Cybersecurity Glossary
Dealership Cybersecurity Glossary: 40 Terms in Plain English
Phishing, MFA, notification event, Qualified Individual. Here’s what the words in your insurance renewal and vendor proposals mean, and where each one shows up in a dealership.
A dealership cybersecurity glossary defines the attack, defense and compliance terms dealers hear from IT vendors, insurers and the FTC Safeguards Rule, in plain English, with where each one shows up in the store.
Last updated: October 27, 2026
The words you’ll hear from vendors, insurers and the FTC, defined for a dealership.
Security has its own language, and dealers hear it from every direction at once. The insurance renewal asks about MFA and immutable backups, the Safeguards Rule talks about a Qualified Individual and a notification event, and a vendor proposal promises EDR, MDR and a SOC in the same paragraph. It’s a lot. If you’ve ever nodded along in that meeting and looked the word up afterward, this page is for you. It’s the reference that sits behind our dealership cybersecurity services.
Helion Technologies has worked only with automotive and heavy truck dealerships since 1997, so every definition here comes with the part of the store where the term actually turns up, whether that’s the F&I office, the parts counter or the controller’s desk. The goal is modest. When somebody uses one of these words, you’ll know the next question to ask.
Jump to attacks and scams, defenses or compliance terms. Every term has its own link, so you can send a colleague straight to it.
Phishing vs Pharming, Explained
These two get mixed up more than any other pair in this glossary, and the difference changes what stops them. Phishing tricks a person into going somewhere bad. Pharming sends the person somewhere bad on its own, even when they did everything right and typed the address by hand.
That’s why training helps a lot with one and much less with the other. A salesperson can learn to check where a link really goes before clicking it, but nobody at the desk can see that the lender portal they typed in correctly has been quietly redirected to a copy. Our original post on phishing vs pharming has more examples.
One fools the person. One fools the computer.
Phishing
A message, usually an email, that baits someone into clicking a link, opening a file or typing a password into a fake login page. The person makes the mistake, so the person is also the first line of defense.
Stopped by training, email filtering and MFA.
Pharming
The attacker tampers with how web addresses get looked up, on one PC or on a network device, so the right address lands on a fake site. There’s no bait to spot and nobody did anything wrong.
Stopped by patched, monitored devices and secure DNS settings.
Side by side
Commonly Confused Cybersecurity Terms
The pairs dealers ask us to untangle most often. Pick a term to jump to its full entry in the glossary below.
| Terms | The first one | The second one | What it changes for you |
|---|---|---|---|
| Vishing vs smishing | A phone call from a fake bank, automaker or IT support desk. | A text message with a fake link or an urgent request. | Both are beaten the same way, by calling back on a number you already have. |
| EDR vs MDR | Software on each PC and server that spots and blocks attacks. | Analysts who watch that software and respond to it. | A tool nobody watches is an expensive alarm. |
| SOC vs SIEM | The team that monitors security alerts and acts on them. | The system that gathers the logs that team reads. | Ask who reads the logs, not just whether you keep them. |
| Vulnerability scan vs penetration test | An automated search for known weaknesses. | A person trying to break in, with your permission. | The Safeguards Rule wants scans every six months and a test every year. |
| Backup vs disaster recovery | A copy of your data. | The tested plan for running the store from that copy. | Ask how many hours until you can sell a car again. |
| Data breach vs notification event | Any unauthorized access to information. | The kind the Safeguards Rule makes you report. | At 500 or more consumers, the FTC hears from you within 30 days. |
| WISP vs incident response plan | Your whole written security program. | One required part of it, for the bad day. | You need both, and the second lives inside the first. |
| DDoS vs ransomware | Floods a website or connection until nobody can reach it. | Locks your files and demands payment. | One is an outage. The other can take your data with it. |
Definitions checked October 27, 2026 against the FTC Safeguards Rule at 16 CFR Part 314, the FTC’s Safeguards Rule guidance for business and the SEC’s 2023 cybersecurity disclosure rules. This page is general information and isn’t legal advice.
