An autonomous daemon is a background service that keeps running without constant human control and can make limited decisions based on rules, state, or model output. In cyber security, this design is often used to automate repetitive work such as scanning, reconciling findings, or chaining tools into a larger workflow.
This matters because persistence and autonomy increase both capability and risk. A daemon can continue operating across multiple steps, remember context, and react to results, which makes it useful for defenders and for offensive tooling. In attacks, that same behavior can help an operator automate reconnaissance or multi-step action chains. In defense, the key controls are tight scope, strong authentication, detailed logging, approval gates, and a safe shutdown path so the service cannot drift beyond authorized boundaries.