Cybersecurity
Cybersecurity is the discipline of protecting systems, networks and data from digital attack — preserving confidentiality, integrity and availability.
Enhance Cybersecurity
Add bot protection to your security strategy
What is Cybersecurity?
Cybersecurity is protecting systems, networks and data from attack. As a single word it covers so much ground that it is nearly useless for deciding anything, which is why the practical discussion is always about a specific threat arriving by a specific route.
The conventional framing is confidentiality, integrity and availability — keeping data private, keeping it correct, keeping the service running. Most real decisions are a trade between those three and the cost of defending them.
The domains, and what each actually defends
| Domain | Defends against | Example control |
|---|---|---|
| Identity | Stolen and guessed credentials | Phishing-resistant MFA |
| Endpoint | Malware, ransomware | Patching, least privilege, tested backups |
| Network | Lateral movement after a foothold | Segmentation, egress control |
| Application | Injection, broken authorisation | Secure development, code review |
| Public surface | Automated abuse of working features | A bot layer, rate limits, proof of work |
| Data | Loss, exposure, over-retention | Encryption, minimisation, deletion schedules |
| People and process | Deception, mistakes, insider risk | Training, separation of duties, a rehearsed incident plan |
Prosopo works in one row of that table. Saying so plainly is more useful than the alternative, because a vendor claiming the whole table is a vendor you cannot evaluate.
The public surface is the unusual one
Every other row involves something being wrong — a vulnerability, a misconfiguration, a person deceived. The public surface involves nothing being wrong. An attacker uses your login, your search, your checkout exactly as designed, only automatically and at volume.
That has a direct consequence: there is no patch, and no signature to match, because no individual request is malicious. The only distinguishing property is whether a person is behind it, which is a question none of the other controls can answer. See bot protection for how that question gets answered.
Where to spend first
For most organisations the honest order, which is not the order vendor marketing suggests:
- Phishing-resistant authentication. Stolen credentials remain the most common way in, and hardware keys or passkeys close it structurally.
- Patching and backups. Tested, offline backups are what decide whether ransomware is an incident or an extinction event.
- Defence of the public surface, if you have forms, logins or APIs strangers can reach.
- Everything else, in the order your own incidents suggest rather than the order a framework lists.
Frameworks such as ISO 27001, SOC 2 and Cyber Essentials are useful for structuring that work and for proving it to customers. They are not the same as being secure, and treating certification as the goal is how organisations end up compliant and breached.