Attacks and scams
Cybersecurity Terms for Attacks Aimed at Dealerships
These are the words you’ll hear after something goes wrong, or better, before it does. Most attacks on a dealership start with a person rather than a server, which is why so many of the terms below turn out to be some flavor of phishing.
Wondering which of these your stores are most exposed to? Request a complimentary IT and cybersecurity assessment.
If one is happening now
Helion’s security support runs 24/7, with live, US-based analysts who monitor your systems and step in the moment they see signs of an attack.
Attacks and scams, A to Z 14 terms
B Business email compromise (BEC)
A criminal gets into a real mailbox, or fakes one convincingly enough to fool a busy office, and then uses it to ask for money in a way that looks like ordinary dealership business. At a dealership that usually looks like a payoff letter with new wire instructions, a vendor invoice with a changed bank account, or an “urgent” note to accounting that seems to come from the controller. Often no malware is involved, so antivirus never sees it. A phone call to a number you already had on file does catch it. It’s simple and it works. Most of these start in Microsoft 365, which is why Microsoft 365 security matters so much.
Watch payoffs, floor plan wires and vendor bank changes.
C Credential stuffing
Attackers take usernames and passwords leaked in some other company’s breach and try them by the thousand against your email, your DMS login and your automaker portals, usually with software that does all the guessing automatically. It works because people reuse passwords. Lots of people. Multi-factor authentication shuts most of it down. Our post don’t be a victim of credential stuffing shows how it plays out.
Reused passwords are the whole trick.
D DDoS attack (distributed denial of service)
A DDoS attack floods a website or an internet connection with junk traffic from thousands of hijacked devices at once, until real visitors can’t get through. Nothing is stolen. The outage is the point, sometimes as a lever for extortion and sometimes as cover for a quieter attack running at the same time. It’s noisy on purpose. For a dealer the exposure is usually the website and each rooftop’s internet line. Our older explainer, what is a DDoS attack, goes further.
An outage, not a theft.
D Deepfake voice
AI can now copy a person’s voice from a short recording, like a dealer principal’s radio spot or a voicemail greeting. The cloned voice then calls the office manager and approves a wire. It sounds exactly right. Treat a voice on its own as unverified for any money request, the same way you’d treat an email. It’s also why our help desk verifies every caller before it resets a password.
A familiar voice isn’t proof.
M Malware
Short for malicious software. It’s the umbrella word for viruses, worms, spyware, keyloggers and ransomware, anything installed to do harm. Some newer kinds never write a file to the disk at all, which is why we wrote about fileless malware on its own, since an antivirus tool that scans files for known signatures has nothing to scan when the attack lives only in memory.
Ransomware is one kind of malware.
P Pharming
Pharming sends you to a fake website even though you typed the right address. The attacker tampers with the system that turns a web address into a server location, either on one PC or on a router, so the bank or lender portal you land on looks real and isn’t. It’s hard to spot. There’s no bait email to catch, which is what separates it from phishing.
No link to click. The address itself is hijacked.
P Phishing
An email built to get someone to click a link, open an attachment or type a password into a fake login page. It’s still the most common way into a dealership, since a store has dozens of inboxes and the people reading them are doing it between customers. It only takes one. Our post on the anatomy of a phishing attack takes one apart line by line.
Every desk gets these, every day.
R Ransomware
Malware that encrypts your files and systems and demands payment for the key. These days the attackers usually copy data out first, so they can also threaten to publish it. In a dealership it can stop the sales floor, the service drive and the parts counter in the same hour. Everything stops. Our guide to auto dealership ransomware covers how attacks start and what recovery takes.
Locks the files, then threatens to leak them.
S Smishing
Phishing by text message. It might be a fake delivery notice, a bank alert, or a message that claims to be the GM asking for gift cards, sent to the same personal phone that reads work email. Texts feel more personal than email, and a phone screen hides where a link really goes. People tap faster on phones.
Phishing that arrives as a text.
S Spear phishing
A phishing email written for one person. It’s personal by design. The details make it believable: a real vendor’s name, a deal number or the dealer principal’s travel dates. Accounting, F&I and the business office get most of it. That’s where the money moves and where the customer files live, so a convincing email that lands there on a busy month-end afternoon can do far more damage than one sent to the lot.
