Plain-English Cybersecurity Definitions for Business Owners

An endpoint is any device that connects to your business network — desktops, laptops, smartphones, tablets, servers, printers, even network-connected cameras and conference room TVs. In modern cybersecurity, "endpoint" specifically refers to the user-facing devices where work happens and where attackers most often gain a foothold. Each endpoint is a potential entry point, which is why endpoint security tools (antivirus, EDR, device management) are the foundation of any cybersecurity program.

Why it matters for your business

The shift to remote work multiplied the number of endpoints outside the office firewall. A laptop on hotel WiFi, a phone checking work email at home, a tablet in a coffee shop — each is a potential way in. Traditional perimeter security ("keep the bad stuff outside the firewall") no longer works. Modern security assumes endpoints will be exposed and focuses on detecting and stopping threats on the device itself.

EDR stands for Endpoint Detection and Response. It's the modern replacement for traditional antivirus. Where antivirus looks for known malware signatures, EDR continuously watches for suspicious behavior on every endpoint — unusual processes, unexpected file changes, abnormal network connections — and can automatically isolate a compromised device from the rest of the network before the threat spreads. EDR also generates detailed forensic data that security analysts use to investigate incidents and harden defenses going forward.

Why it matters for your business

Traditional antivirus is no longer enough. Attackers regularly use techniques — fileless malware, living-off-the-land tactics, novel ransomware variants — that signature-based antivirus simply can't see. EDR catches what antivirus misses. Most cyber insurance carriers now require EDR as a baseline control before they'll write or renew a policy. For a small or mid-sized business, EDR managed by a 24/7 SOC turns endpoint security from "hopefully nothing got through" into "we'll know within minutes and contain it automatically."

A SOC, or Security Operations Center, is a team of cybersecurity analysts who monitor an organization's networks, endpoints, and cloud systems around the clock for signs of attack. A SOC combines tools (EDR, SIEM, threat intelligence feeds) with human expertise to spot threats that automated systems miss, investigate suspicious activity, and respond to incidents in real time. Most small and mid-sized businesses can't justify the cost of building their own SOC — instead, they get SOC coverage through a managed service provider or a specialized security vendor.

Why it matters for your business

Cyber attacks don't keep business hours. Ransomware crews specifically time their attacks for weekends and holidays when IT staff are away. A 24/7 SOC means someone is watching even when your team isn't. Trinity includes 24/7 SOC monitoring with our cybersecurity service — this is security operations specifically, not general help desk coverage. Since our SOC went live in 2018, our managed clients have had zero successful cyber events.

SIEM stands for Security Information and Event Management. A SIEM platform collects log data from across your environment — firewalls, servers, endpoints, cloud apps, identity systems — into one central place, correlates the events, and raises alerts when patterns suggest an attack. Think of it as the security camera system for your IT environment: it records what's happening everywhere, and it flags activity that looks suspicious so a human analyst (usually in the SOC) can investigate.

Why it matters for your business

Attackers rarely trigger one obvious alarm. A real attack looks like a series of small, individually unremarkable events — a login from a new country, a file download at an odd hour, an account suddenly accessing systems it normally doesn't touch. SIEM connects those dots across your whole environment. Without it, those signals stay scattered across dozens of separate tools and nobody sees the pattern until it's too late. SIEM is what makes 24/7 SOC monitoring effective.

Encryption is the process of scrambling data so that it can only be read by someone with the correct decryption key. Modern encryption uses mathematical algorithms that are practically impossible to break by brute force. Businesses use encryption in two main contexts: in transit (data moving between systems, like an email being sent or a file uploaded to a cloud app) and at rest (data sitting on a hard drive, in a backup, or in a database). HTTPS, BitLocker, and encrypted backups are all examples of encryption you encounter every day.

Why it matters for your business

Encryption is one of the few cybersecurity controls that protects data after a breach. If an attacker steals an encrypted backup or laptop, the data inside is useless without the key. Many regulations (HIPAA for medical, PCI for payment cards, state data breach laws) require encryption of sensitive data — and encryption can reduce breach notification obligations if a device is lost or stolen. Encrypted, immutable backups are also the single best defense against ransomware: even if attackers encrypt your live systems, they can't touch a properly secured backup.