Serverless is a cloud computing model where the provider runs and scales functions on demand, so the user does not manage traditional servers. The code executes briefly in response to events such as API calls, queue messages, or file uploads, which makes the environment highly elastic and often short-lived.
In cyber security, serverless matters because attackers and defenders both operate in a very small time window. Threats often target over-permissive IAM roles, exposed secrets, unsafe event inputs, or abused triggers that launch unexpected code paths. Defenders look for runtime telemetry, least-privilege permissions, logging, and configuration checks to catch suspicious execution before a function disappears. Because these workloads are ephemeral, tools that only inspect snapshots can miss the attack entirely.