Targeted phishing, researched first.
V Vendor breach (third-party breach)
A breach at a company that holds your data or connects to your systems, like a DMS provider, a credit-check service or a marketing platform. Your customers can be affected even when nothing inside your store was touched. It happens. In 2025, 700Credit mailed breach letters to dealers’ customers on the dealers’ behalf. Our write-up on the Motility DMS breach covers a heavy truck example.
Their breach, your customers.
V Vishing
Voice phishing. A caller poses as the bank, the automaker, the DMS provider or your own IT support and talks someone into reading back a code or resetting a password. They sound very convincing. Help desks get these calls too, which is why a good one verifies the caller before it resets anything. There’s more in what is voice phishing.
Phishing over the phone.
Z Zero-day
A security hole that attackers find and use before the software maker has a fix out, so on that first day the defenders have had zero days to patch. Patching can’t help yet. What helps is software that watches behavior, plus people who notice when a machine starts acting strangely. Once a fix is out, CISA’s Known Exploited Vulnerabilities catalog shows which holes attackers are already using in the wild, and those go to the front of the patch line at every store.
No patch exists yet.
Defenses
Security Terms for What Stops an Attack
This is the vocabulary of IT proposals and cyber insurance applications. When a vendor uses one of these words, ask two things. What does it cover at our stores, and who’s watching it? Those questions sort a working control from a line item.
Seen these in a proposal?
Bring it to a complimentary IT and cybersecurity assessment. We’ll show you which of these your stores already have and which ones only exist on paper.
Defenses, A to Z 15 terms
B Backup and disaster recovery
A backup is a copy of your data. Disaster recovery is the tested plan for running the business again from that copy, and how long it takes. Those aren’t the same thing. Insurers now ask whether at least one copy is offline or immutable, meaning ransomware can’t reach it or change it, because attackers who get in now go looking for the backups first and try to delete them before they lock anything else. Our backup and disaster recovery page covers what a dealer needs.
A backup you’ve never restored is a guess.
E EDR (endpoint detection and response)
Software on every PC and server that watches behavior, not just known virus signatures, and can cut a machine off the network the moment it acts like it’s under attack. It replaced traditional antivirus as the baseline. Antivirus alone isn’t enough now. The catch is that somebody has to answer its alerts, which is where MDR comes in. We cover both in MDR and EDR for dealerships.
The tool. MDR is the people.
E Encryption
Scrambling data so it can’t be read without a key. The rule is specific here. The Safeguards Rule requires dealers to encrypt customer information both in transit over external networks and at rest. If the key is stolen along with the data, the rule treats that data as unencrypted, as our post on encryption keys explains.
Required in transit and at rest.
F Firewall
The device at each rooftop’s internet connection that decides what traffic gets in and out. A modern one also inspects that traffic, blocks known threats and keeps the guest Wi-Fi in the showroom apart from the network that the F&I office and the DMS run on. It’s necessary and nowhere near enough by itself, the point of firewall and antivirus software isn’t enough. Ours are managed as part of dealership network management.
One per rooftop, kept current.
L Least privilege
Giving each person access to what their job needs and nothing more. A porter doesn’t need the F&I folders, and a salesperson doesn’t need admin rights on their PC. Neither does the GM, usually. It limits how far an attacker gets with one stolen login, and the Safeguards Rule asks for exactly this kind of access control. The same rule should cover the AI tools you connect to your data.
One stolen login, one small blast radius.
M MDR (managed detection and response)
A team of security analysts who watch your EDR and other alerts around the clock and act on them, isolating a PC or locking an account before an attack spreads to the next store. Think of it as the people half of the equation. See managed detection and response for dealerships.
Analysts who act on the alerts.
M MFA (multi-factor authentication)
Logging in with two kinds of proof instead of one, usually a password plus a code or a prompt on a phone. It’s worth the hassle. The Safeguards Rule requires it for any individual accessing any information system, unless your Qualified Individual approves an equivalent control in writing, and cyber insurers ask about it on their applications. The right way to do MFA covers the rollout.
Required by the Safeguards Rule.
