Security & Threat Protection Networking Cabling & Physical Infrastructure — Layer 1 Wireless Voice & Communications Cameras, Access & Life Safety Audio & AV Cloud, Identity & Continuity Artificial Intelligence — Concepts AI Assistants — Choosing & Using Them AI & the Modern Web
Security & Threat Protection
Antivirus (AV)
Software on each computer that checks files and programs against a list of known threats ("signatures") and a few simple behavior rules, then blocks or quarantines matches. It is the floor of endpoint protection: it stops common, already-known malware cheaply. Its limit is that brand-new or hand-crafted attacks have no signature yet, which is why businesses pair it with EDR.
EDR — Endpoint Detection & Response
A step beyond antivirus. EDR software on each computer keeps a running record of what happens on it: which programs start, what they connect to, and which files they change. It looks for suspicious patterns of behavior rather than known files, alerts when something looks wrong, and lets a responder isolate the machine from the network and undo changes. It catches attacks that use legitimate tools or new malware that antivirus has never seen.
MDR — Managed Detection & Response
EDR plus people. A service where trained security analysts watch your detections around the clock, decide which alerts are real, hunt for attackers who are hiding quietly, and either guide your team through the response or take the response actions themselves, such as isolating a computer or disabling an account. It matters because most small and mid-sized businesses can't staff a 24-hour security team, and attacks often start at night or on weekends.
XDR — Extended Detection & Response
Detection and response that looks across more than individual computers. XDR combines signals from endpoints, user sign-ins, email, cloud apps, and the network into one investigation, so a phishing email, the account it compromised, and the laptop it infected show up as one connected incident instead of three separate alerts. The value is faster, more complete investigations.
SIEM — Security Information & Event Management
A system that collects logs (records of sign-ins, firewall events, server activity and more) from across the business into one place, links related events together, and raises alerts when a pattern looks like an attack. It also keeps logs for the period that regulations or insurers require, and lets investigators search back in time after an incident.
SOC — Security Operations Center
The people, processes, and tools that monitor security alerts and respond to incidents, usually 24×7. Large enterprises build their own; most smaller businesses get one as a service from a provider. A SOC is what turns alerts from EDR, XDR, or a SIEM into action.
Firewall / NGFW (Next-Generation Firewall)
The checkpoint between networks, such as between your office and the internet. A basic firewall allows or blocks traffic by address and port number. A next-generation firewall (NGFW) also identifies the application and the user behind the traffic, inspects content for threats, filters risky websites, and often provides VPN access. It matters because it is the main control point for what can enter and leave your network.
Zero Trust
A security approach summed up as "never trust, always verify." Instead of trusting anyone who is inside the office network, every user and device must prove who it is and that it is healthy (patched, encrypted, managed) before it can reach each application, and gets access only to what its job needs. Access is re-checked continuously. It matters because remote work and cloud apps mean there is no longer one building wall to defend.
MFA — Multi-Factor Authentication
Requiring a second proof of identity on top of the password, such as a code or approval prompt in a phone app, or a physical security key. A stolen password alone is then not enough to get in. It is one of the most effective protections against account takeover; phishing-resistant methods such as security keys and passkeys are stronger than text-message codes, which can be intercepted.[1]
Ransomware
Malicious software that locks (encrypts) your files and systems, and today often copies your data out first, then demands payment to unlock it or to keep the stolen data from being published. It usually gets in through stolen passwords, phishing, or unpatched remote-access equipment. Defense is layered: MFA, EDR or MDR, separated (segmented) networks, prompt patching, and backups that can't be altered and are tested by actually restoring from them.
Phishing
Fake messages, usually email but also text messages and phone calls, that pretend to come from someone you trust in order to steal passwords, trick you into paying a fake invoice, or get you to open malware. It is one of the most common ways attacks begin. It is countered with email filtering, MFA, verifying payment changes by phone, and regular staff training.
DMARC (Domain-based Message Authentication, Reporting and Conformance) / SPF (Sender Policy Framework) / DKIM (DomainKeys Identified Mail)
Three settings published in your domain's DNS that prove email really came from you. SPF lists which servers are allowed to send mail for your domain. DKIM adds a digital signature to each message so receivers can confirm it wasn't altered. DMARC tells receiving mail systems what to do when a message fails those checks (deliver, send to spam, or reject) and sends you reports. Together they stop criminals from sending email that appears to come from your domain, and major mailbox providers now expect them from bulk senders. Not to be confused with a demarc (demarcation point), where a telecom provider's service enters a building.[2]
Penetration Test
An authorized, simulated attack on your systems by security testers, done with your written permission. Where a vulnerability scan only lists possible weaknesses, a penetration test tries to actually exploit them to show which ones an attacker could really use and how far they could get. Many insurers, customers, and regulations ask for one regularly.
FTC (Federal Trade Commission) Safeguards Rule
A U.S. Federal Trade Commission rule requiring businesses that handle consumers' financial information, including auto dealerships that arrange financing, to run a written information security program. Requirements include a named person in charge, a risk assessment, MFA, encryption of customer data, monitoring, staff training, oversight of service providers, an incident response plan, and notifying the FTC of a breach affecting 500 or more consumers.[3][4]
Passkey
A sign-in method that replaces the password with a cryptographic key pair stored on your phone, computer, or security key and unlocked with your fingerprint, face, or PIN. The website keeps only the public half, so there is no password to steal, and a passkey works only on the real site it was created for, which makes it resistant to phishing.
BEC (Business Email Compromise)
A scam where a criminal takes over or imitates a trusted email account, such as an executive, vendor, or title company, and asks for a wire transfer, a change to payment details, or sensitive data. There is often no malware involved, so filters can miss it. The best defense is a process: confirm any payment change by calling a known phone number, plus MFA and email authentication.
Patch Management
The routine of finding, testing, and installing software updates (patches) for operating systems, applications, and devices such as firewalls and cameras. Vendors release patches to fix security holes, and attackers quickly target systems that haven't installed them. A good program tracks every device, applies critical patches within days, and reports what is still missing.
Least Privilege
Giving every person, device, and program only the access it needs to do its job, and nothing more. Everyday work is done from standard accounts, while administrator rights are separate and used only when needed. If an account is compromised, the attacker can reach far less.
Security Awareness Training
Regular, short training that teaches staff to recognize phishing, fake invoices, and suspicious requests, often paired with simulated phishing emails to measure progress. It turns employees into an early-warning system rather than the easiest way in.
PIN (Personal Identification Number)
A short numeric code a person enters to prove who they are or to unlock something: a door keypad, a phone, a payment card, or a passkey on a computer. A PIN on its own is weak because it can be watched or guessed, so it is usually one factor combined with something you have, such as a badge or a device. Many systems lock out after a few wrong tries to stop guessing.
Networking
Estate (IP Estate)
The complete set of connected systems that run a business over its network: cabling, switches, Wi-Fi, phones, cameras, door access, audio-visual, building controls, and the computers and cloud services they connect to. Treating them as one system matters because they depend on each other: a cabling fault can show up as a dropped call, and a weak Wi-Fi design can show up as cameras that stutter. Planning, securing, and documenting the estate as a whole avoids gaps between separate contractors.
