Carrier-grade NAT (CGNAT) is a large-scale form of network address translation used by internet providers and large operators to let many devices share a smaller pool of public IPv4 addresses. It rewrites traffic so multiple private hosts can appear to come from the same public IP, while keeping internal addresses hidden behind the translation layer.
CGNAT matters in cyber security because it affects attribution, logging, and blocking. Attackers can use translation layers to make scanning, abuse reports, and source tracing harder. Defenders rely on logs, timestamps, and port mappings to correlate sessions that pass through CGNAT. The presence of a CGNAT address in certificate metadata, DNS records, or service inventories can also be a useful clue: it may indicate that a system is not directly exposed, but sits behind shared address space and an internal network boundary. That makes CGNAT both a practical networking tool and an important hint during investigation.