P Patch management
Installing security updates on PCs, servers, firewalls and software on a schedule, and keeping proof that it happened. Most attacks use holes that already had a fix available. That’s the frustrating part. In a dealership the hard part is the odd machine nobody owns, like the shop’s diagnostic laptop or the old PC behind the parts counter. More in software security patching.
The fix usually existed already.
P Penetration test
A security specialist attacks your network on purpose, with your permission, to find the ways in before a criminal does. It’s a fire drill. The Safeguards Rule calls for one every year unless you run continuous monitoring instead. A good one is led by a person, not just a scanning tool. See penetration testing for dealerships.
Yearly under the Safeguards Rule.
S Security awareness training
Short, regular lessons and simulated phishing emails that teach staff to spot an attack and report it. The Safeguards Rule requires security awareness training for your people. The version that changes behavior keeps going all year and measures who clicks. One video at onboarding doesn’t.
Required, and it works best in small doses.
S SIEM (security information and event management)
A system that pulls logs from firewalls, servers, email and other tools into one place and flags patterns that suggest an attack. It’s how an analyst sees that a strange login at one store and a file change at another are the same incident. That’s the whole idea. The Safeguards Rule’s requirement to monitor and log user activity is often met with one. Our post SIEM to the rescue has the longer version.
Where the logs come together.
S SOC (security operations center)
The team, and often the room, that monitors security alerts and responds to them. A SOC can be in-house, outsourced or shared with your own IT staff, and for most dealerships an in-house SOC isn’t realistic, since covering every night and weekend takes far more analysts than one store or a mid-size group could keep busy. Ours is staffed by live, US-based analysts. Dealer groups with an IT department of their own often share the work, as in co-managed SOC for dealer groups.
The people watching, day and night.
S SPF, DKIM and DMARC
Three email settings that prove which servers may send mail as your dealership’s domain, and tell other mail systems what to do with fakes. Without them, anyone can send an email that looks like it came from your store. Our email security page walks through how they fit together.
Stops strangers sending as your domain.
V Vulnerability scan
An automated check of your systems for known weaknesses, such as missing patches or services exposed to the internet. It finds more, faster, than a penetration test does, but it proves less, because a scanner can only report that a weakness exists while a tester actually shows what an attacker could do with it. The Safeguards Rule calls for vulnerability assessments at least every six months. Here’s how a scan differs from a pen test.
Every six months under the rule.
Z Zero trust
A design approach where no user or device is trusted just because it’s inside the network. Every login and connection gets checked, and people get access only to what their job needs, whether they’re in the main store, at a satellite location or logging in from home on a Sunday night. For a dealer group it’s a direction more than a product, and it usually starts with MFA and tighter access rights. The standard reference is NIST’s SP 800-207. Start small.
Check every time, inside or out.
What Helion Brings to Dealership Cybersecurity
Helion Technologies works only with automotive and heavy truck dealerships, and Erik Nachbahr and Brandon Dorsey both hold the CISSP. We use every word on this page daily. We’d just rather you hear them from us before an incident than in the middle of one. Our help desk is open whenever dealers are open, 7 days a week, and security support runs 24/7.
Compliance terms
Dealership Cybersecurity Terms From the Rules
Nearly all of these come straight from the FTC Safeguards Rule, which applies to a dealership because arranging financing or leases makes it a financial institution. The definitions follow the rule’s own wording at 16 CFR Part 314, put into plain English, and where a term comes from somewhere else, like the SEC or a separate FTC rule, the entry says so.
From words to a to-do list
Our FTC Safeguards Rule checklist turns these terms into the steps your Qualified Individual signs off on.
Compliance terms, A to Z 11 terms
C Customer information
Under the Safeguards Rule, any record with nonpublic personal information about a customer, on paper or in a system, that you or someone working for you handles. At a dealership that’s the credit application, the deal jacket, the copy of the driver’s license and the Social Security number sitting in the DMS. It’s a long list. It’s the thing the whole rule exists to protect.
Paper counts too.
F Form 8-K, Item 1.05
Under rules the SEC adopted in July 2023, a public company discloses a material cybersecurity incident on Form 8-K within four business days of deciding it’s material. When the CDK Global outage hit in June 2024, several publicly traded dealer groups filed 8-Ks about the disruption. A private dealership doesn’t file one. Its lender, its automaker or a vendor it relies on might.