OSI (Open Systems Interconnection) Model — the 7 Layers
A shared map that splits networking into seven layers, each relying on the one below it: 1 Physical (cables, fiber, radio signals) · 2 Data Link (switches, MAC addresses, VLANs) · 3 Network (routers, IP addresses) · 4 Transport (TCP and UDP, port numbers) · 5 Session · 6 Presentation (formats, encryption) · 7 Application (web, DNS, email). Engineers use it to troubleshoot from the bottom up: a damaged cable at Layer 1 can show up as a "website won't load" complaint at Layer 7.
Layer 2 vs Layer 3
Layer 2 moves data (frames) between devices on the same local network using each device's hardware MAC address; that is switching. Layer 3 moves data (packets) between different networks using IP addresses; that is routing. A Layer 3 switch does both: it switches traffic within each VLAN at full speed and routes between VLANs internally, without sending that traffic out to a separate router.
Switch
The device that connects wired equipment in a building (computers, phones, cameras, access points). It learns which device is on which port and sends each piece of traffic only to the port that needs it, rather than to everyone. Unmanaged switches simply plug and play; managed switches add VLANs, Power over Ethernet, traffic priority, monitoring, and port security, which business networks rely on.
Router
The device that connects separate networks, such as your office network to the internet or one site to another, and decides where each packet should go next based on its destination IP address. At the edge of a small office, the router is often combined with the firewall in one appliance.
VLAN — Virtual LAN
A way to divide one physical network into separate logical networks. Each port or wireless network is tagged as belonging to a VLAN (for example cameras, phones, guests), and devices in one VLAN can't reach another unless a router or firewall rule allows it. That limits how far an infection or intruder can spread, keeps guest traffic away from business systems, and makes it easy to prioritize voice.
IP (Internet Protocol) Address / DHCP (Dynamic Host Configuration Protocol) / DNS (Domain Name System)
An IP address is the number that identifies a device on a network, like a street address for data. DHCP is the service that hands out those addresses automatically when a device connects, along with the settings it needs to reach the internet. DNS is the internet's directory: it translates names like xotavo.com into the IP addresses computers use. When "the internet is down," the cause is often a DNS problem rather than the connection itself.
NAT — Network Address Translation
A router function that lets many devices share one public internet address. As traffic leaves, the router swaps each device's private address for the shared public one and keeps a table so replies get back to the right device. That's why an office of two hundred devices appears as one address from outside. NAT also means outside systems can't start a connection to inside devices unless a rule specifically allows it.
PoE — Power over Ethernet
Sending electrical power over the same network cable that carries data, supplied by a PoE-capable switch or a small inline injector. It is how desk phones, cameras, Wi-Fi access points, and door controllers run without a separate electrical outlet at each location. Standards set how much power each port can supply (from about 15 to about 90 watts), so the switch's total power budget must be sized to the devices it feeds.[5]
SD-WAN (Software-Defined Wide Area Network)
Software-defined wide-area networking. An SD-WAN device connects a site through two or more internet links (fiber, cable, cellular, satellite), continuously measures the quality of each, and sends each type of traffic over the best path, such as voice on the cleanest link and backups on the cheapest. If one link fails, traffic moves to another automatically. Policy is managed centrally for all sites, often replacing costly private circuits.
VPN — Virtual Private Network
An encrypted tunnel across the public internet. A remote-access VPN lets a worker's laptop connect to the office network as if it were in the building; a site-to-site VPN permanently links two offices. The weakness is that a connected user often gets broad access to the whole network, which is why many businesses are moving user access to Zero Trust models that grant access one application at a time.
QoS — Quality of Service
Rules that tell the network which traffic goes first when a link is busy. Voice and video packets are marked as high priority and sent ahead of file downloads and updates, so calls stay clear even when the connection is full. QoS only helps where the network equipment honors the markings, which is why it is set up end to end on switches, firewalls, and the internet edge.
Latency / Bandwidth / Jitter
Bandwidth is how much data a connection can carry per second (the width of the pipe). Latency is how long a packet takes to arrive (the length of the trip), measured in milliseconds. Jitter is how much that delay varies from packet to packet. Large downloads need bandwidth; voice and video calls need low, steady latency and little jitter, so a fast connection can still produce choppy calls.
DNS Filtering
A security service that checks every website lookup (DNS request) against lists of known malicious, phishing, or unwanted categories, and refuses to resolve the bad ones. Because it acts before any connection is made, it blocks threats for every device that uses it, including phones and IoT devices without security software.
Network Access Control (802.1X)
A way to require every device to prove who it is before it is allowed onto the wired or wireless network. The switch or access point asks for credentials or a certificate, checks them with an authentication server, and then places the device on the right VLAN, or blocks it. An unknown laptop plugged into a lobby jack gets nowhere.
Static vs Dynamic IP Address
A dynamic IP address is assigned automatically and can change over time; a static IP address is fixed. Internal printers, servers, and cameras usually get fixed or reserved addresses so other systems can always find them. A static public address from your internet provider is often needed to host a VPN, server, or remote camera access reliably.
IPv6 (Internet Protocol version 6)
The newer version of the Internet Protocol, created because the original IPv4 system ran short of addresses. IPv6 addresses are much longer (written in hexadecimal, like 2001:db8::1) and provide an almost unlimited supply. Most networks now run both versions side by side, so firewalls and security policies need to cover both.
ISP (Internet Service Provider)
The company that connects your building to the internet, over fiber, cable, copper, fixed wireless, cellular, or satellite. The ISP's equipment and responsibility end at the demarc; everything past that point (routers, firewalls, in-building cabling) is yours. Businesses often use two ISPs over different physical paths so an outage on one doesn't take the office offline.
MAC (Media Access Control) Address
A hardware identifier built into every network interface (wired or wireless), written as six pairs of characters such as 3C:22:FB:1A:09:7E. Switches use MAC addresses to deliver traffic within the local network (Layer 2), while IP addresses are used to reach other networks. Because MAC addresses can be copied or randomized by phones for privacy, they are useful for tracking devices but not strong proof of identity.
TCP (Transmission Control Protocol) / UDP (User Datagram Protocol)
The two main ways data is carried between applications (OSI Layer 4). TCP sets up a connection, numbers every piece of data, and resends anything lost, so web pages and files arrive complete and in order. UDP just sends packets without checking, which is faster and avoids delay, so live voice, video, and DNS lookups use it; a lost packet is skipped rather than waited for. Both use port numbers to tell services apart, which is what firewall rules refer to.
IPv4 (Internet Protocol version 4)
The original and still most widely used internet addressing system. An IPv4 address is four numbers from 0 to 255 separated by dots, such as 192.168.1.10, which allows about 4.3 billion addresses in total, far fewer than the number of connected devices today. That shortage is why NAT and private address ranges are used inside networks, and why IPv6 was created.
IoT (Internet of Things)
Everyday devices that connect to a network: cameras, door controllers, thermostats, sensors, smart televisions, printers, and building systems. They are often managed less carefully than computers, run outdated software, and can't host security tools, so IoT devices are usually placed on their own VLAN with tight firewall rules and kept updated.
Gbps / Mbps (Gigabits / Megabits per Second)
Units of data speed. One Mbps is one million bits per second; one Gbps is one billion, or 1,000 Mbps. Internet plans and network links are rated this way. Note bits, not bytes: a 1 Gbps link moves at most about 125 megabytes of file data per second, and real-world throughput is lower after overhead.
