Quarantine metadata is a macOS file flag added to items downloaded from the internet or received from other untrusted sources. It tells the operating system that the file should be treated with extra caution, which can trigger Gatekeeper checks, warnings, and other safety prompts before the file opens or runs.
This matters in cyber security because the flag helps users and defenders spot potentially risky software, scripts, or archives. Attackers sometimes try to remove or bypass quarantine metadata to reduce friction and make a malicious file look more ordinary. Defenders can look for missing or altered quarantine attributes as a sign that a file has been tampered with, and they can use endpoint controls to block unsafe execution even if the metadata is stripped.