A DMZ (Demilitarized Zone) in cybersecurity is a physical or logical subnetwork that separates an internal local area network (LAN) from untrusted external networks, such as the internet. The primary purpose of a DMZ is to add an additional layer of security to an organization's local network. External-facing servers, resources, and services are placed in the DMZ so they can be accessed from the internet but remain isolated from the internal network. This setup helps reduce the risk of attackers gaining direct access to sensitive internal data if they compromise a public-facing system. Firewalls and other security measures control traffic between the DMZ, internal network, and external sources.