Cabling & Physical Infrastructure — Layer 1
Structured Cabling
A building's organized, standards-based wiring system: horizontal cables from each outlet back to a telecom room, backbone cables linking telecom rooms and floors, and patch panels and racks where everything is labeled and terminated. Because it is designed as a whole and documented, moves and additions are quick and faults are easy to trace, instead of cables being added one emergency at a time.
Cat6 / Cat6A (Category 6 / Category 6 Augmented)
Categories of twisted-pair copper network cable. Cat6 carries 1 Gbps to the full 100-meter channel length and 10 Gbps only on shorter runs (roughly 37–55 meters, depending on how many cables are bundled together). Cat6A carries 10 Gbps over the full 100 meters and resists interference from neighboring cables better. Cat6A is the common choice for new installs, especially to Wi-Fi access points whose uplinks run faster than 1 Gbps.[6]
Single-mode vs Multimode Fiber
Network cabling that carries data as light through glass, so it is immune to electrical interference and can't be tapped as easily as copper. Multimode fiber has a wider core and uses lower-cost optics; it covers distances up to a few hundred meters, such as within a building or across a small campus. Single-mode fiber has a very narrow core and can carry signals for many kilometers, so it is used between buildings and by carriers. Fiber is the usual backbone choice in industrial plants and wherever runs exceed copper's 100-meter limit.
Plenum vs Riser Cable
Fire ratings printed on the cable jacket. Plenum-rated cable is required by fire code in air-handling spaces (such as a ceiling used as an air return) because it resists spreading flame and produces less smoke when it burns. Riser-rated cable is for vertical runs between floors and is designed to keep fire from traveling up the shaft. Using the wrong rating can fail inspection and must be replaced.
Patch Panel
A panel of numbered ports in a rack where the permanent building cables end. Short patch cords then connect each port to the switch. Equipment can be moved and circuits changed by swapping a patch cord, without touching the cable in the walls, and every port is labeled to match a wall outlet, which makes troubleshooting fast.
Cable Certification
Testing every installed cable link with a calibrated certification tester against the category standard (for example Cat6A), measuring length, wiring, signal loss, and crosstalk, and saving a pass/fail report for each link. It proves the cabling will perform as specified, documents the work for the owner, and is normally required before a manufacturer will grant a long-term system warranty.
Demarc (Demarcation Point)
The point where the service provider's responsibility ends and the building owner's or tenant's begins: typically the provider's termination equipment where an internet or phone circuit enters the building. That equipment can sit in any closet, not necessarily the MDF. The provider maintains everything up to and including the demarc; everything past it (inside cabling, network equipment, and any extension) belongs to the owner or tenant. When the demarc is far from the equipment that needs the service, an extended demarc (in-building cabling, and sometimes equipment, that carries the circuit from the demarc to the MDF or suite) is installed; it is usually the building's or tenant's responsibility unless the provider agrees in writing to build it. Clear labeling at the demarc speeds up every outage call. Not to be confused with DMARC, the email-authentication setting.
MDF (Main Distribution Frame) / IDF (Intermediate Distribution Frame)
The MDF (main distribution frame) is a building's core network room or closet: it houses the core switching and routing equipment and is the hub where all backbone cabling meets. IDFs (intermediate distribution frames) are secondary closets that serve a particular floor, wing, or area; each holds the switches for the outlets nearby and connects back to the MDF over backbone cabling, usually fiber. The internet provider's service does not have to arrive in the MDF. It enters at the demarc, which can be in any closet; if it isn't in the MDF, in-building cabling or equipment (an extended demarc) carries the service from there to the MDF. See Demarc (Demarcation Point).
Optical Transceiver / SFP (Small Form-factor Pluggable)
A small plug-in module that converts electrical network signals to light and back, so a switch port can connect to fiber. Different modules are made for multimode or single-mode fiber, different distances, and different speeds, and both ends of a link must match.
UPS (Uninterruptible Power Supply)
A battery unit that sits between equipment and the wall outlet and keeps it running through power outages, dips, and surges. In a network closet, the UPS keeps switches, firewalls, and PoE-powered phones, cameras, and access points working long enough to ride out short outages or shut down cleanly. It is sized by the load and the runtime needed, its batteries need replacing every few years, and a network-connected UPS can alert staff when it switches to battery.
Wireless
AP (Access Point)
The radio that connects Wi-Fi devices to the wired network. Each access point covers an area and is cabled back to a switch. Business-grade APs are managed centrally from one console, handle many simultaneous users, support several network names, and are placed according to a site survey rather than guesswork.
Wi-Fi 6 / 6E / 7
Generations of the Wi-Fi standard. Wi-Fi 6 (802.11ax) improved efficiency when many devices share the air. Wi-Fi 6E added the 6 GHz band, which has more room and less congestion but shorter range and requires compatible devices. Wi-Fi 7 (802.11be) adds wider channels and the ability for a device to use several frequency bands at once, for higher speed and lower delay. Older devices still work, but only at their own generation's capabilities.
SSID (Service Set Identifier)
The network name a device sees when it looks for Wi-Fi. One set of access points can broadcast several SSIDs, such as staff, guest, and devices, and each is usually tied to its own VLAN with its own security rules. Keep the number small: every extra SSID adds overhead to the airwaves and slows everyone down.
Site Survey
An engineering study of how Wi-Fi signals actually behave in your space. A predictive survey models coverage from floor plans and wall materials before installation; an on-site survey measures real signal strength, noise, and interference to validate the design afterward. Re-surveys are needed when layouts, racking, or usage change. It is the difference between designed coverage and guesswork.
Roaming
How a moving device switches from one access point to the next as it moves through a building. The device decides when to move, guided by signal strength and help from the network. When access points are placed or tuned poorly, devices hold on to a weak signal too long, which is why a scanner or phone call drops at the same spot every time.
Interference / RF (Radio Frequency) Noise
Other radio signals or physical obstacles that weaken Wi-Fi: neighboring networks on the same channels, microwave ovens, some machinery, and metal shelving or concrete that blocks or reflects signals. It is managed with surveys, careful channel and power planning, using the less crowded 5 and 6 GHz bands, and placing access points thoughtfully.
Wireless Bridge — PtP (Point-to-Point) / PtMP (Point-to-Multipoint)
A radio link that joins two or more networks as if they were connected by cable, using directional antennas mounted outdoors. A PtP (point-to-point) bridge links exactly two sites with antennas aimed at each other; a PtMP (point-to-multipoint) bridge has one base station feeding several remote sites (see PtMP). Typical uses: linking buildings across a parking lot or road, reaching gate houses, guard shacks, outbuildings, and parking-lot cameras, and providing a backup path for a fiber link, all without trenching. Range and speed depend on the band: from a few hundred meters at multiple Gbps to tens of kilometers at tens or hundreds of Mbps. Every bridge needs a clear line of sight and Fresnel zone, precise antenna alignment (installers fine-tune by measured signal strength), rigid mounts that won't sway in wind, grounding, and a choice between licensed vs. unlicensed spectrum. Pros: fast to deploy and far cheaper than trenching. Cons: needs a clear path, and some bands are affected by rain or interference.
PtMP (Point-to-Multipoint)
One central base station, usually with a sector antenna covering a wide angle, that serves several remote locations at once, each with its own small directional antenna aimed back at it, like a hub with spokes. It's an economical way to connect outbuildings, gate houses, cameras, and storage yards from one main building. All remote sites share the base station's total capacity, so the busiest sites or cameras set the design. See Wireless Bridge.
