One of the phrases that I've been noticing more and more -- particularly outside of the security world -- is "cyber attack." For example, in the past week the Chinese cyber security watchdog has claimed China was attacked nearly half a million times last year.
It sounds fantastically sci-fi, and I can see why journalists in particular like it. But "cyber attack" is a really misleading term.
Firstly, one of the features of any other "attack" is that you know when it's happened to you. Obviously there are some "cyber attacks" for which that's the case -- the recent website hacks carried out by Lulz Security and Anonymous for example, or an outbreak of a virus. But probably the most dangerous "cyber attacks" are cases where the victim doesn't even know it's happened -- where someone has covertly infiltrated their IT network and either stolen critical information, or gained access to critical control systems.
In the latter case, of course, there is the potential for a genuine "attack" -- we know from Stuxnet that it's possible to use cyber means to mount real-world attacks. Even then, though, the "cyber attack" phrase is misleading. There could be a significant delay between the initial infiltration and the eventual discernible effect of that infiltration -- indeed, in some cases it could be a delay of several years. But people tend to use "cyber attack" to mean the initial part of that process -- the part that, if it's successful -- the victim won't even feel.
I'd prefer it if we were all talking about "cyber infiltrations". But I suspect we're stuck with "cyber attacks."