Indicator of compromise
Also known as IOC
A specific, observable artifact suggesting a system has been breached, such as a file hash, domain, or unusual account behavior.
Classic indicators are technical: a known-bad file hash, a command and control domain, an IP address. Behavioral ones are often more durable, because an attacker can change infrastructure in minutes but their methods change slowly.
Indicators are inherently backward-looking, describing what has already been seen elsewhere. They are necessary but not sufficient, which is why behavioral detection sits alongside them rather than being replaced by them.
Where this comes up
Indicator of compromise sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.