Wireless Backhaul
Using radio links instead of buried cable or leased lines to carry network traffic between sites or buildings. It covers both point-to-point and point-to-multipoint designs, and is often chosen where trenching is expensive or not permitted, or as a backup path for a wired connection.
Line of Sight & Fresnel Zone
Line of sight means the two antennas of a wireless link can "see" each other with no buildings, hills, or trees in the straight path. That alone isn't enough: radio energy travels in a football-shaped region around that line called the Fresnel zone, which is widest at the middle of the path and grows larger with distance and at lower frequencies. Obstructions inside it, such as rooftops, tree canopies, or even the ground, weaken the signal; a common design rule keeps at least 60% of the first Fresnel zone clear. On long links, mounting height must also allow for the curve of the earth and for trees that grow taller over time. A path study checks all of this before equipment is bought.
Licensed vs. Unlicensed Spectrum
In the U.S., the Federal Communications Commission decides how each band of radio frequencies may be used. Unlicensed bands (such as 900 MHz, 2.4, 5, 6, 24, and 60 GHz) can be used by anyone with certified equipment that follows power limits, with no application or fee, but they offer no protection from other users' interference. Licensed bands require registering each link or buying exclusive rights, which takes time and cost but provides legal protection from interference, important for links that must not fail. In between are shared or "light-licensed" approaches, such as CBRS at 3.5 GHz and E-band at 70/80 GHz, where links are registered in a database for low cost and coordinated protection.
WPA2 / WPA3 (Wi-Fi Protected Access 2 / 3)
The current generation of Wi-Fi security. It protects passwords against offline guessing attacks, adds stronger encryption options for business networks, and provides encryption on open guest networks so nearby users can't read each other's traffic. Older devices may support only WPA2, so many networks run a transition mode during upgrades.
Captive Portal
The web page that appears when you join a guest Wi-Fi network, asking you to accept terms, enter a code, or sign in before you can browse. It lets a business control and record guest access, and can limit speed or session length.
Wi-Fi Mesh
Access points that relay traffic to each other wirelessly instead of each being cabled to a switch. Mesh is useful where cabling is impractical, but every wireless hop reduces speed, so in businesses cabled access points are preferred and mesh is used only to fill gaps.
GHz (Gigahertz)
A unit of radio frequency: one billion cycles per second. Wi-Fi uses three bands named by frequency: 2.4 GHz (longest range, most crowded), 5 GHz (more capacity, shorter range), and 6 GHz (cleanest and fastest, shortest range, newer devices only). Higher frequencies carry more data but pass through walls less easily, which is why band choice shapes access point placement.
900 MHz (Megahertz) Band
The unlicensed 902–928 MHz band. Its long waves travel far and bend around and through trees and walls better than higher bands, so links can reach several kilometers without a perfectly clear path. The trade-off is very little bandwidth: throughput is typically a few to a few tens of Mbps, and the band is shared with utility meters, sensors, and other devices. Use it for low-data links through foliage or around obstacles, such as remote sensors, gate controllers, or a single camera at a lower bitrate; it's not a backbone.
2.4 GHz (Gigahertz) Band
The unlicensed 2.400–2.4835 GHz band used by Wi-Fi, short-range wireless accessories, many IoT devices, and microwave ovens. It has the longest range and best wall penetration of the Wi-Fi bands, but only about 83 MHz of room, which allows just three non-overlapping 20 MHz channels (1, 6, and 11 in the U.S.). It is usually the most crowded band, so speeds are modest and interference is common. Use it for range and for older or low-power devices; avoid it for outdoor bridges in busy areas.
5 GHz (Gigahertz) Band
Unlicensed spectrum between about 5.15 and 5.895 GHz, split into several sub-bands with different power and rules. Some channels are shared with weather and military radar, so equipment must listen for radar and move off the channel if it hears it (dynamic frequency selection), which can briefly interrupt service. It has far more room than 2.4 GHz, giving faster Wi-Fi with wider channels, and is the most common band for outdoor PtP and PtMP bridges, which can reach several kilometers with directional antennas at hundreds of Mbps. The trade-offs are shorter range through walls than 2.4 GHz and growing congestion outdoors.
6 GHz (Gigahertz) Band — Wi-Fi 6E/7 and AFC (Automated Frequency Coordination)
1,200 MHz of unlicensed spectrum from 5.925 to 7.125 GHz, opened by the Federal Communications Commission in 2020 and used by Wi-Fi 6E and Wi-Fi 7. It has room for many wide channels (including 160 and 320 MHz) and is free of older Wi-Fi devices, so it is fast and uncluttered. Because licensed microwave links already use the band, rules vary by power level: low-power indoor access points need no coordination; standard-power and outdoor devices must check with an AFC (Automated Frequency Coordination) system, a database that tells each device which channels and power it may use at its location; very-low-power portable devices are also allowed. Range through walls is shorter than 5 GHz, and only newer devices can use it.
CBRS (Citizens Broadband Radio Service) — 3.5 GHz
A shared band from 3.55 to 3.7 GHz used mainly for private 4G/5G cellular networks in warehouses, campuses, ports, and industrial sites, and for fixed wireless internet. Access has three tiers coordinated automatically by a spectrum access system: existing federal users such as Navy radar are protected first; priority access licenses (sold at auction by county) come second; and general authorized access is available to anyone with certified equipment at no license cost, but without protection from priority users. It offers cellular-grade coverage, mobility, and device control over large areas, but requires a core network, compatible devices, and professional design.
24 GHz (Gigahertz) Band — Unlicensed PtP
The unlicensed 24.0–24.25 GHz band, used for short point-to-point bridges. Its narrow beams and higher frequency mean little interference and quick setup, with typical links of up to a few kilometers carrying several hundred Mbps to around 1 Gbps or more depending on equipment and channel width. The band is only 250 MHz wide and higher frequencies weaken in heavy rain, so it suits medium-capacity links between nearby buildings. It is separate from the neighboring licensed 24 GHz spectrum auctioned for mobile 5G.
60 GHz (Gigahertz) Band — V-band
Unlicensed spectrum from 57 to 71 GHz with very wide channels (about 2 GHz each), supporting multi-gigabit links. Oxygen in the air absorbs signals strongly near 60 GHz, so links are short: typically a few hundred meters to about a kilometer or two. That absorption, plus pencil-thin beams, also means neighboring links rarely interfere, so many can operate close together. Use it for high-capacity links across a campus or street, between buildings, or as a fiber substitute for short hops; heavy rain and precise alignment are the main limits.
70/80 GHz (Gigahertz) Band — E-band
Spectrum at 71–76 and 81–86 GHz that the Federal Communications Commission makes available through light licensing: a low-cost, non-exclusive nationwide license, with each link registered in a third-party database that gives first-come interference protection. Very wide channels support multi-gigabit throughput (up to 10 Gbps or more) over a few kilometers, with narrow beams that need precise alignment and rigid mounts. Heavy rain weakens signals at these frequencies (rain fade), so link distance is planned around local rainfall, often with a lower-band backup radio. Use it when you need fiber-like capacity between sites and can't trench.
