to do with the agency.
Confidentiality means only the right people can see your data. Integrity means the data is accurate and hasn't been tampered with. Availability means you can actually get to it when you need it.
The interesting part is that these three pull against each other. The most confidential system is one nobody can access — which destroys availability. The most available system is one with no login — which destroys confidentiality. Security is the work of finding a defensible balance for a specific situation, which is why there is no universal right answer, and why anyone selling you one is selling something.
The balance also shifts by context. In a hospital's medical devices or a water treatment plant, availability and human safety come first and confidentiality comes last. In a law firm's document store, the order reverses.
Six words people use interchangeably that mean different things
This is where most public confusion starts, so it's worth thirty seconds.
Information security is the broadest term: protecting information in any form, including paper and conversation. It predates computers.
Cybersecurity is the part of that concerned with digital systems and networks.
Privacy overlaps with security but isn't the same. Security is about stopping unauthorized access. Privacy is about what's done with data by people who are authorized. A company can hold your data perfectly securely and still violate your privacy by selling it.
Cyber resilience assumes some attacks will succeed and asks whether you can keep operating anyway. It's the shift from "prevent everything" to "survive what gets through" — and it's where serious organizations have been heading for several years.
Cybercrime is the legal category: fraud, extortion, theft. It's what police and prosecutors deal with.
National security in its cyber dimension covers state-level espionage and sabotage — the kind of activity no single company can defend against alone.
When a news story blurs these together, it usually gets the response wrong too.
What actually protects you
Here is the part the industry under-communicates, because it's not very sellable: a small number of unglamorous controls do most of the work.
For an individual, the highest-value things are free or nearly free. Use a password manager so every account has a unique password. Turn on multi-factor authentication, starting with your email — because whoever controls your email can reset everything else. Let your devices install updates automatically. Freeze your credit with all three bureaus if you're in the US. Back up anything you'd hate to lose.
That's most of your realistic risk, addressed for roughly the cost of nothing.
For an organization, the list is similar and the evidence is strong: multi-factor authentication that resists phishing, backups that have actually been restored from in a test, fast patching of anything internet-facing, endpoint monitoring that a human or a service actually watches, and knowing what systems and accounts you have in the first place.
We wrote that list out properly in the minimum viable security checklist, with the evidence for each one.
Not all multi-factor authentication is equal any more
This is the single most important update to common advice in the last few years, so it gets its own section.
For about a decade, "turn on MFA" was sufficient guidance. It isn't now. Attackers routinely defeat text-message codes and app-based approval prompts — by tricking people into approving a login they didn't start, by wearing them down with repeated prompts, or by sitting invisibly between the user and the real site and passing the code through.
What still holds up is phishing-resistant MFA: passkeys, or a physical security key you tap. These work because the credential is cryptographically bound to the real website, so a fake site can't use it. That closes the phishing failure mode specifically — it doesn't make an account untouchable, since session-token theft and help-desk resets remain routes in.
If you do one thing after reading this page, make it your email account, with a passkey.
Why breaches keep happening to organizations that "did security"
Three reasons recur in almost every post-mortem, and none of them is exotic.
Something wasn't covered. The monitoring tool was deployed everywhere except the server that got hit. The MFA requirement had one legacy exception. The backup ran nightly and had never been restored.
Something was somebody else's. Roughly half of breaches now involve a third party, according to Verizon's 2026 Data Breach Investigations Report — a supplier, a software vendor, a connected app. Your security is partly a function of the security of organizations you don't control.
Someone was helpful. The most effective attacks of the last three years didn't break anything technical. They involved a convincing phone call to a help desk, asking for a password reset.
Notice that none of these are solved by buying another product. They're solved by coverage, inventory, and process — which is why the honest version of security advice is less exciting than the marketed version.
Where to go next
If you're protecting yourself and your family, start with the 20-minute personal security checklist (planned reference; not yet available). If you're responsible for a small business, minimum viable security is twelve controls on one page. If you're curious how the field got here, seven years that changed cybersecurity traces the incidents behind the current advice.
And if someone is currently targeting you — a scam, an extortion attempt, a compromised account — go straight to the scam and fraud centre, which tells you what to do now and where to report it.
What to do next: Turn on phishing-resistant MFA for your email account today. It takes about five minutes and removes more risk than anything else on this page.
Related: The 20-minute personal security checklist (planned reference; not yet available) · Minimum viable security · Glossary · Seven years that changed cybersecurity
Sources: Verizon 2026 Data Breach Investigations Report (May 2026) — third-party involvement in breaches. NIST SP 800-63B Digital Identity Guidelines — authentication assurance and password policy. FIDO Alliance — passkey and phishing-resistant authentication. CISA Secure Our World — consumer guidance.