What is a backdoor in cyber security?
In this glossary, a backdoor is a way into a device or network that bypasses the sign-in the owner expects. It can also let someone return later. This is Secordit's plain description of the term, not a quotation from a particular report. This page does not give steps, tools or signs.
By Secordit. Last checked: 10 November 2026.
How it works
- In this glossary, the term means a way into a device or network that bypasses the sign-in the owner expects. It can also let someone return later.
- Related terms such as malware, vulnerability and threat actor are explained on their own pages.
What UK guidance says
The NCSC SparrowDoor malware-analysis report describes that malware as a persistent loader and backdoor. The NCSC Pygmy Goat report is titled as a network-device backdoor and describes backdoor access to an affected device. Both reports are technical. 123
Frequently asked questions
What is a backdoor in cyber security?
In this glossary, it is a way into a device or network that bypasses the sign-in the owner expects. It can also let someone return later.
Where does NCSC use this term?
In technical malware-analysis reports. The SparrowDoor report describes that malware as a persistent loader and backdoor. The Pygmy Goat report is titled as a network-device backdoor. 123
Does this page tell me how to find or use a backdoor?
No. This page explains the term only. It does not give steps, tools, signs or product advice.
News Pulse
Account security, explained by email.
Sources
- NCSC, SparrowDoor malware-analysis report (opens in a new tab). Accessed 10 November 2026 (Europe/London).
- NCSC, Pygmy Goat malware-analysis report (opens in a new tab). Accessed 10 November 2026 (Europe/London).
- NCSC, Malware analysis reports (opens in a new tab). Accessed 10 November 2026 (Europe/London).