What is cyber security? Assets, threats, impact and careers
In short: Cyber security is the practice of protecting data, systems, networks and services from harm, whether accidental or deliberate. It is about managing risk to the things an organisation values, and it is delivered by people, processes and technology working together.
What cyber security means
Cyber security is the work of keeping digital assets safe from damage, theft, misuse and disruption. An asset is anything of value: customer records, a payroll system, a website that takes orders, a Wi-Fi network, or the reputation of the business. The aim is not to make anything perfectly secure, which is impossible, but to keep risk at a level the organisation is willing to accept.
The field grew out of information security, which also covers paper records and conversations. Today the two terms overlap heavily. Most of the goals can be summed up by the CIA triad: keep data confidential, keep it accurate (integrity), and keep services available.
Threats, vulnerabilities and risk
Three words come up constantly, and exam questions love to test the difference:
- A threat is something that could cause harm, such as a ransomware gang, a careless employee or a flood.
- A vulnerability is a weakness that a threat could use, such as an unpatched VPN appliance or a shared admin password.
- Risk is the chance that a threat exploits a vulnerability, combined with how bad the result would be.
Example: a school runs an old file server with a known flaw (vulnerability). Criminals scan the internet for that flaw every day (threat). If they get in, pupil data could leak and lessons could stop for a week (impact). The risk is high, so patching or isolating that server becomes a priority.
What incidents really cost
When people think of a breach they picture stolen data, but the costs spread much wider:
| Cost | Example |
|---|---|
| Downtime | Tills, booking systems or production lines stop working |
| Recovery | Rebuilding servers, paying responders, overtime |
| Legal and regulatory | Fines under data protection law, legal advice, notifying people |
| Reputation | Lost customers and harder sales conversations |
| Direct theft | Fraudulent payments after a business email compromise |
This is why security is a business topic, not only an IT one. Boards fund security because it protects revenue and trust.
How the work is organised
Security is delivered through people (skilled staff and aware users), process (policies, patching routines, incident plans) and technology (firewalls, endpoint protection, logging). Weakness in any one of the three undermines the others: the best firewall does little if nobody reviews its alerts.
Entry routes are varied. Many people move in from help desk, networking or system administration, because understanding how systems normally work is the foundation for protecting them. Typical first roles include SOC analyst, junior security engineer and IT auditor.
Tip: build a small home lab, keep notes on what you learn, and practise explaining risk in plain business language. Employers value both the technical skill and the communication.
Practice
A laptop has no disk encryption. Is that a threat, a vulnerability or a risk?
Name three costs of an incident other than the stolen data itself.
Why is cyber security described as people, process and technology?
Key takeaways
- Cyber security protects assets: data, systems, networks, cloud, people and services.
- Threat, vulnerability and risk are different ideas; risk combines likelihood and impact.
- Incident costs include downtime, recovery, fines and lost trust, not just data loss.
- Security relies on people, process and technology together.
- Careers span operations, testing, governance, engineering, cloud and forensics.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.