Don't confuse these

Application security

• Cross-site request forgery (CSRF) vs Cross-site scripting (XSS)

  XSS runs the attacker's script inside the trusted site; CSRF runs nothing there and only borrows the user's login to send one request from outside.

• Cross-site scripting (XSS) vs SQL injection

  Both abuse input the site trusts too much, but SQL injection attacks the database on the server, while XSS attacks the visitor's browser.

Compliance & regulation

• Audit vs Gap analysis

  A gap analysis finds what is missing before you start; an audit checks whether what you claim to do is really done.

• Audit vs Self-assessment
• Centre for Cyber Security (CFCS) vs Supervisory authority

  CFCS dealt with cyber threats to Danish firms and society; Datatilsynet checks how personal data is handled under GDPR - easily mixed up when a breach must be reported.

• CER Directive vs NIS2 Directive

  Adopted the same day as twins - NIS2 protects network and information systems, CER protects the physical ability of critical entities to keep running. Entities named under CER count as essential under NIS2.

• Compliance and risk coordinator vs Information security coordinator

  The compliance and risk coordinator checks against rules and risks; the security coordinator runs the whole security programme day to day.

• Cyber Resilience Act (CRA) vs NIS2 Directive

  NIS2 sets duties for the organisations that run vital services; the CRA sets duties for the products and software they, and everyone else, buy.

• D-mærket vs ISO 27001

  D-mærket is a light Danish label also covering data ethics; ISO 27001 is a heavier international certification of a security system.

• Data controller vs Data processor

  The controller decides why and how data is used; the processor only handles it on the controller's written instructions.

• Data ethics vs GDPR

  GDPR sets what you must do with personal data; data ethics asks what you should do, also with data the law does not cover.

• DORA vs NIS2 Directive

  NIS2 covers many sectors; DORA is the stricter, more detailed rulebook for finance, and where both apply to a financial firm, DORA's rules take the lead.

• EU directive vs EU regulation

  A directive must first become national law; a regulation applies directly and the same way in every member state.

• GDPR vs NIS2 Directive

  GDPR protects people's personal data; NIS2 protects the services society depends on.

• ISO 27000 series vs NIST Cybersecurity Framework (CSF)

  The ISO series is a set of certifiable standards; the NIST framework is a free, voluntary guide without certification.

• ISO 27001 vs NIS2 Directive

  NIS2 is a law you must obey; ISO 27001 is a voluntary standard you can use to meet it.

• ISO 27001 vs NIST Cybersecurity Framework (CSF)

  ISO 27001 is a management system a firm can be certified against; the NIST CSF is a free, voluntary framework of outcomes with no certificate.

Controls & technical basics

• Intrusion detection system (IDS) vs Intrusion prevention system (IPS)

  An IDS only watches and warns; an IPS sits in the path of traffic and blocks what it judges harmful.

• Organisational control vs People control
• Organisational control vs Technical control
• Penetration test vs Vulnerability scanning

  A scan automatically lists known weaknesses; a pentest has people actually use and combine them to prove real impact.

• Penetration test vs Vulnerability assessment

  An assessment ranks weaknesses on paper; a pentest proves which ones can really be used by trying.

• People control vs Technical control

Detection & response

• Alert triage vs Threat hunting

  Triage reacts to alarms that tools have already raised; hunting starts from a guess and searches for what raised no alarm.

• Anomaly detection vs Detection rule

  A detection rule looks for an attack someone has already described; anomaly detection looks for anything that breaks the usual pattern.

• Indicator of compromise (IoC) vs MITRE ATT&CK

  A trace is a single thing an attacker left behind and can easily change; MITRE ATT&CK describes how attackers behave, which is much harder for them to change.

Fundamentals

• Availability vs Confidentiality

  More locks protect confidentiality but can make information harder to reach; the two must be balanced.

• Compliance vs Cyber and information security

  Being compliant means meeting a set of rules; being secure means actually being protected. One does not guarantee the other.

• Confidentiality vs Integrity

  Confidentiality is about who can see information; integrity is about whether it has been changed.

• Credential stuffing vs Session hijacking

  Credential stuffing comes in through the front door with a reused password; session hijacking skips the login and takes over someone already logged in.

• Defence in depth vs Perimeter security
• Integrity vs Non-repudiation
• Risk vs Threat

  A threat is what could happen; risk also weighs how likely it is and how much it would hurt.

• Security control vs Security policy

  A policy says what should be achieved; a control is the concrete measure that achieves it.

• Security incident vs Threat

  A threat is something that could cause harm; an incident is harm that is actually happening or has happened.

Incidents & continuity

• Business continuity plan (BCP) vs Disaster recovery plan (DRP)

  The BCP keeps the business working during the crisis; the DRP gets the technology back afterwards.

