Who can get in
Making sure only you — and the people you deliberately allow — can open your email, bank, photos, messages or business records.
Free guide · plain English
What is cybersecurity, in words anyone can use.
A short, honest explanation of what cybersecurity actually means, what it protects, the threats ordinary people really meet, and the first five things worth doing today.
The short answer
Cybersecurity is the practice of keeping computers, phones, networks and the information on them safe from people who do not have permission to use them. That includes the obvious — a stranger trying to break in — but also the quiet and ordinary: a password reused across six sites, an app that kept your location, a message from a “bank” that is not your bank.
The important part is that cybersecurity is not a product you buy once. It is a set of decisions, most of them small, made by people rather than by software. A household that updates its phones, uses different passwords, and agrees what to do about a suspicious message is practising cybersecurity, whether or not anyone called it that.
What it protects
Three things, not one
“Security” sounds vague until you name what is actually being guarded.
What your information says
Keeping your data accurate and private, so nobody can read it, change it, or sell a picture of you that you did not agree to.
Whether things still work
For a school, a clinic or a small shop, an outage is a cybersecurity problem too: if the system is locked or down, the work stops.
The threats people actually meet
Six things worth understanding
Not an exhaustive list — a realistic one, ordered roughly by how often they reach ordinary people.
Phishing
A message that pretends to be from someone you trust — your bank, a delivery company, a colleague, a school — to make you hand over a password or a payment. Urgency and a link are its two signature moves.
Malware
Software that ends up doing something you never asked for: watching what you type, stealing saved passwords, locking your files until you pay, or quietly using your device.
Reused and weak passwords
Not an attack at all — just the slow, automated testing of passwords leaked from one site against every other site you use. It works because people reuse them.
Social engineering
Manipulation rather than code. Someone calls, messages or impersonates you well enough that a real person willingly opens a door. Training beats technology here.
Lost or unsecured devices
A phone without a screen lock is an open wallet of accounts. Most of the damage from a lost phone comes from what was already signed in on it.
Over-permissioned apps
Applications that keep access to location, contacts, microphone or photos long after you stopped using them — usually perfectly legally, and completely unnoticed.
Where to start
Five steps, in this order
Do them one at a time. Each is a decision you make once and benefit from every day afterwards.
- Turn on two-step verification for your email first — it is the master key to the rest
- Give every important account its own password, stored in a password manager
- Switch on automatic updates for the phone, the laptop and the apps
- Write down one rule for links: never enter credentials from a message you did not expect
- Decide today who you would call if money or a threatened person were involved
Words you will keep meeting
A ten-term glossary
Enough vocabulary to read any security notice, news story or bank alert without feeling lost.
- Authentication
- Proving you are who you say you are — a password, a code, a fingerprint, a key.
- Two-step verification
- A second check after the password, so a stolen password alone is not enough.
- Encryption
- Scrambling information so only someone with the key can read it. Your messaging app and your bank both rely on it.
- Phishing
- A fake message that imitates someone trusted to steal a login, a card or a payment.
- Malware
- Any software that harms a device, steals information or takes control without permission.
- Ransomware
- Malware that locks your files and demands payment to release them. Backups are the real answer.
- Two-factor (2FA)
- A second factor — usually an app or a hardware key — that proves the person logging in is present.
- VPN
- An encrypted tunnel for your internet traffic. Useful on shared networks; not a shield against bad passwords.
- Firewall
- A gatekeeper that decides what network traffic is allowed in and out of a device or building.
- Breach
- An incident where information reached someone who was not allowed to have it.
Why this matters to us
Most people are never given a plain explanation
Cyber Tor is building practical cybersecurity tools and education for people who are not technical — families, schools, small businesses and communities. That work is still in development, so this guide is written to be useful to you today, on its own.
- Written for people, not specialists.
- No product names or paid tools required.
- Honest about what is available now and what is still in development.
A safer future starts with us
Help us build a safer digital future.
Early users, educators, community organizations and mission-aligned partners — there’s a place for you in our journey.