Indicator of Compromise (IOC)
An observable artefact suggesting a system has been compromised -- a file hash, IP address, domain, registry key, filename or mutex. IOCs are contrasted with indicators of attack, which describe behaviour and intent rather than artefacts, and they sit at the cheap-to-change end of the cost-to-evade scale. IOC handling is examined in CySA+, GCIH, GCTI-adjacent threat-intelligence material and SC-200.
Why It Matters
In practice IOCs are indispensable and overrated in equal measure: they are cheap to share, trivial to match at scale and excellent for retrospective hunting, but an attacker changes a hash by recompiling and an IP by moving provider, so a detection strategy built only on IOCs is permanently one step behind. This is what the Pyramid of Pain formalises -- hashes and addresses are cheap for an adversary to change, while tooling and behaviour are expensive -- so mature programmes use IOCs for fast wide matching and behavioural detections for durability. Two operational disciplines matter more than the feed: IOCs need an expiry, because a re-allocated IP address that once hosted a C2 server will eventually belong to something legitimate and generate false positives indefinitely, and they need context, since an indicator with no associated actor, campaign or confidence cannot be triaged sensibly. Sharing formats such as STIX and TAXII exist for that reason. On exams, expect questions contrasting IOC with IOA.
Practice this topic
Test your knowledge of Indicator of Compromise (IOC) concepts with exam-style practice questions.
Related Fundamentals terms
CIA Triad
The three core principles of information security: Confidentiality (ensuring data is accessible only to authorized parties), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring systems and data are accessible when needed). The CIA Triad is the foundational model for designing security controls, every security measure addresses one or more of these principles. For example, encryption protects confidentiality, hashing protects integrity, and redundancy protects availability. Some frameworks extend this to include authentication, non-repudiation, and privacy. The CIA Triad is the most fundamental concept in cybersecurity and appears in every certification exam.
Defense in Depth
A layered security strategy that uses multiple independent security controls at different levels to protect information assets, so that if one layer fails, others continue to provide protection. Layers typically include physical security, network security (firewalls, IDS/IPS), host security (EDR, hardening), application security (WAF, input validation), data security (encryption, DLP), and administrative controls (policies, training). This approach originates from military strategy and recognizes that no single control is foolproof. Defense in depth is a guiding principle for security architecture and is a fundamental concept in CISSP, Security+, and CISM certifications.
Threat Intelligence
Evidence-based knowledge about existing or emerging threats that helps organizations make informed security decisions, including indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and threat actor profiles. Threat intelligence is categorized into strategic (high-level trends for executives), tactical (TTPs for security teams), operational (specific attack campaigns), and technical (IOCs for automated tools). Sources include open-source feeds (MITRE ATT&CK, AlienVault OTX), commercial feeds, ISACs (Information Sharing and Analysis Centers), and dark web monitoring. Threat intelligence is central to CySA+, CTIA, GCTI, and CISSP Domain 1 certifications.
Patch Management
The process of identifying, acquiring, testing, and installing software updates (patches) to fix security vulnerabilities, bugs, and improve functionality across an organization's IT infrastructure. An effective patch management program includes asset inventory, vulnerability scanning, patch prioritization (using CVSS scores and exploitability data), testing in staging environments, deployment scheduling, and verification. Unpatched systems remain the most exploited attack vector, many major breaches (Equifax, WannaCry) resulted from failure to apply available patches. Patch management is required by PCI DSS, HIPAA, and other compliance frameworks and is tested in Security+, CySA+, and CISSP certifications.
EDR (Endpoint Detection and Response)
A security solution that continuously monitors endpoints (laptops, desktops, servers, mobile devices) to detect, investigate, and respond to cyber threats in real time. EDR goes beyond traditional antivirus by using behavioral analysis, machine learning, and threat intelligence to detect fileless malware, living-off-the-land attacks, and advanced threats. Key capabilities include process monitoring, file integrity monitoring, network connection tracking, automated response actions (isolation, remediation), and forensic investigation tools. Leading EDR platforms include CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, and Carbon Black. EDR is a core technology for SOC operations and is tested in CySA+, CISSP, and Security+ certifications.
Honeypot
A decoy system or resource designed to attract attackers and study their methods, tools, and techniques while protecting real production systems. Honeypots can be low-interaction (simulating services with limited functionality) or high-interaction (full operating systems that allow deeper attacker engagement). A network of honeypots is called a honeynet. Honeypots serve multiple purposes: early warning of attacks, intelligence gathering on new threats, diverting attackers from real targets, and collecting evidence for legal proceedings. Tools include Cowrie (SSH honeypot), Dionaea (malware capture), and T-Pot (multi-honeypot platform). Honeypots are covered in CEH, CySA+, and CISSP security operations topics.