A risk signal is an indicator that something may deserve security review, even if compromise has not been confirmed. In practice, it is weaker than evidence of a breach, but stronger than background noise. Examples include an extortion post naming a site, unusual login patterns, sudden file changes, or a new hash or identifier that appears in a threat actor’s claim.
Risk signals matter because defenders often must act before the full picture is known. They help teams prioritize logs, preserve evidence, check account activity, and verify whether a website, server, or connected service was actually affected. In attacks, criminals may use risk signals to create pressure and force a response. In defense, analysts treat them as triggers for validation, not conclusions. The key rule is simple: a risk signal justifies investigation, but it does not by itself prove intrusion, data theft, or disruption.