Persistent root is a privileged control state on a device that survives a normal reboot. Unlike a temporary shell or one-time root session, it can remain active after power cycling because the attacker has altered a startup component, bootloader state, system partition, or another mechanism that is loaded early in boot. In practice, this means the device keeps elevated control even when the user thinks it has restarted cleanly.
In cyber security, persistent root matters because it changes a short-lived compromise into durable system ownership. It can let an attacker disable protections, modify firmware, preserve access, and interfere with updates or logging. Defenders look for signs such as unlocked bootloaders, altered boot chains, unexpected startup changes, or integrity-check failures. On hardened systems, verified boot, secure boot, signed firmware, and re-locking mechanisms are designed to prevent or detect this state.