Voice & Communications
VoIP — Voice over IP
Phone calls converted to data and carried over the network and the internet instead of traditional copper phone lines. It allows phones to work anywhere with a connection, along with features like voicemail to email, mobile apps, and call recording. Call quality depends on the network, so VoIP is designed together with QoS, VLANs, and sound internet connections.
SIP — Session Initiation Protocol
The standard signaling language VoIP systems use to set up, change, and end calls: it handles ringing, answering, and transfers. The voice itself travels separately, usually over a protocol called RTP. A SIP trunk is a phone-service connection delivered over the internet that replaces bundles of traditional phone lines, connecting your phone system to the public telephone network with flexible capacity.[7][8]
PBX — Private Branch Exchange
The core of a business phone system: it manages extensions, routes incoming calls, handles transfers, voicemail, hunt groups, and business-hours rules, and connects to the outside phone network. Today a PBX can run in the cloud and be managed by a provider (hosted), run on equipment at your site (on-premises), or combine both (hybrid). The right choice depends on internet reliability, compliance needs, and who will manage it.
Auto-Attendant / IVR
The automated menu that answers and routes calls ("press 2 for service"). A basic auto-attendant routes by keypress; IVR (interactive voice response) can also understand spoken answers and look up information, such as account status, without a person. It is often a caller's first impression, so clear scripting, short menus, and an easy route to a person matter.
Contact Center / Omnichannel
A customer-communication platform that goes beyond a phone system. It distributes voice calls, web chat, text messages, email, and social messages to available agents through shared queues, keeps one history for each customer across every channel, and reports on wait times, volumes, and outcomes. Omnichannel means a conversation can move from chat to a call without the customer starting over.
CRM Screen-Pop
An integration between the phone system and a customer database (CRM) that opens the caller's record on the employee's screen the moment the phone rings. The phone system passes the caller ID to the CRM, which looks up the matching customer and displays their history, open orders, or service appointments; when the call ends, it can log the time, length, and notes automatically. Staff greet callers by name with context in hand, and every call is recorded without extra typing.
E911 (Enhanced 911)
Enhanced 911: the rules and technology that make sure an emergency call from a business phone reaches the right 911 center and tells responders where the caller actually is. Under federal rules (Kari's Law and RAY BAUM'S Act of 2018, whose name stands for Repack Airwaves Yielding Better Access for Users of Modern Services and honors congressional staffer Ray Baum), business phone systems installed since February 2020 must let users dial 911 directly without a prefix and notify someone on site when 911 is called, and systems must convey a dispatchable location: the street address plus details such as floor or room. It is a legal requirement, not a feature, and remote and softphone users need their locations kept current too.[9]
Softphone
A phone app on a computer or smartphone that works as your business extension: make and receive calls with your office number, transfer, check voicemail, and see who is available, from anywhere with internet. Its 911 location must be kept current when users work away from the office.
Number Porting
Moving existing phone numbers from one provider to another so customers keep dialing the same numbers. The new provider submits a request with an authorization letter and a copy of the current bill, and the switch happens on a scheduled date. Cancelling the old service before the port completes can lose the numbers.
STIR/SHAKEN (Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs)
A U.S. framework that lets phone carriers digitally sign the caller ID on calls, so the receiving carrier can verify that a call really comes from the number shown. It fights spoofed robocalls and affects whether legitimate business calls show as verified or are labeled as possible spam.
Call Recording & Consent
Recording calls helps with training, quality, and disputes, but laws differ by state: some allow recording if one party consents, while others require every party's consent. Businesses typically play a notice at the start of calls and set retention rules for recordings, which may contain sensitive data.
RTP (Real-time Transport Protocol)
The standard protocol that carries the actual audio and video of a VoIP call once SIP has set it up. It sends the sound in small, numbered, time-stamped packets, usually over UDP, so the receiving phone can put them back in order and play them smoothly. Firewalls must allow RTP traffic and QoS should prioritize it, or calls can connect but have one-way or choppy audio.
CRM (Customer Relationship Management)
Software that keeps one shared record for every customer and prospect: contact details, purchase and service history, conversations, open opportunities, and follow-up tasks. Staff in sales, service, and support work from the same record, so anyone can pick up where a colleague left off, and managers can see pipelines and response times. Its value grows when it is connected to the phone system, email, and website, so interactions are logged automatically rather than typed in.
Cameras, Access & Life Safety
IP Camera
A camera that is itself a network device. It turns video into data, sends it over the network (usually powered by PoE) to a recorder or cloud service, and can be viewed from anywhere with permission. Compared with older analog cameras, IP cameras offer higher resolution, can analyze video in the camera itself, and are managed and updated like other network devices, which also means they need the same security care.
Video Analytics
Software, in the camera, recorder, or cloud, that analyzes video to recognize what is happening: telling people from vehicles or animals, and detecting someone lingering, crossing a virtual line, or leaving an object behind. Instead of someone watching hours of footage, the system flags events in real time and makes recordings searchable ("show every person in a red shirt after 9 p.m."). Accuracy depends on camera placement, lighting, and tuning.
Facial Recognition (in access control)
Using a camera to compare a person's face with a list of enrolled people. It can unlock a door without a badge, confirm that the person presenting a badge is its owner, or alert when someone who isn't enrolled enters a restricted area. Because faces are biometric data, several states regulate how it is collected, disclosed, and stored, so consent and retention policies need to be in place before it is deployed.
LPR (License Plate Recognition) / ANPR (Automatic Number Plate Recognition)
Cameras and software that read vehicle license plates, turning the plate into searchable text. Plates can be matched against allowed or flagged lists to open gates, manage parking, log visitors, or support investigations. Reliable reads depend on the right camera angle, shutter speed, and infrared lighting for night use.
Access Control
An electronic system that controls who can open which doors and when. Users present a credential (badge, phone, PIN, or fingerprint) at a reader; a controller checks it against the rules and unlocks the door if access is allowed. Every attempt is logged, permissions can be changed or revoked instantly when someone leaves, and the system can tie into cameras and alarms. Door hardware must still meet fire and life-safety codes for free exit.
Video Verification
Attaching camera footage to an alarm or door event so whoever responds sees what actually happened. For example, a forced-door alarm arrives with a video clip of that door. It cuts false dispatches, speeds response, and many police departments give verified alarms higher priority than unverified sensor alerts.
Mass Notification / Emergency Communication
Systems designed to deliver urgent safety messages to everyone, everywhere, clearly and immediately: over loudspeakers, desktop pop-ups, phones, text messages, and signs. They can override background music and paging, and their speakers and circuits are monitored so failures are reported before an emergency. Design follows life-safety codes for how clearly speech must be heard in each area.
NVR (Network Video Recorder) / VMS (Video Management System)
An NVR (network video recorder) is the device that records and stores footage from IP cameras. A VMS (video management system) is the software used to view live and recorded video, search it, manage cameras and user permissions, and export clips for evidence, often across many sites. Small systems combine both in one box; larger ones run VMS software on servers or in the cloud.
Video Intercom / Door Entry
A door station with a camera, microphone, and speaker that lets a visitor call staff, who can see and talk to them on a desk station, phone, or app before unlocking the door remotely. Calls and unlocks are logged and can be linked to access control and recording.
Cloud Video Surveillance
Camera systems where recordings and management live partly or fully in a cloud service rather than only on an on-site recorder. It allows viewing from anywhere, automatic updates, and offsite copies of footage, but depends on internet bandwidth, so many systems record locally and upload selectively.
