Why cybersecurity needs a shared vocabulary: notes from my PhD
Cybersecurity terms are used inconsistently across the sector, and that slows everyone down. Here is what a systematic review of cybersecurity ontologies taught me, and where my PhD research goes next.
On this page
Every organisation now needs a cybersecurity framework that it can plan, implement and sustain. That work depends on communication: between cybersecurity experts, between supply chain partners, and with customers. And communication depends on words meaning the same thing to everyone involved.
In cybersecurity, they often do not.
A field with a terminology problem
Cybersecurity is a complex area with a very involved terminology. It spans many security mechanisms, which provide security services, which in turn thwart attacks and protect data and other resources. Across the sector, the same terms are used inconsistently and ambiguously, and this makes it harder for professionals to understand one another.
That observation is the starting point of my PhD research.
What the systematic review found
A key step in my PhD research was a systematic literature review of cybersecurity ontology studies, published in Procedia Computer Science with my co-authors Ljiljana Brankovic, David Paul and Cesar Sanin. An ontology, in this sense, is a formal and shared description of the concepts in a domain and the relationships between them.
We reviewed the most significant existing studies using a refined search strategy, careful data management and continuous evaluation. The review identified clear knowledge gaps and a need for a new cybersecurity ontology that focuses on two things:
- mapping standard terms, so that the vocabulary of different standards and frameworks can be lined up, and
- identifying semantic equivalences, so that existing ontologies can be reused and connected rather than replaced.
From review to prototype
The next step was to build something. The review pointed to a chain of knowledge that links security services, security mechanisms, attacks, vulnerabilities, attackers and assets. In 2026 we published a prototype platform built around that chain in the Companion Proceedings of the ACM Web Conference: a wiki-style, homonym-aware ontology that experts can keep improving together. I describe it in more detail in a separate research post.
What I have learned so far
A systematic review is slow, careful work, and it pays off: it turns a vague sense that “the terminology is a mess” into a precise list of gaps that a new contribution can address. I will use this section of the blog to share how the research develops from here.
Sources and further reading
- A Systematic Literature Review on Cybersecurity Ontology, Procedia Computer Science 270 (KES 2025), pp. 3598-3607
- Bridging the Semantic Gap: A Homonym-Aware Ontology Platform for Cybersecurity Interoperability, Companion Proceedings of the ACM Web Conference 2026, pp. 242-250