Executable behavior is software action a system can run, not just content it can store or display. A file, input, or document crosses this line when its contents are interpreted as instructions, logic, or code-like operations. In that moment, the security model changes: the data is no longer passive.
This matters because attackers often try to turn “data” into execution. Examples include malicious macros, scriptable documents, polyglot files, and parsers that convert user input into commands or compiled output. Defenders look for this boundary shift by reviewing parsers, sandboxing untrusted content, separating display from execution, and minimizing trust in file formats that can trigger actions. The key question is simple: can this input only be read, or can it make the system do something?