Audio & AV
Sound Masking
A carefully shaped, steady background sound, similar to soft airflow, played through ceiling speakers so nearby conversations become hard to understand beyond a short distance. It doesn't block sound; it covers the parts of speech that make words understandable. It improves privacy and reduces distraction in open offices, healthcare, and legal settings. It is tuned zone by zone to stay unobtrusive.
DSP — Digital Signal Processor
A dedicated audio computer at the center of a professional sound system. Microphones and sources go in; the DSP mixes them, removes echo and background noise, balances levels automatically, and routes sound to the right speakers and video-call systems. It is what makes a conference room sound natural on both ends of a call, and it is programmed for each room.
70V Audio
A way of wiring commercial speaker systems, also called constant-voltage audio. The amplifier sends a higher-voltage signal, and each speaker has a small transformer with a power setting, so many speakers can share one long cable run and each can be set louder or quieter. It is the standard for paging and background music in businesses, schools, and warehouses.
Digital Signage / CMS (Content Management System)
Networked screens (menus, lobby boards, showroom displays, wayfinding) controlled by a content management system. Staff create or schedule content in one place, and each screen or group of screens shows the right content at the right time, with no thumb drives or visits to each display. The system can also check that each screen is online and playing.
Video Wall
Multiple displays mounted edge to edge and driven as one large image. A video wall processor splits the content across the screens, and the design accounts for thin bezels, precise mounting, heat, viewing distance, and maintenance access. It is planned as a complete system rather than a set of televisions on a wall.
Video Conferencing Room
A meeting room equipped so remote participants can see and hear everyone clearly: camera, microphones, speakers, display, and a touch panel to start meetings with one tap. Good results depend as much on room acoustics, lighting, and microphone placement as on the equipment.
Assistive Listening System
Equipment that sends sound directly to listeners with hearing loss, through induction loops that connect to hearing aids, or through infrared or radio receivers with headsets. Accessibility standards require these systems in many assembly areas, such as conference and training rooms with built-in sound systems.
Cloud, Identity & Continuity
Cloud Productivity Suite
A subscription bundle of business tools delivered from the cloud: email and calendar, chat and video meetings, file storage and sharing, and document, spreadsheet, and presentation apps. Business tiers typically add the identity, device-management, and security controls smaller organizations need. Because everything lives in one platform, its security settings and backups deserve the same care as an on-site server.
Cloud Identity Provider (IdP)
A cloud directory of users and groups that controls sign-in to email, apps, and devices. It checks who someone is (password, MFA, passkey), lets them use one sign-in for many apps (single sign-on), and enforces policies such as Conditional Access. When most work happens in cloud apps, identity becomes the main security boundary: protect the accounts and you protect the data.
Device Management — MDM (Mobile Device Management) / UEM (Unified Endpoint Management)
Software that enrolls company laptops, phones, and tablets (and, with limits, personal devices) so IT can manage them remotely: enforce encryption, passcodes, and updates, push apps and settings, and lock or wipe a lost device. On personal devices it can manage only the work apps and data, leaving personal content alone. It also reports which devices are healthy, which Conditional Access can require before allowing sign-in.
Conditional Access
Rules that evaluate every sign-in before granting access: who the user is, where they are, which device they're on and whether it is managed and healthy, which app they want, and how risky the attempt looks. Based on the answers, access is allowed, challenged with MFA, limited, or blocked. A sign-in from an unknown country on an unmanaged laptop can be stopped even with a correct password.
Backup vs Retention
Retention keeps deleted or changed items for a while inside the same system, so they can be recovered from the recycle bin or a hold. Backup keeps independent copies outside that system, under separate credentials. Retention is not backup: if the account is compromised, an administrator makes a mistake, ransomware spreads, or the service has a failure, copies kept in the same system can be lost too. Cloud email and file platforms need a separate backup just like on-site servers.
RPO (Recovery Point Objective) / RTO (Recovery Time Objective)
The two targets that define recovery. RPO (Recovery Point Objective) is how much recent data you can afford to lose; nightly backups mean up to a day of work. RTO (Recovery Time Objective) is how long you can afford to be down before systems are back. Shorter targets cost more, so each system gets agreed targets first, and the backup design is built and tested to meet them.
Immutable Backup
A backup copy that cannot be changed or deleted until a set retention period expires, not even by an administrator or by someone using stolen admin credentials. Attackers routinely try to erase backups before launching ransomware; immutability keeps a clean recovery copy out of their reach. It's best paired with an offsite or offline copy and regular restore tests.
Business Continuity / DR (Disaster Recovery)
Business continuity is the plan for keeping the business running through a disruption; disaster recovery (DR) is the technical part that restores systems and data. A sound plan defines priorities and who does what, and covers recovering data, switching to backup internet (such as cellular or satellite), rerouting phones, and contacting staff and customers. It is tested regularly, because an untested plan is only an assumption.
RMM — Remote Monitoring & Management
Software agents installed on every managed computer and server that report health to a central console and let technicians work remotely. They can monitor disk space, failed backups, and offline devices; apply patches on a schedule; run scripts; and connect to a screen to help a user. It lets problems be fixed before users notice, and is the core tool of proactive managed IT.
Managed Services / MSP (Managed Service Provider)
Outsourcing IT operations to a managed service provider (MSP) for a predictable monthly fee, usually priced per user or per device. Typical services include help desk support, monitoring, patching, security, backups, and vendor coordination under a service agreement with defined response times. It gives a business a full IT team's coverage without hiring each specialty in-house.
SSO (Single Sign-On)
Signing in once with one strong, MFA-protected identity to reach many applications, instead of a separate password for each. When an employee leaves, disabling one account removes their access everywhere, closing a common security gap.
3-2-1 Backup Rule
A widely used guideline: keep at least three copies of your data, on two different types of storage, with one copy offsite. Many now extend it to 3-2-1-1-0: one copy immutable or offline, and zero errors on restore tests.
SaaS / IaaS / PaaS (Software / Infrastructure / Platform as a Service)
Ways of buying cloud services. SaaS (software as a service) is a finished application you use through a browser or app. PaaS (platform as a service) provides a managed platform to build and run your own applications. IaaS (infrastructure as a service) rents virtual servers, storage, and networks that you manage yourself. The further toward IaaS, the more security and maintenance remains your responsibility.
IT (Information Technology)
The computers, networks, software, data, and services an organization uses, and the people and processes that run them. In a business, IT covers everything from help desk support and accounts to security, backups, and cloud services. It can be handled by in-house staff, an MSP, or a combination.
Artificial Intelligence — Concepts
LLM — Large Language Model
The engine behind modern AI assistants: a very large neural network trained on huge amounts of text to predict the next word. At that scale, prediction turns into the ability to answer questions, summarize, translate, write, and reason through problems. Many companies build LLMs; they differ in size, training data, cost, speed, and strengths, but they work the same basic way. An LLM produces likely-sounding text, not checked facts, which is why grounding and review matter.
Token
The small chunk of text an AI model actually reads and writes: a common word, part of a longer word, or punctuation. In English a token averages about three-quarters of a word. Usage pricing, speed, and context-window limits are all counted in tokens, so long documents and long conversations cost more and take longer to process than short ones.
