In security, safety, compliance, and technology, a lot of words get used as if they mean the same thing. They don’t. Mixing them up is how an organization ends up “compliant” and still exposed, or “certified” and still breached. Over 35 years in this work, I’ve learned to ask what someone means before I agree with them. Here’s a short field guide to the words that get swapped most. These are my definitions, so they are A perspective, not THE perspective. For the full glossary, see the Converged Security Definitions page.
Compliance, Security, and Assurance
Compliance ≠ Security. Compliance means you met a checklist someone else wrote. Security means the thing actually holds up against an attacker. You can pass an audit and still be wide open.
Compliance ≠ Assurance. Compliance is a pass or fail against a standard. Assurance is evidence, plus a named person accountable for how much confidence to place in it.
Audited ≠ Secure. An audit is a snapshot of what was examined, on the day, within the scope it was given.
Certification / Certified (organization) ≠ Secure. A certification says a process was checked. It does not say the next release, the next supplier, or the next employee is safe.
Security, Safety, and Their Cousins
Security ≠ Safety. In my definitions, security is the prevention, detection, and response to a crime or a violation of organizational rules. Safety is the prevention, detection, and response to an accident. Same three verbs, different causes. A lock is security. A handrail is safety.
Safety ≠ Safe. Safety is a discipline. “Safe” is a claim about one specific outcome, and it should always come with the conditions it was tested under.
Security ≠ Secure. Security is a field and a set of practices. Secure is an outcome, and it does not stay true on its own. It expires the moment something changes.
Church Security ≠ Church Safety. Locks, cameras, and access control are security. Emergency plans, first aid, and clear exits are safety. Most congregations need both programs, and few have both.
Cyber, Information, and Physical
Cyber Security ≠ Information Security. Cyber covers digital assets. Information security covers information in every form, including paper, conversation, on a computer, in the cloud, and the filing cabinet.
Physical Security ≠ Personnel Security. Physical security is about places and things. Personnel security is about protecting people no matter where they are. (assuming they are under a covering of your organization at the time).
Insider (Threat) ≠ Employees Only. Suppliers, former staff, and anyone holding a valid credential can be an insider. Your org chart does not show all of them.
Enterprise-wide ≠ Large corporations. Enterprise-wide means the program covers the whole organization. A ten-person firm can be enterprise-wide. A two-thousand-person firm can have a program that covers none of it.
Vulnerabilities, Patches, and Incidents
Patch Management ≠ Vulnerability Management. Patching is one way to fix a weakness. Vulnerability management finds, ranks, fixes, accepts, and tracks weaknesses. Patching is one tool in that program.
Vulnerability Management ≠ Only Cyber. Weaknesses also live in locks, procedures, staffing, and habits.
Incident Management ≠ Only Cyber. An incident can be a fire, a flood, a theft, a medical emergency, or a threatening phone call.
Risk, Diligence, and Continuity
Risk Management ≠ Security Management. Security management is one input to risk management. Risk management also weighs finance, operations, reputation, and legal exposure.
Due Diligence ≠ Risk Assessment. Due diligence asks what is true about a party before you commit. A risk assessment asks what could go wrong, and how badly.
Investigations ≠ Due Diligence. Investigations look into something that already happened. Due diligence looks into someone before you do business with them.
Business Continuity ≠ Disaster Recovery. Continuity keeps the business running during a disruption. Recovery gets systems back afterward. Recovery is a part of continuity, not the whole of it.
Supply Chain ≠ Purchasing. Purchasing is the transaction. The supply chain is everyone and everything upstream of it: suppliers, their suppliers, their software, and their access to your systems/buildings/people.
Executive Protection ≠ Personnel Security. Executive protection is a protective service for specific individuals. Personnel security is the screening, access, protection program for all personnel (generally the public is not included in “personnel”)
Acronyms That Will Bite You
SOC ≠ SOC. The acronym can mean a Security Operations Center or a SOC 2 report. They are very different things. If you are not sure which one someone means, ask. (You’ll know if you know.)
NOC ≠ SOC. A Network Operations Center keeps the network up. A Security Operations Center watches for attacks (sometimes physical, sometimes cyber) and responds to them. Same acronym family, different job.
MSP ≠ MSSP ≠ SOC. A managed service provider runs your IT. A managed security service provider runs (part of) your security. A SOC is a function, which an MSSP may or may not provide or you may manage your SOC inside.
The New Words
AI ≠ Human Experience. A model can summarize a thousand incident reports. It has never been the person who took the call at 3 a.m.
Vibe Coding ≠ Secure Coding. Vibe coding is describing what you want and accepting what comes back. Secure coding includes threat modeling, input validation, review, and testing. Both can produce code that runs. Only one is built to survive an attacker.
Zero Trust ≠ An Operational Business. Zero Trust is a design principle: verify every request, and assume something is already wrong. It is not a product you buy, and it is not a finished state you arrive at. (Okay, that one was funny.)
Why This Matters
Words set expectations, and expectations decide what gets bought, signed, and trusted. The next time a supplier promises you “secure,” ask which definition they mean. If they can’t tell you, that is your first finding. (This is ONE guy’s perspective. Check mine against yours.)