Monitorability is the ability to observe, audit, and understand a system’s behavior while it is running. In cybersecurity, it means defenders can see what actions a system takes, what inputs and outputs it handles, and whether those actions stay within policy. Good monitorability depends on telemetry, logs, alerts, traces, and clear documentation of expected behavior.
It matters because security controls are only effective when they can be verified. A model, service, or agent may appear safe in testing but become risky if its internal decisions or tool use are hard to inspect. Attackers benefit from low monitorability because hidden actions are harder to detect, investigate, or block. Defenders improve monitorability with structured logging, access controls, sandboxing, audit trails, and human review, especially for agentic systems that can take real-world actions.