2026-06-11
What is an IOC (Indicator of Compromise): traces that reveal a breach
An IOC (Indicator of Compromise) is a trace a breach leaves behind — known-bad file hashes, attacker IPs/domains, URLs, unusual processes. Its value is mechanically detecting/blocking known-bad. But it's a reactive clue attackers can swap cheaply, so IOC matching is a final check, not a complete defense. The main defense is a design that resists intrusion (least privilege, patching, MFA).