Cybersecurity and GRC terminology: English to Mexican Spanish
Use this guide when translating cybersecurity, privacy, audit, and GRC content for professionals in Mexico. It describes professional usage, not word-for-word equivalence.
Edition 2026.3. The companion guide, Spanish to English, lives on the Spanish version of this page. If something here is not how you would say it, tell us.
Legal note: Legal terms are date-sensitive, and this guide is not legal advice. Verify the current official instrument, authority, and procedure before relying on a legal translation.
How to use this guide
The default register is formal Mexican professional writing: security policies, audit reports, regulatory material, technical documentation, and professional training. Team chat, job titles, product names, commands, and quoted interface text may retain more English.
- Translate: Mexican professional writing normally uses the Spanish term.
- Keep in English: The English borrowing is the normal specialist term in Mexico.
- Context-dependent: The correct form changes with technical sense, register, organization, or jurisdiction.
- Official name or acronym: Preserve the official name, designation, or working acronym.
- Legal term, date-sensitive: Use the wording of the governing instrument and verify the current official text.
Consistency applies to the same sense, register, jurisdiction, and grammatical use. It does not require different concepts to share one translation.
Terms
exploit
→exploitContext-dependentTechnical and vulnerability-management writing
Retain exploit as the usual specialist noun. The verb is explotar una vulnerabilidad. In Spanish, un exploit and plural exploits are standard.
Sources: UNAM-CERT security bulletin
That is not how I would say it
exploit code
→código de explotaciónTranslateFormal vulnerability explanation
Use código de explotación when the source specifically refers to code. The broader practitioner noun remains exploit.
Sources: UNAM-CERT security bulletin
That is not how I would say it
payload
→payload; carga útilContext-dependentMalware tooling, APIs, and protocol writing
Retain payload in malware tooling, exploit modules, commands, and quoted interface labels. Use carga útil for an API or message body and where formal protocol prose uses that term. Mexican sources use both forms, so neither is inherently translationese.
Example: The API rejects a payload with an invalid signature. → La API rechaza una carga útil con una firma no válida.
Sources: Official DOF text of the CNBV standardized API provisions · UNAM-CERT fileless-attack analysis
That is not how I would say it
zero-day
→vulnerabilidad de día cero; zero-day; 0-dayContext-dependentFormal explanation, technical feeds, and offensive security
Use vulnerabilidad de día cero, exploit de día cero, or ataque de día cero in formal explanatory prose. Retain zero-day or 0-day in technical feeds, tool output, and offensive-security dialogue. Both patterns are current in Mexico.
Example: The vendor patched a zero-day vulnerability. → El proveedor corrigió una vulnerabilidad de día cero.
Sources: UNAM-CERT zero-day bulletin