In cyber security, conversion is the point at which a target completes the attacker’s desired action. That action may be clicking a phishing link, entering credentials, approving a login prompt, installing malware, or making a fraudulent purchase. It is the end of a deception funnel: attention, trust, urgency, then action.
The term matters because defenders try to reduce conversion, not just block delivery. Security teams measure how often malicious emails, fake ads, or scam pages turn into clicks, submissions, or payments, then use that data to improve warnings, authentication checks, and fraud controls. Attackers also optimize for conversion, testing wording, branding, and page design to make a lure more convincing.