An SNMP trap is an asynchronous notification sent by a device or service to an administrator’s monitoring system. Instead of waiting for the manager to poll for status, the sender “traps” an event such as a fault, threshold breach, or service change and pushes an alert immediately.
In cyber security, traps matter because they are part of the management plane, which is often exposed to broad network access and sometimes trusted too much. Defenders use them to detect outages, configuration changes, or suspicious activity, but insecure trap listeners can become an attack surface if they parse untrusted data badly, accept unauthenticated traffic, or pass trap contents into scripts or system commands. Real attacks often target these weak points rather than SNMP itself. Good defenses include using SNMPv3 where possible, restricting who can send traps, disabling unused listeners, and treating trap payloads as untrusted input.