← Security+ glossary

Indicator of compromise (IoC) IoC

An IoC is a forensic trace indicating that an intrusion or infection has already occurred, for example unusual network traffic, unknown files, account lockouts or 'impossible travel' when the same account logs in from two distant locations in too short a time. Missing logs are an especially strong indicator because attackers often delete records to hide their tracks, so their disappearance itself suggests a deliberate cover-up.

All Security+ guides →