Reference · Entry 7

Glossary

Forty-odd terms from this subject, each defined in a sentence or two, cross-linked to the entry that treats it at length. Grouped by what the term is about rather than alphabetically, because related words are easier to learn together.

Part of the Momentum Space knowledge base · Last reviewed 22 September 2026

How to use this page

Four groups: what the software does, what it looks for, how devices are protected more broadly, and the commercial terms that appear at checkout. Two worked examples at the end show the vocabulary in use.

What the software does

Antivirus: A program that inspects files, memory and program behaviour and acts on what matches a definition of harm. A historical name for what the industry calls endpoint protection. See what antivirus software is.
Endpoint protection: The industry term for the same category, covering the scanner plus the additional controls layered on it. An endpoint is any device that connects to a network.
Real-time protection: Also on-access scanning. The scanner is consulted every time a file is opened, written or executed, so something can be stopped before it runs. This is where most of a product's performance cost sits.
On-demand scan: A scan run manually or on a schedule, reading through storage independently of what is being used. Its value is applying today's knowledge to files that arrived earlier.
Quarantine: A storage area holding a suspected file in a form that cannot execute. Reversible, which is why it is preferable to immediate deletion.
Exclusion: A file, folder or process the scanner is told to skip. Useful for a confirmed false positive; risky when applied to a whole drive, because everything inside it becomes invisible to the scanner.
Definition update: New signatures and rules, delivered frequently. Distinct from an engine update, which changes the scanning software itself and arrives rarely.
Web protection: Blocking known malicious or phishing addresses before a page loads, usually through a browser extension or a local network filter. The only scanning-adjacent function available on iOS.
Firewall: Controls which network connections are allowed in or out. A separate function from scanning; both Windows and macOS include one.

What it looks for

Malware: The general term for software written to cause harm or to act against the interests of the device's owner. Every term below is a species of it. See malware types, defined.
Virus: Code that attaches to a host file and copies itself when the host runs. Requires a carrier and requires execution.
Worm: Self-replicating code that spreads across a network without needing a host file or a person's action.
Trojan: Code disguised as something wanted. Does not replicate; relies on someone choosing to run it. The most common route onto consumer devices.
Dropper: A small program whose only job is to fetch and install a larger payload, keeping the initially delivered file unremarkable.
Ransomware: Encrypts files and demands payment, often after copying them so publication can also be threatened. Recovery depends on backups the ransomware could not reach.
Information stealer: Collects saved passwords, session cookies, wallet files and documents and sends them to an operator. The stolen material is generally resold.
Session cookie theft: Taking the token that proves a browser is already signed in, which in some configurations allows an account to be entered without the password.
Spyware: Software that observes activity without the person's knowledge, including keystrokes, screenshots and camera or microphone access.
Stalkerware: Monitoring software installed on someone's phone by a person with physical access and hidden from the owner. A safety matter; the eSafety Commissioner publishes specific guidance.
Adware: Injects advertising, redirects searches or opens advertising windows. Intrusive rather than destructive, and frequently bundled with wanted software.
Cryptominer: Uses the device's processor to mine cryptocurrency for someone else. Symptoms are heat, noise and a fast-draining battery.
Rootkit: Code that hides by interfering with the operating system's own reporting. A bootkit does the same by loading before the operating system starts. Detection usually requires scanning from outside the running system.
Botnet: A network of compromised devices directed remotely, used for spam, traffic relay or attacks on third parties. The owner typically notices nothing.
Potentially unwanted program: Software installed without a clear choice, or behaving in ways most people would decline if asked. Not criminal; products differ on whether they remove it by default.
File-less attack: Malicious activity carried out by legitimate system tools driven by a script, leaving no suspicious file on disk. Countered by behavioural monitoring rather than file scanning.
Zero-day: A flaw exploited before a fix is available. The term describes the state of the vulnerability, not a type of malware.
Phishing: A message leading to a convincing copy of a login page. No malicious file is involved, which is why scanning alone does not address it. Reportable to Scamwatch.

