Bishop Fox named “Leader” in 2024 GigaOm Radar for Attack Surface Management. Read the Report ›

Version 2.0

Cybersecurity Style Guide



Universal 2nd Factor.

Ex: a U2F device, U2F authentication


A Linux distribution. Pronounced as “oo-boon-too.”



User Datagram Protocol. A faster alternative to TCP that can tolerate some loss of data.



Unified Diagnostic Services. A communication protocol.


Universal Greeting Time. On IRC, it’s always morning when you log on and always night when you log off. Informal.

UI, UIs (n.)

User interface. Pronounced as letters. Spell out on first use when writing for a non-technical audience.

UMTS (n.)

Universal Mobile Telecommunications System. Do not spell out.

uncanny valley (n.)

The disturbing nightmare gap between semi-realistic artificial faces and actual living humans. Informal.

uncredentialed (adj.)

Describes a person who lacks proper credentials. When discussing authentication, we prefer to use unauthenticated.

Unicode Consortium

A nonprofit that decides the internet standards for emoji and Unicode.


unicorn (n.)

Corporate jargon for a successful startup. Informal.


A fictional, planet-eating robot from the Transformers universe. Voiced by Orson Welles in the 1986 movie.

units of measurement

Pay attention to unit capitalization (GB, Gb, GiB). Keep units singular, as in 500TB. Don’t put a space between the number and the unit for things like MB and GHz. Do use a space for some units like dpi, fps, and ms. Use the International System of Units (SI) for further guidance.

Unix or UNIX

An operating system. Not an acronym. Pronounced as “you-nicks.”

unpickling (n.), unpickle (v.)

In Python, this is the process of taking something out of serialization.

unprivileged (adj.)

Describes an authenticated user with no permissions. Avoid using this term to describe an unauthenticated user; consider instead if anonymous, guest, or unregistered is more accurate. To avoid ambiguity, specify the name of the role or any permissions involved on first mention.


unremediated (adj.)

We prefer to write that “the issue was not remediated” to avoid implying that a problem was solved and then unsolved.


unsanitized (adj.)

Means that security checks have not been performed. Typically pertains to user-supplied data. “Sanitized” data should be safe for an application to ingest, whereas unsanitized data may not be.

unserialize (v.), unserialized (adj.)

We prefer to use deserialize. For the PHP function, use tech font, as in unserialize().


A tool that predicts random numbers from insecure algorithms.

unvalidated vs. invalidated

Invalidated data has been checked and deemed invalid. Unvalidated data has not been checked at all.


UPC, UPCs (n.)

Universal Product Code. A common type of barcode. Pronounced as letters. Do not spell out.

UPN, UPNs (n.)

User principal name. Used in Active Directory. Spell out on first use.



Universal Plug and Play. A set of networking protocols for device-to-device communication. Spell out on first use.

uppercase (adj. or v.)

Better to write “put in uppercase” but if needed, “uppercased” is OK.

UPS, UPSes (n.)

Uninterruptible power supply. Spell out on first use to avoid confusion with the shipping company United Parcel Service.

up-to-date (adj.), up to date

Ex: The system is powered by up-to-date software. The systems are up to date.


upvote (v. or n.)

Term used to approve posts on Reddit. Analogous to a Facebook “like.”

URI, URIs (n.)

Uniform/Universal Resource Identifier. Both URLs and URNs are subsets of URIs. Use the tech font when writing them out. URI is pronounced as letters.

URL, URLs (n.)

Uniform/Universal Resource Locator. Use the tech font for URLs (including IPv6). Avoid starting sentences with URLs. Format variable segments in bold color, as in[variable]. If the URLs are meant to be clickable links, underline in the normal font and color in blue. URL is pronounced as letters or, more rarely, as “earl.” Do not spell out.

URL encoding (n.), URL-encoded (adj.)

A specific kind of encoding used by browsers for characters outside the ASCII set and certain other characters (e.g., spaces and ampersands).



A Microsoft application.

URL shortener, URL-shortening (n.)

Tool used to abbreviate lengthy URLs. Shortened URLs can hide the true identity of a site.

URN, URNs (n.)

Uniform/Universal Resource Name. Pronounced as letters.


USB, USBs (n.), USB 3.0, USB-C

Universal Serial Bus. Pronounced as letters. Do not spell out.

USB drive (n.)

A storage device that connects via USB. A thumb drive is a small form-factor USB drive. A flash drive is any drive with flash memory (solid state/NAND or USB).

USB On-The-Go (OTG)

A specification that allows a USB device to act as a host when connecting another USB device. Spell out OTG on first use.


USB Rubber Ducky

A keyboard HID that automates keystrokes. Rubber Ducky is OK on second use.


USDZ, .usdz file

Universal Scene Description Optimized. A file format for AR.


use after free (n.), use-after-free (adj.)

A vulnerability relating to how memory is used by a program.



A bulletin board system that preceded the modern internet and still exists.


username (n.)

A user’s login ID. Do not use this term to refer to a user’s IRL name, such as “John Smith.” Write usernames in the tech font, as in admin or Zero Cool.


A Unicode character encoding. Pronounced as letters. (Don’t pronounce the dash.)

UUID, UUIDs (n.)

Universally unique identifier. Pronounced as letters.


UX (n.)

User experience. Pronounced as letters or the whole phrase. Spell out on first use in public-facing documents.


This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.