LEARN CYBER

Build real cybersecurity knowledge.

Start with a problem you want to solve. Each section explains the idea in plain English, shows why it matters, and gives you a trusted place to learn more.

ACCOUNT SECURITY

The four habits that stop common account takeovers

Use a unique password

Every important account needs its own long password. If one company is breached, a unique password prevents criminals from reusing it elsewhere.

Use a password manager

A password manager creates and stores strong passwords so you do not have to memorize or reuse them.

Turn on MFA

Multifactor authentication asks for another proof after your password. An authenticator app or security key is stronger than a text message when available.

Install updates

Updates often repair weaknesses that attackers already know about. Enable automatic updates when possible.

PHISHING & SCAMS

Pause when a message creates urgency

Phishing often impersonates a person or company you trust. The attacker wants you to react before you verify.

Unexpected urgency

“Act now,” “your account will close,” or “do not tell anyone” are pressure tactics.

A request for secrets

Legitimate support should not ask for your password, MFA code, recovery code, or remote access.

A disguised destination

The words in a link can look legitimate while opening a different website. Visit the official app or type the address yourself.

BREACH CHECK

See whether your email appeared in a known data breach

Have I Been Pwned is a public service built to help people assess exposure from known breaches. Its separate Pwned Passwords service checks whether a password has appeared in breach data without linking that password to your identity.

CHECK AN EMAIL CHECK A PASSWORD

Never enter your password into the email-search box. Use only the separate Pwned Passwords page for a password check.

IF YOUR INFORMATION APPEARS

What to do next

1
Read what was exposedAn email address alone requires a different response than an exposed password, Social Security number, or payment card.
2
Change the affected passwordChange it on the breached account and anywhere else you reused it. Use a new, unique password.
3
Secure your email firstYour email often controls password resets. Review recovery details, active sessions, forwarding rules, and MFA.
4
Watch for targeted scamsExposed details can make fake messages sound convincing. Verify requests through a separate, trusted channel.
5
Protect your identity when neededIf sensitive identity data was exposed, use the FTC’s recovery guidance and consider a free credit freeze.

FTC DATA-BREACH RECOVERY

TRUSTED RESOURCES

Go beyond headlines

These official and established resources provide practical guidance, standards, and vulnerability information.

CISA Secure Our World

Straightforward guidance about passwords, MFA, phishing, and software updates.

FTC Identity Theft & Online Security

Consumer guidance for scams, compromised accounts, breaches, and identity recovery.

NIST Cybersecurity Framework

A structured way for organizations to understand and manage cybersecurity risk.

NIST Cybersecurity Glossary

Definitions drawn from cybersecurity and privacy standards and publications.

CISA Known Exploited Vulnerabilities

A prioritized catalog of software flaws known to be used by attackers.

National Vulnerability Database

Technical details and severity information for publicly disclosed vulnerabilities.

PLAIN-ENGLISH GLOSSARY

Terms you will see in cyber news

Authentication

Proving that you are the person or system allowed to sign in.

Botnet

A group of infected devices remotely controlled to send spam, spread malware, or disrupt services.

CVE

A public identifier assigned to a specific known cybersecurity vulnerability.

Data breach

An incident where protected information is accessed, exposed, or stolen without authorization.

Encryption

A method of scrambling information so only someone with the right key can read it.

Exploit

Code or a technique used to take advantage of a vulnerability.

Firewall

A control that allows or blocks network traffic according to security rules.

Malware

Software intentionally created to damage, spy on, steal from, or control a device.

MFA

Multifactor authentication: another proof of identity beyond a password.

OSINT

Research using information that is legally available to the public.

Patch

An update that fixes a software problem, including a security weakness.

Phishing

A fake message or website designed to make you reveal information, send money, or open something harmful.

Ransomware

Malware that locks systems or files and demands payment, often after stealing data.

Social engineering

Manipulating a person into giving access, information, or money.

Threat actor

A person or group responsible for, or attempting, harmful cyber activity.

Vulnerability

A weakness in software, hardware, or a process that could be abused.

Zero-day

A vulnerability defenders had no advance time to fix before it was used or disclosed.

Zero trust

A security approach that continuously verifies access instead of automatically trusting a user or device.

Cybersecurity is not about knowing every technical term. It is about recognizing risk, verifying before acting, and knowing where to find reliable information.