Cybersecurity glossary
What is indicator of compromise?
Also known as: IOC, IOCs
Definition
An indicator of compromise (IOC) is observable evidence that a system may have been attacked, such as a malicious IP address, domain, URL or file hash.
Why it matters
IOCs are shared in threat reports and feeds so defenders can search logs and block known infrastructure. They expire quickly, so pair them with behavior-based detections.
Common questions about indicator of compromise
See also
Sources
Related Guides
GuideSmall Business Security
Business Email Compromise: How It Works and How to Stop It
Learn how business email compromise attacks target finance teams and discover concrete controls, verification rules, and policies to protect your company.
Read more GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more GuideGRC
8 Steps to Prepare for a Security Audit (ISO 27001, SOC 2 or Customer Audit)
How to prepare for an ISO 27001, SOC 2 or customer security audit: scope, control mapping, evidence collection, GRC platforms, mock audits, interviews and managing findings.
Read more GuidePersonal Security
7 Signs Your Account Has Been Hacked (and How to Fix It)
Spot the warning signs your account has been hacked, learn immediate containment steps, and restore your digital security with practical defensive advice.
Read more