An adaptive attack is a cyberattack that changes its behavior, timing, payload, or execution path to avoid being recognized. Instead of following one fixed pattern, it may alter code, rotate infrastructure, pause when it detects analysis, or use different tactics on different targets.
This matters because many defenses still rely on stable indicators such as hashes, signatures, or known malicious domains. When an attacker adapts, those controls can miss the threat or detect it too late. In real operations, adaptive attacks often appear as malware that checks for sandboxes, phishing campaigns that vary wording and delivery, or intrusions that shift laterally only after confirming access. Defenders respond with behavior-based detection, telemetry correlation, threat hunting, and repeated validation of controls. The key idea is that security must track how an attack acts, not only what it looks like at one moment.