Context Window
The amount of text, measured in tokens, a model can consider at once: its instructions, the conversation so far, any attached documents, and its own reply. Anything outside the window is simply not seen. Larger windows let a model read whole contracts or manuals in one pass, though very long inputs can still cause details in the middle to be overlooked.
Prompt
Everything you give the model to get a response: the question, instructions, examples, and attached material. The model has no other knowledge of your situation beyond its training, so what you include (and leave out) is the biggest factor in output quality that you control.
Prompt Engineering
The practice of writing prompts that reliably produce useful results: stating the task, audience, and format clearly; giving the needed background; showing an example of good output; and splitting large requests into steps. The same model can give a vague answer or a usable one depending on the prompt.
System Prompt
Standing instructions a business sets once, which the model receives before every conversation and the user normally doesn't see. They define the assistant's role, tone, what it should and shouldn't discuss, which sources it may use, and when to hand off to a person. It is how a company makes a general model behave like its own assistant.
Prompt Chaining / Sequences
Breaking complex work into a series of smaller prompts, where each step's output feeds the next: for example, summarize a document, extract the key figures, draft a reply, then check the draft against the source. Each step is simpler, easier to test, and easier to fix than one large prompt, so chains are how dependable AI workflows are built.
Hallucination
When an AI model states something false with full confidence, such as a made-up citation, a wrong specification, or a policy that doesn't exist. It happens because models generate plausible text rather than looking facts up. It can be reduced but not eliminated: ground answers in your documents (RAG), require sources, and have people or automated checks verify facts before they are used.
Fine-Tuning
Additional training of an existing model on a set of your own examples so it learns a style, format, or specialized vocabulary. It changes how the model behaves, but is a poor way to teach it facts that change. Compare RAG, which supplies current documents at question time; most business use cases are better served by RAG, with fine-tuning reserved for consistent tone or format.
RAG — Retrieval-Augmented Generation
A way to ground an AI assistant in your own documents. When a question comes in, the system first searches your content (manuals, policies, product data) for the most relevant passages, then gives those passages to the model with instructions to answer from them and cite them. Updating the documents updates the answers right away, without retraining, which makes RAG cheaper and more current than fine-tuning.
Embeddings / Vector Search
How computers search by meaning rather than exact words. An embedding model converts text into a long list of numbers (a vector) so passages with similar meanings end up close together. A vector search then finds the closest matches, so a search for "phone won't ring" can find a document titled "inbound call failures." It is the search engine inside most RAG systems.
AI Agent
AI that takes actions, not just answers. Given a goal and access to tools (search, a browser, a database, email, other software), an agent plans steps, carries them out, checks the results, and adjusts until the job is done. Scanning a website, grading it, and emailing a report is agent behavior. Because agents act on real systems, they need limited permissions, logging, and human approval for important steps.
Multimodal AI
Models that work with more than text: images, audio, video, and documents. A multimodal model can read a photo of a wiring closet, a floor plan, a chart, or a screenshot as easily as an email, or listen to a recording and summarize it. It opens up tasks like inspecting photos, reading scanned forms, and describing camera footage.
Voice AI / Conversational Speech
AI that listens and speaks in natural conversation. It converts speech to text, decides on a response, and replies with a synthetic voice, increasingly in one fast step that handles tone, pauses, and being interrupted. Current systems can sound close to human, which is why the technology is reaching phone systems and reception desks. Businesses should tell callers they are speaking with AI and offer an easy way to reach a person.
Prompt Injection
An attack where hidden or malicious instructions are placed in content an AI reads, such as a web page, email, or document, to make it ignore its rules, leak data, or take unwanted actions. It's especially risky for AI agents with access to tools and data, and is reduced by limiting permissions, separating trusted instructions from untrusted content, and requiring approval for sensitive actions.
AI Guardrails
Controls placed around an AI model to keep it safe and on-task: instructions, content filters, limits on topics and tools, checks on outputs, and hand-offs to a person. They are how a business makes an assistant behave predictably in front of customers.
AI Acceptable Use Policy
A short written policy telling staff which AI tools are approved, what information may and may not be entered, how outputs must be reviewed, and how AI use is disclosed to customers. It is the simplest protection against data leaks and errors from unmanaged AI use.
AI (Artificial Intelligence)
Computer systems that perform tasks normally requiring human judgment, such as understanding language, recognizing images, making predictions, or deciding what to do next. Most AI today is machine learning: instead of being programmed rule by rule, a model learns patterns from large amounts of example data. The language-based assistants described on this page are one kind of AI; video analytics and spam filtering are others.
Deepfake
Synthetic audio, video, or images made to look like a real person saying or doing something they never said or did. It is made by training an AI model on recordings or photos of the person; a short voice sample can be enough to imitate a voice. It matters because deepfakes are used for fraud (a fake call from a boss asking for a payment) and to mislead voters, so organizations should verify urgent requests through a second, known channel.
Synthetic Media
Any audio, image, video, or text that is created or substantially altered by AI rather than captured from the real world. It ranges from harmless uses, such as an AI-narrated training video, to deceptive ones, such as a deepfake. Some laws require synthetic media to be labeled or marked so people can tell it apart from real recordings.
GPAI — General-Purpose AI
An AI model that can handle a wide range of tasks, such as writing, summarizing, translating, and answering questions, rather than one narrow job like reading license plates. Most chat assistants are built on one. The term matters because some laws, including the EU AI Act, set separate rules for the companies that build these models.
High-Risk AI System
An AI use that can seriously affect a person's health, safety, or rights, such as screening job applicants, scoring exams, deciding eligibility for benefits, or identifying people from their face. Some laws require extra checks for these uses: risk assessments, quality data, activity logs, human oversight, and documentation. The same tool can be low-risk in one use and high-risk in another; what matters is the decision it feeds.
CSAM — Child Sexual Abuse Material
Sexual images or video involving children. The term now also covers realistic AI-generated images that depict children, which many laws treat the same as real images. Online services are generally required to remove and report it.
EU AI Act
The European Union's law on artificial intelligence. It sorts AI uses by risk: a few practices are banned outright, high-risk uses must pass checks before use, some systems must tell people they are dealing with AI or that content is AI-generated, and makers of general-purpose models have their own duties. Its rules are phased in from 2025 to 2028. It matters outside Europe because companies that sell there often build their products to meet it.
TRAIGA — Texas Responsible Artificial Intelligence Governance Act
A Texas state law on artificial intelligence, in effect since January 1, 2026. It requires government agencies to tell people when they are interacting with an AI system, bans certain uses such as social scoring and AI built to unlawfully discriminate, and gives the state Attorney General power to enforce it.
OMB — Office of Management and Budget
The White House office that prepares the federal budget and issues policy memos telling federal agencies how to manage programs, data, and technology, including how they use and buy AI. Its memos bind federal agencies, and state and local governments often borrow from them.
Executive Order
A written directive from a president or a governor to the agencies under their authority. It can set priorities and tell agencies what to do, but it cannot by itself change a law passed by a legislature; that takes new legislation or a court ruling.
DIR — Texas Department of Information Resources
The Texas state agency that sets technology and cybersecurity standards for state government, runs shared technology contracts, and certifies the cybersecurity and AI training programs that many state and local government employees must complete each year.