Public companies only. Four business days.
F FTC Safeguards Rule
The federal rule at 16 CFR Part 314 that requires a financial institution, including any dealership that arranges financing or leasing, to run a written information security program. Its updated requirements took effect in June 2023 and its breach notice requirement in May 2024. We break it down in the 9 elements explained, and our FTC Safeguards compliance service runs it for you.
The floor in all 50 states.
G GLBA (Gramm-Leach-Bliley Act)
The 1999 federal law that makes financial institutions protect their customers’ financial information. Car and truck dealers that arrange financing or leases fall under it, and the Safeguards Rule is how the FTC enforces its security side. It’s also why most state privacy laws exempt dealers in some way.
Why a dealer counts as a financial institution.
I Incident response plan
The written plan for the first hours and days after a security event. It names who’s in charge and who gets called, and it says how the store keeps selling and servicing while it’s sorted out. The Safeguards Rule requires one in writing. Keep a printed copy. Start from our incident response plan template, and if it’s happening right now, see incident response services.
Required in writing.
N Notification event
The Safeguards Rule’s term for a breach you have to report. Not every breach qualifies. It means unencrypted customer information was acquired without the customer’s authorization. If it involves at least 500 consumers, the dealer notifies the FTC no later than 30 days after discovering it. The details are in Safeguards Rule breach notification.
500 consumers, 30 days, notice to the FTC.
Q Qualified Individual
The one person the Safeguards Rule makes responsible for overseeing and enforcing your security program. It can be an employee or someone at a service provider, but the dealership stays responsible either way. Choose that person carefully. That person reports to the owners or board in writing at least once a year. More on the Qualified Individual role.
One name, accountable, reporting yearly.
R Red Flags Rule
A separate FTC rule, at 16 CFR Part 681, that requires creditors to run a written identity theft prevention program, and a dealer that arranges financing generally counts. Check with counsel. It’s about spotting warning signs at the desk, like a license that doesn’t match the customer sitting across from you, or a credit report that shows an address the customer has never mentioned. It sits next to the Safeguards Rule, not inside it.
Identity theft, not data security.
R Risk assessment
A written review of where customer information lives, what could go wrong with it and how well your safeguards hold up. The Safeguards Rule says the whole security program has to be based on one, and it gets redone periodically. Our Safeguards risk assessment template gives you the format.
The program is built on it.
S Service provider oversight
The Safeguards Rule makes you choose vendors that can protect customer information, write that duty into their contracts and check on them periodically. Your DMS, CRM, credit and marketing vendors all count. So does IT. When one of them is breached, it’s still your customers’ data and your customers’ phone calls, and the letters may go out under your name even though nothing inside your store was attacked. Our buyer’s guide to cybersecurity vendors lists the questions to ask before you sign.
In the contract, and checked.
W WISP (written information security program)
The documents that describe how your dealership protects customer information, from who can log in to what happens after a breach. It’s the backbone of the Safeguards Rule, and every other term in this section lives somewhere inside it. Every state also has its own breach notice law, and California’s attorney general posts the notices it receives on a public list. Our WISP template for dealerships is a good place to start.
The rule’s central document.
Common Questions
Heard a term that isn’t here?
Bring it to a complimentary IT and cybersecurity assessment. We’ll tell you, in plain English, what it means for your stores.
What’s the difference between phishing and pharming?
What is a DDoS attack?
Does the FTC Safeguards Rule require MFA at dealerships?
Who can be a dealership’s Qualified Individual?
We already have EDR. Do we need MDR too?
When does a dealership have to report a breach to the FTC?
Does a private dealership file an 8-K after a cyberattack?
Knowing the words is the start. Find out which of them apply to your stores today.
Request a Complimentary Assessment →
S Social engineering
The umbrella term for tricking a person instead of breaking a system. Phishing, vishing and smishing all count, and so does the stranger in a polo shirt who walks into the back office saying he’s there to check the network. It’s the reason security awareness training belongs in every serious program.
Aimed at people, not computers.