Replace security jargon with a short sentence that describes what happens and why it matters. For example, say "an attacker can read other customers' data" instead of "broken access control". Keep the technical term in brackets once, for readers who want to search for it.
When to translate
Translate when your audience does not work in security: managers, sales, legal, support, customers and new hires. Keep the term when talking to peers, since precision helps. A good test: if the listener could not explain the word back to you, give them the plain version first.
Twelve terms and plain versions
| Term | Plain version |
|---|---|
| Vulnerability | A weakness in software that someone could use to do something they should not |
| Exploit | The method or code that uses a weakness |
| CVE | A public ID number for a specific known weakness |
| Patch | A fix released by the maker of the software |
| Attack surface | All the places an outsider could try to get in |
| Lateral movement | An intruder moving from one system to another once inside |
| Privilege escalation | Gaining more access than you were given |
| Supply chain attack | Getting at you by tampering with something you rely on, such as a library or an update |
| SBOM | An ingredient list for software |
| Zero day | A weakness attackers use before a fix exists |
| False positive | A warning that turns out to be wrong |
| Compensating control | A different safeguard that reduces the same risk when the main fix is not possible yet |
How to use a plain version
Lead with the plain sentence, then add the term if it helps.
"A weakness in our login page could let someone guess their way into accounts. The technical name is credential stuffing, in case you see it in reports."
This teaches without lecturing. Over time, colleagues pick up the words themselves.
Watch for words that mean different things to different people
Breach. Lawyers and engineers may mean different things. Check whether you mean any unauthorised access or an event that triggers notification duties.
Critical. A scanner may use it for a score band, while a manager hears "drop everything". Say what the rating means in context.
Secure. Almost meaningless alone. Say what it is secure against.
Compliant. Say with what, audited by whom, as of when.
Build a team glossary
Keep a one page glossary in your wiki with the plain version of each term your team uses. New hires read it in their first week, and writers of tickets, emails and reports can borrow from it. Review it twice a year.
Do not over simplify
Plain language should be accurate. Replacing "this needs a login and a rare configuration" with "anyone can break in" is a distortion, not a translation. If the simple version leaves out a condition that changes the decision, include the condition.
Test your wording
Read your message to someone outside security. Ask them what they would do next. If their answer is not what you intended, the wording is the problem, not the listener.
Safeguard's compliance and evidence automation can help teams keep findings and plain language summaries side by side. The free scan at gold.safeguard.sh/scan gives a readable first result.
Quick check
Should I ever use jargon with executives?
Rarely. If you must, explain it in the same sentence and move on.
Does plain language make me look less expert?
No. Being clear to a wide audience is a mark of expertise.
Last reviewed: 19 October 2026.