TX-RAMP — Texas Risk and Authorization Management Program
The Texas security certification for cloud services. Before a Texas state agency signs or renews a contract for a cloud service that stores or handles its data, the provider must be certified, with a higher level required for confidential or regulated data. It works like a security review done once by the state so each agency does not have to repeat it.
ERCOT — Electric Reliability Council of Texas
The organization that operates the power grid serving most of Texas. It balances electricity supply and demand minute by minute and forecasts future demand so new power lines and generation can be planned. Large new users such as data centers must be studied before they can connect.
PUC — Public Utility Commission
The state agency that regulates utilities such as electric, water, and telephone companies. It sets rules on rates, service, and how new customers connect. In Texas, it oversees ERCOT and writes the rules for connecting very large electricity users.
PUE — Power Usage Effectiveness
The standard measure of how efficiently a data center uses electricity. It is the total power the building draws divided by the power that reaches the computers. A PUE of 2.0 means one unit is spent on cooling, lighting, and power losses for every unit of computing; the closer to 1.0, the less is wasted.
MW — Megawatt
A unit of electric power equal to one million watts, or 1,000 kilowatts. A typical home draws a few kilowatts at a time; large data centers are rated in tens or hundreds of megawatts, comparable to a small city.
TWh — Terawatt-Hour
A unit of energy equal to one billion kilowatt-hours. Power (watts) is how fast electricity is used at a moment; energy (watt-hours) is how much is used over time. TWh is the scale used to describe the electricity use of a whole country or industry over a year.
AI Assistants — Choosing & Using Them
General-Purpose AI Assistant
A chat-based assistant built on a large language model that can write, summarize, analyze, brainstorm, code, and answer questions on almost any topic. Several companies offer them, with free and paid tiers. They are strongest at drafting and reasoning, and weakest at verified, current facts unless they can search or use your documents. Treat output as a capable first draft that still needs review.
Built-in (Embedded) AI Assistant
AI built into software you already use, such as email, documents, spreadsheets, meetings, or a CRM, so it can draft, summarize, and answer questions using the files and messages you already have permission to see. The advantage is convenience and governance: data stays within your existing platform and access rules. The trade-off is that it is only as good as your file permissions and the model behind it, so clean up oversharing before turning it on.
Web-Connected (Real-Time) Assistant
An assistant that can search the internet or live data sources while answering, instead of relying only on what it learned in training. It can discuss today's news, prices, or events and often shows its sources. Answers are only as reliable as the pages it finds, so check the citations for anything important.
Consumer vs. Business AI Plans
The same assistant usually comes in consumer and business versions, and the difference is mainly about your data. Business plans typically promise that your inputs won't be used to train the model, and add administrator controls, single sign-on, retention settings, audit logs, and contractual privacy terms. Staff pasting customer or financial data into a personal free account is a real data-leak risk; an approved business plan and a short usage policy prevent it.
AI Voice Agent / Virtual Receptionist
A voice AI connected to the phone system that answers calls, understands what the caller needs, answers common questions, books appointments, and transfers to the right person or takes a message, at any hour. It is grounded in the business's own information and rules, and is set up to disclose that it is AI and to hand off to a person whenever asked or unsure.
Reasoning Model
A type of language model designed to work through a problem in steps before answering, spending more time and computing power on harder questions. Reasoning models do better on math, planning, analysis, and multi-step tasks, but are slower and cost more per answer, so they're best saved for work that needs them rather than quick everyday questions.
How to choose an assistant
Test with your actual work, not a brand's reputation: use your documents, your questions, and the formats you need, and compare the results side by side. Check data-privacy terms, administrative controls, and how well it fits your existing tools. Models improve every few months, so re-test periodically. For business systems, grounding the assistant in your own data (RAG) usually matters more than which model sits underneath.
AI & the Modern Web
AI Crawler
An automated program that AI companies use to read public websites, either to train models or to fetch pages live when a user asks a question. Crawlers identify themselves by name and generally follow the rules in your site's robots.txt file. Allowing reputable AI crawlers helps your business appear accurately when someone asks an assistant for a recommendation; blocking them reduces your chance of being found or described correctly there.[10]
Good Bots vs Bad Bots
Not every automated visitor deserves the same treatment. Good bots, such as major search-engine and reputable AI crawlers, identify themselves honestly, obey robots.txt, crawl at a polite pace, and bring visibility in return. Bad bots pretend to be browsers or even impersonate well-known crawlers, ignore the rules, overload servers, copy content and prices, probe for weaknesses, and try stolen passwords. Blocking all bots stops the good with the bad and can quietly remove a site from search results and AI answers.
Telling Crawlers Apart
Three checks separate real crawlers from imposters. First, the user-agent: legitimate bots state their name and a web address explaining who they are. Second, verification: major crawler operators publish their official IP address ranges and support reverse-DNS lookups, so a "search engine bot" from an unrelated address is fake. Third, behavior: real crawlers follow robots.txt and pace their requests, while fakes ignore rules and spike traffic. Modern web firewalls and bot-management services perform these checks automatically, letting verified bots through and challenging or blocking the rest.[11]
llms.txt
A proposed convention, not yet an official standard: a plain-text file at yoursite.com/llms.txt that summarizes, in simple structured form, what your business is and does, with links to your most important pages. The aim is to give AI systems accurate, easy-to-read facts. Support among AI providers is still limited and uneven, so treat it as a low-cost addition to, not a replacement for, good content and structured data.[12]
Structured Data / Schema.org
Machine-readable labels added to a web page's code, using a shared vocabulary (Schema.org), that state facts plainly: this is an organization, here is its address and phone number, these are its services, these are questions and answers. Search engines and AI systems can read those facts directly instead of guessing from the text, and search engines may use them for richer results.[13]
SEO — Search Engine Optimization
The work of helping search engines find, understand, and rank your pages: content that clearly answers what people search for, a fast and technically sound site that search engines can crawl, structured data, and credibility signals such as reputable sites linking to you. Results are measured with search-performance data and take time to build.
GEO — Generative Engine Optimization
The newer counterpart to SEO: helping AI assistants find, understand, and accurately cite your business when they answer questions. It relies on the same foundations (clear, factual, well-organized content, structured data, and a sound site) plus allowing reputable AI crawlers and keeping facts consistent everywhere your business appears online. Because the field is young, results are harder to measure than traditional search.
robots.txt
A plain-text file at the root of a website (yoursite.com/robots.txt) that tells automated crawlers which parts of the site they may or may not visit, by crawler name. Reputable crawlers follow it voluntarily; it is a set of instructions, not a security control, so private content still needs real protection.
HTTPS (Hypertext Transfer Protocol Secure) / TLS (Transport Layer Security) Certificate
HTTPS encrypts the connection between a visitor's browser and your website using TLS, so data can't be read or altered in transit. A certificate proves the site is really yours. Browsers warn visitors about sites without it, and search engines favor secure sites.
Core Web Vitals
A set of measurements of real visitors' experience on a page: how quickly the main content appears, how quickly the page responds to a tap or click, and how much the layout shifts while loading. They are measured from real-world usage data and are one of the signals search engines use.
Now you speak the language — want someone who lives it?
Have Tavo grade your website free, or get an engineer on the phone.
Social Scoring
Rating people based on their behavior, personal traits, or associations and then using that score to grant or deny them treatment or services. Several laws ban it when done by or for governments, because it can penalize people for things unrelated to the decision being made.