Cybersecurity is the work of keeping things you value safe from people who should not have them, in the digital places where those things live. That is the whole field. Everything else in this course is a detail of one of three questions: what are we protecting, from whom, and how do we know it is working.
This lesson gives you the vocabulary for those questions. Nothing here needs a computer.
Start with what you value
Security begins with an asset: anything worth protecting. It helps to list them, because people tend to guard the wrong things.
- A photo library, a password manager, an email account.
- A company's customer database, its source code, its website.
- A laptop itself, since whoever controls it controls everything on it.
- Less obviously: an API key, a login session, or a developer's ability to push code. These are not valuable on their own. They are valuable because they open the things above.
If you cannot say what you are protecting, you cannot say whether you are protecting it. Most security failures are not clever attacks. They are an asset nobody realised was there.
The three goals
Almost every control in security serves one of three goals. Together they are called the CIA triad.
Confidentiality means only the right people can see it. A leaked customer list breaks confidentiality. Passwords, encryption and access rules protect it.
Integrity means it has not been changed without permission. If an attacker edits the account number on an invoice, nothing was stolen and nothing was deleted, but the data can no longer be trusted. Checksums, signatures and audit logs protect it.
Availability means it works when you need it. Ransomware attacks availability: your files are still there, but you cannot open them. So does a flood of traffic that knocks a website offline. Backups and spare capacity protect it.
The goals pull against each other. The most confidential computer is one that is switched off and locked in a vault, and it has no availability at all. Security is choosing the right balance for each asset, not maximising one letter.
A hospital's records system is down for six hours, but nothing was copied or altered. Which goal failed?
Availability. The data stayed private and unchanged, but staff could not use it. For a hospital this can be the most serious failure of the three.
Who we protect it from
The people (or programs) attacking a system are called . They differ in what they want, and that decides what defense makes sense.
| Actor | Usually wants | Typical approach |
|---|---|---|
| Criminal group | Money | Ransomware, stolen logins, fraud, run at scale against whoever is exposed |
| Targeted attacker | One organisation's secrets | Patient, specific, often starts with a single employee |
| Insider | Varies: grievance, profit, or no intent at all | Already has legitimate access |
| Opportunist | Whatever is easy | Scans the internet for anything left open |
Notice that the last row needs no skill. A great deal of real-world harm comes from automated scanning that finds machines nobody patched, not from a genius aimed at you.
An attacker can also be a mistake. A person pasting a secret into a public chat, or a program deleting the wrong folder, harms the same three goals. Later in this course you will see AI agents cause exactly this kind of harm with no malice involved.
Weaknesses, attacks and incidents
Three words get mixed up, and the difference matters:
- A vulnerability is a weakness: a door that can be opened by someone who should not. It exists whether or not anyone notices.
- An attack is someone using a weakness, or a trick, to reach an asset.
- An incident is when an attack succeeds, or may have, and a response is needed.
Vulnerabilities are catalogued publicly. Each one gets a CVE number, so that everyone can talk about the same flaw. You will learn to read these records in level 1. For now, see one in action.
A real case: one flaw, a global outbreak
In March 2017 Microsoft released a fix for a flaw in SMBv1, an old file-sharing feature of Windows. The flaw let a remote attacker run code on a machine with no password and no click from the user. It is recorded as:
Read it through the three goals. Availability failed first, since hospitals and businesses lost the use of their computers. Confidentiality and integrity were exposed too, because the attacker had control of the machines.
Now read it through the three questions. The asset was ordinary office computers. The actor was a criminal operation looking for anything reachable. The vulnerability was known, and the fix had been available for two months. The machines that were hit were the ones nobody had updated.
That last point is the most useful lesson in this whole course, and it is not technical. A lot of security is boring maintenance done on time.
Try it
On paper, write down five things you would be upset to lose or have exposed. For each one, answer:
- Which of the three goals matters most for it?
- Who, realistically, might want it?
- What is the easiest way someone could get it today?
Question 3 is the start of a threat model, which is the subject of level 1. Keep your list; you will use it again.
How AI changes this
The three goals and the cast of threat actors stay the same. What AI changes is speed, cost and a new kind of asset.
Attackers get cheaper labour. Beam's write-up of AI-led attacks in October 2026 reports ransomware affiliates running intrusions through a coding agent with commercial models, with the AI doing planning, command writing, debugging and data triage. The same write-up notes that humans still chose targets and approved key steps. So the honest summary is: AI makes an attacker faster and lets a less skilled one do more, but the goal (steal, alter, or take offline) has not changed.
Defenders get a second pair of eyes. AI can help sort a flood of alerts, summarise a log, or explain an unfamiliar advisory. It is a helper for the person doing the work, not a replacement for knowing what you are protecting.
Agents become something to protect, and something to protect from. An AI agent that works on your computer holds access to your files and accounts. Run the three goals on it: can it read things it should not (confidentiality), change things without you noticing (integrity), or delete or lock up your work (availability)? The new part is that an agent can be steered by text it reads, a risk we call . The old part is that you are, again, deciding what to trust with what.
Check yourself
An attacker changes the destination account on a payment but takes no data. Which goal was broken?
Integrity. Nothing was disclosed or taken offline, but the information was altered without permission.
Is a vulnerability the same thing as an attack?
No. A vulnerability is a weakness that exists whether or not anyone uses it. An attack is someone using it. Many vulnerabilities are never attacked, and many attacks need no vulnerability at all, such as tricking a person into handing over a password.
Why did patching matter so much in the WannaCry case?
The fix existed two months before the outbreak. The attack only worked on machines that had not applied it, so applying updates would have stopped it.
Next
You cannot protect a computer you do not understand. In the next lesson we open one up and follow a program from storage to the screen.