Tail latency is the slowest part of a system’s response distribution, usually measured with high percentiles such as p95 or p99 instead of an average. It shows how long the worst requests take, which matters because a small number of slow operations can dominate user experience and system behavior.
In cyber security, tail latency is important for both defense and attack detection. A denial-of-service flood, resource exhaustion, cache misses, or noisy-neighbor contention can push the tail up long before the mean changes much. Defenders watch percentile latency to spot overloaded nodes, failing dependencies, and abnormal traffic patterns. Attackers can also use timing differences in the tail to probe shared infrastructure or infer how a service behaves under load.