Self-hosted software is a service an organization installs and runs on its own infrastructure instead of using a managed provider. The organization is responsible for the server, updates, configuration, access control, logging, backups, and monitoring. Common examples include source-code platforms, file services, chat systems, and internal dashboards.
In cyber security, self-hosted software matters because security depends on the operator, not just the vendor. If an instance is exposed to the internet and not patched quickly, attackers can scan for it, exploit known flaws, steal credentials or tokens, and reach sensitive data such as repositories or automation hooks. Defenders should inventory every instance, verify the fixed version is actually deployed, restrict exposure, enforce strong authentication, and review logs for unusual account, token, or webhook activity. The key risk is that a patch only helps after the environment is confirmed clean and updated.