• Crisis management vs Incident response

  Incident response is the technical work to stop and fix an attack; crisis management is leadership steering the business around it.

• Incident reporting vs Lessons learned

  Reporting passes facts on quickly during the event; lessons learned looks back afterwards to improve.

People, culture & awareness

• Phishing vs Pretexting
• Pretexting vs Spear phishing

  Both aim at one chosen person, but spear phishing rests on a single well-made message, while pretexting rests on playing a role that can last over many contacts.

• Security awareness vs Security culture

  Awareness is what each person knows and does; culture is the shared habits and attitudes of the whole group.

• Smishing vs Vishing

  Smishing sends a written message and waits for a click; vishing uses a live voice to push the victim in real time.

Risk management

• Qualitative risk analysis vs Quantitative risk analysis

  The qualitative method uses scales and judgement; the quantitative one puts money and probabilities on each risk.

• Residual risk vs Risk appetite

  Residual risk is what is actually left; risk appetite is how much leadership is willing to leave. The first is measured against the second.

• Risk acceptance vs Risk avoidance

  Acceptance keeps the activity and its risk; avoidance stops the activity so the risk disappears.

• Risk appetite vs Risk profile
• Risk avoidance vs Risk mitigation

  Avoidance stops the activity; mitigation keeps it and adds controls to make it safer.

• Risk mitigation vs Risk transfer

  Mitigation lowers the risk itself; transfer leaves the risk unchanged but moves its cost to another party.

Across clusters

• Attack surface vs Threat landscape

  The attack surface is your own ways in; the threat landscape is who and what is out there trying them.

• Certification vs Compliance

  Compliance means following the rules; certification is an outside body's formal statement that a standard is met at a point in time.

• Denial of service (DoS/DDoS) vs Ransomware

  Both make systems unusable, but a flood blocks them from outside while ransomware locks the data from inside.

• False positive vs Security incident

  A security incident is real harm or a real threat; a false positive only looked like one until someone checked.

• IT operations vs Security operations centre (SOC)

  IT operations keeps systems running; a SOC watches the same systems for attacks.

• Nudging vs Security policy

  A policy sets rules that must be followed; a nudge steers behaviour without any rule or penalty.

• Organisational control vs Physical security
• People control vs Physical security
• Perimeter security vs Zero Trust

  Perimeter security trusts whatever is inside the network; Zero Trust trusts nothing by location alone and checks every request.

• Privacy by design vs Security by design

  Security by design protects all systems and data; privacy by design is the GDPR principle focused on people's personal data and collecting less.

• Security framework vs Security policy

  A framework is an outside, shared structure; a policy is the organisation's own document of its goals and rules.

Cryptography

• Public-key cryptography vs Symmetric encryption

  Symmetric encryption uses one shared key for both locking and unlocking; public-key cryptography uses a linked pair, so no secret has to be shared first.

Identity & access

• Authentication vs Authorization

  Authentication asks who you are; authorization asks what you may do. Passing the first does not grant the second.

• User account vs Digital identity

  An identity is who someone is; an account is one login they hold in one system. One identity can have many accounts.

Networking

• Client vs Server

  The client asks and starts the exchange; the server waits and answers. The same machine can play either role.

• TLS vs VPN

  TLS protects one program's connection to one service; a VPN wraps all of a device's traffic in a single protected tunnel.

Across clusters

• Cryptographic key vs Password

  A password is chosen and remembered by a person; a key is a long random value made and stored by a machine.

• Database vs File system

  A file system stores whole files by name; a database stores records it understands, so it can search them and keep many changes in step.

• Encryption vs Hashing

  Encryption can be reversed by whoever holds the key; hashing is one-way and can never give the original data back.

• End-to-end encryption vs TLS

  TLS protects data only on each hop and the server reads it in the middle; end-to-end encryption keeps it closed all the way from sender to receiver.

Agents & tools

• Agent2Agent protocol (A2A) vs Model Context Protocol (MCP)

  MCP connects one agent to its tools and data; A2A connects whole agents to other agents as equals that may think and work for a long time.

AI hardware & serving

• Latency vs Throughput

  Latency is how long one request waits; throughput is how much total work gets done per second. Grouping requests together often raises throughput while making each one wait longer.

AI risk & governance

• Adversarial example vs Data poisoning

  An adversarial example fools a finished model while it is in use; data poisoning corrupts the model while it learns.

• AI alignment vs Guardrails

  Alignment shapes what the model itself tends to do; guardrails are separate checks placed around it that catch what alignment misses.

• Data poisoning vs Prompt injection

  Poisoning corrupts the model while it learns; prompt injection misleads a finished model while it is in use.

• Jailbreak vs Prompt injection

  In a jailbreak the user attacks the model's own safety rules; in prompt injection an outsider hides instructions in content the model reads, turning it against its user or owner.

