Indicator of compromise
Also called IOC, IoC, indicators of compromise
A piece of technical evidence that a system may have been attacked: an address, a domain, a file's fingerprint, an account.
An indicator of compromise, or IOC, is something observable that suggests an attack is coming, is under way or has already happened. The usual kinds are IP addresses, domain names, file hashes, account names and the times things occurred.
Indicators are how security teams pass findings to each other. One team's investigation becomes a list that another team can search for in its own logs or add to a blocklist. That makes a wrong indicator costly: it sends other people looking for something that was never there, and it can block a service that did nothing.
This matters more now that AI drafts incident summaries. A model asked to summarise an intrusion can write an indicator that fits the pattern and appears in no log.
For example
After a break-in, a team shares the IP address the attacker connected from so that partners can search their own logs for it.
Put it to use
Where you'll meet indicator of compromise in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.