How detection is described

Signature: An exact identifier for a known malicious file, from a hash to a byte pattern. Precise, fast, and blind to anything not yet analysed.
Hash: A short fingerprint calculated from a file's contents. Identifies that exact file without revealing what is in it; changing one byte changes the hash entirely.
Heuristic: A rule that judges a file by its characteristics rather than by a known identity. Catches new things and, because it generalises, sometimes misfires. See how detection works.
Behavioural monitoring: Judging a running program by the sequence of actions it performs, such as rapidly rewriting many documents.
Sandbox: A constrained, disposable environment in which a suspicious file can be run and observed. Also the term for the isolation each app runs in on mobile platforms.
Reputation: A judgement based on how widely and how long a file has been seen, and whether it is signed. Useful, with a known blind spot for anything genuinely rare.
False positive: A clean file identified as malicious. Costs time, and trains people to dismiss warnings.
False negative: Something malicious not identified. Costs whatever the code was written to do.
Detection name: The label a product displays, usually combining platform, category, family and variant. Not standardised between vendors; a generic or heuristic marker indicates a rule-based rather than exact match.
Telemetry: Data sent from the product to the vendor, from file hashes to detection records. Discussed in scanning and privacy.

Controls beyond the scanner

Patching: Applying updates that close known flaws. Treated as foundational in the guidance published by the Australian Cyber Security Centre.
Multi-factor authentication: Requiring a second element beyond a password. Addresses stolen and reused credentials, which scanning does not.
Backup: A copy of data stored where a compromise of the original device cannot reach it. The determining factor in ransomware recovery.
Disk encryption: Rendering stored data unreadable without the key, so a lost or stolen device does not expose its contents.
Password manager: Software that generates and stores distinct passwords per service, removing reuse as a weakness. Frequently bundled with security suites.
Virtual private network: Encrypts traffic between a device and a server operated by the VPN provider. Addresses network observation; it does not scan files or detect malware, though the two are often sold together.
Australian Privacy Principles: The thirteen principles under the Privacy Act 1988 (Cth) governing how covered organisations handle personal information, published by the OAIC.
Notifiable Data Breaches scheme: The scheme administered by the OAIC requiring notification of eligible data breaches likely to result in serious harm.

Terms that appear at checkout

Seat or device slot: One unit of a licence, covering one device. Whether a slot can be moved to a replacement device is a vendor policy worth checking.
Introductory price: The rate for the first term only. The renewal rate is a separate figure and is the one that recurs.
Automatic renewal: The subscription continues and is charged again unless cancelled. Find the cancellation control before subscribing, not at renewal.
Affiliate link: A link that identifies the site sending the visitor, so the vendor can pay a commission on a resulting sale. Every affiliate link on this site is marked and explained; see the affiliate disclosure.
Consumer guarantee: A right that applies automatically to goods and services supplied to consumers in Australia and cannot be excluded by contract. Explained by the ACCC.

Two worked examples

Example one: a scan result

A scheduled scan on a Windows laptop reports a detection with a generic name in a folder of downloaded installers, and the file is moved to quarantine. Read in the vocabulary above: an on-demand scan applied current definitions to a file that arrived earlier; the detection name indicates a heuristic rather than a signature match, so a false positive is possible; quarantine means the decision is reversible. The appropriate next step is to establish where the installer came from, not to add an exclusion for the whole folder.

Example two: a subscription decision

A household has two iPhones, one iPad and one Windows laptop, and is considering a five-device subscription. In these terms: three of the four seats are on a platform whose sandbox prevents scanning, so those apps provide web protection and breach alerts; one seat replaces real-time protection already present in Windows. Before paying, check the introductory price against the renewal rate and confirm whether automatic renewal applies. That is a defensible purchase, but for reasons different from the ones the packaging suggests.