AI-assisted coding

• AI coding assistant vs Coding agent

  An assistant answers and suggests while the developer drives; a coding agent is handed a task and carries out many steps, runs commands and edits files by itself.

• AI pair programming vs Vibe coding

  Both hand the typing to AI, but in pair programming the developer reads and understands every change, while vibe coding skips that reading on purpose.

• Code completion vs Coding agent

  Completion offers a few lines at the exact spot being typed; a coding agent plans and changes many files toward a goal.

• Spec-driven development vs Vibe coding

  Vibe coding lets the code decide what gets built and skips reading it; here people agree what should be built first and check the result against it.

Evaluation & metrics

• Accuracy vs F1 score

  Accuracy counts every correct answer alike, so it hides a rare class that is always missed; the F1 score looks only at that class and exposes the problem.

• Benchmark vs LLM-as-a-judge

  A benchmark checks answers against fixed correct ones; an LLM judge grades open answers where no single correct one exists.

• Precision vs Recall

  Precision asks how many of the flagged cases were right; recall asks how many of the real cases were found. Raising one usually lowers the other.

• Test set vs Validation set

  The validation set is checked many times to steer choices while building; the test set is opened once, after every choice is made.

Language models

• Context window vs Knowledge cutoff

  The context window is what the model can read right now; the knowledge cutoff is where its built-in knowledge stops - new facts can only get in through the window.

Machine learning basics

• Artificial intelligence (AI) vs Machine learning

  AI is the whole goal of making computers act smart; machine learning is one way to get there, by learning from examples instead of written rules.

• Classification vs Regression

  Classification picks one group from a fixed list; regression gives a number on a scale, such as a price or a time.

• Classification vs Clustering

  Classification sorts into groups that people named in advance and taught with examples; clustering finds its own groups with no names given.

• Classification vs Generative AI

  Classification only decides which group an input belongs to; generative AI makes new text, images or sound.

• Deep learning vs Feature engineering

  Deep learning finds useful inputs by itself from raw data; feature engineering has people build those inputs by hand.

• Inference vs Model training

  Training is the slow, one-off stage where the model learns; inference is every later use, where it only applies what it learned.

• Linear regression vs Logistic regression

  Linear regression predicts a number such as a price; logistic regression, despite its name, predicts which group something belongs to.

• Reinforcement learning vs Supervised learning

  Supervised learning is shown the right answer for each example; reinforcement learning is only told afterwards how good its choice turned out.

• Reinforcement learning vs Unsupervised learning
• Self-supervised learning vs Supervised learning

  Both learn from right answers, but in supervised learning people write the answers; here they are cut out of the data itself.

• Self-supervised learning vs Unsupervised learning

  Neither needs human labels, but unsupervised learning only looks for groups and patterns, while self-supervised learning sets itself fill-in-the-gap tasks with a right answer.

• Supervised learning vs Unsupervised learning

  Supervised learning is given the right answers to learn from; unsupervised learning gets no answers and must find groups or oddities by itself.

Model architectures

• Decoder vs Encoder

  An encoder reads the whole input in both directions to understand it; a decoder only looks back and writes new tokens one by one.

Prompting & generation

• Context engineering vs Prompt engineering

  Prompt engineering polishes the wording of one request; context engineering manages everything placed in view across many steps, much of it gathered automatically.

• Few-shot prompting vs Zero-shot prompting

  Few-shot shows the model worked examples first; zero-shot gives only the instruction.

Retrieval & search

• Keyword search vs Semantic search

  Keyword search needs the same words to appear; semantic search matches on meaning, so each catches results the other misses.

Training & optimisation

• Hyperparameter vs Model parameter

  A hyperparameter is set by people before training; a model parameter is learned by the model during training.

• Instruction tuning vs Pretraining

  Pretraining gives broad knowledge from raw text; instruction tuning afterwards teaches the model to act on requests.

Across clusters

• Agent instructions file vs System prompt

  Both are standing orders, but the system prompt is set by whoever builds the AI tool, while this file is written by the project team and travels with the code.

• Agent memory vs Context window

  The context window is what the model sees right now and is lost when the chat ends; agent memory is stored outside and survives to be read in again.

• Agentic workflow vs AI agent

  In a workflow the developer's code decides the order of steps; in an AI agent the model decides for itself as it goes.

• AI bias vs Hallucination

  Bias is a steady tilt in results for certain groups; a hallucination is a confident answer that is simply made up.

• AI supply chain attack vs Slopsquatting

  Both abuse trust in downloads, but slopsquatting plants code packages under names an AI invents, while an AI supply chain attack tampers with the AI's own parts.

• Artificial intelligence (AI) vs Large language model (LLM)

  Many people now say "AI" and mean a chat assistant, but a large language model is only one kind of AI among many.

• Context window vs Training data

  Text in the context window is only read for the current answer; training data shaped the model beforehand. A supplier may still keep chats and reuse them as training data later.

• Convolutional neural network (CNN) vs Transformer

  A CNN only looks at small nearby patches at a time and builds up; a transformer lets every part of the input look at every other part from the start.

• Data drift vs Overfitting

  Both show up as a model doing worse in real use than in testing, but overfitting is a flaw from training, while data drift comes from the world changing afterwards.

• Diffusion model vs Large language model (LLM)

  A diffusion model shapes the whole output at once over many cleaning steps; a large language model writes one token after another.

• Embedding model vs Large language model (LLM)

  Both read text, but an embedding model returns a single list of numbers, while a large language model writes new text.

• Feature vs Model parameter

  Features are the values an example brings to the model; model parameters are the values the model learns and keeps from training.

• Foundation model vs General-purpose AI model (GPAI)

  A foundation model is the research name for the idea; a general-purpose AI model is the legal category in the EU AI Act, with its own tests and duties.

• Knowledge distillation vs Transfer learning

  Transfer learning reuses the same model for a new task; distillation moves skill into a different, smaller model.

• Large language model (LLM) vs Small language model (SLM)

  Both work the same way, but a small language model has far fewer parameters, so it is cheaper and faster but knows less.

• Model evaluation (evals) vs Model training

  Training changes the model to fit its examples; evaluation only measures the finished model and must not feed back into it unchecked.

• Overfitting vs Underfitting

  Overfitting learns the examples too closely and fails on new cases; underfitting has not learned enough to do well even on the examples it saw.

• Prompt injection vs System prompt

  Both are instructions to the model, but the system prompt comes from the app's builder while prompt injection smuggles in an attacker's orders that try to override it.

• Test set vs Training data

  Training data is what the model learns from; the test set is kept strictly apart so it can measure the model fairly.

• Training data vs Validation set

  Training data is what the model learns from; the validation set is held back from it and only checked, to choose settings and when to stop.

Cloud

• Infrastructure as a service (IaaS) vs Platform as a service (PaaS)

  With IaaS you look after the operating system yourself; with PaaS the provider does, and you bring only your program and data.

• Infrastructure as a service (IaaS) vs Software as a service (SaaS)

  IaaS hands you raw machines to build on; SaaS hands you a finished program to use.

• Platform as a service (PaaS) vs Software as a service (SaaS)

  With PaaS you run your own program on the provider's platform; with SaaS you only use the provider's finished program.

Observability

• Distributed tracing vs Metrics
• Monitoring vs Observability

  Monitoring answers questions you chose in advance; observability lets you ask new questions about problems you did not expect.

• Service level agreement (SLA) vs Service level objective (SLO)

  An SLA is a contract promise to customers with a price for breaking it; an SLO is the stricter internal target that keeps the promise safe.

Across clusters

• Container vs Virtual machine

  A virtual machine carries its own full operating system; a container shares the host's kernel, which makes it lighter but less strongly separated.

• Access control vs Access management

  Access control is the mechanism that allows or refuses each request; access management is the ongoing process of granting, reviewing and removing that access.

• AI red teaming vs Penetration test

  A pentest looks for ways into systems and data; AI red teaming also hunts for harmful, false or rule-breaking answers from the model itself.

• Audit logging vs Audit

  Audit logging is a system's own record of actions; an audit is a person's independent review of whether controls work - which often reads those records.

• Classification vs Data classification

  Same word, different job. Data classification is people labelling files by how secret they are, not a machine sorting inputs.

• Distributed tracing vs Log
• EU AI Act vs GDPR

  GDPR protects personal data wherever it is used; the AI Act governs AI systems as products, whether or not they touch personal data. Both often apply at once.

• Excessive agency vs Privilege escalation

  In privilege escalation an attacker gains rights they were never given; with excessive agency the rights were handed over from the start.

• Firewall vs Intrusion prevention system (IPS)

  A firewall decides by fixed rules about where traffic may go; an IPS looks inside allowed traffic for signs of an attack.

• Firewall vs Human firewall
• One-time password (OTP) vs Passkey

  A one-time code can be typed into a fake site by mistake; a passkey only answers the real site.

• Prompt injection vs Social engineering

  Both trick a target into obeying a false authority, but here the target is the model, not a person.

• Prompt injection vs SQL injection

  Both slip commands in through input, but SQL injection targets a database while prompt injection targets a language model.

• Recovery objectives (RTO/RPO) vs Service level objective (SLO)
• VPN vs Zero Trust

  A VPN trusts whoever gets into the network; Zero Trust checks every request no matter where it comes from.