Firmware persistence is a technique where malware embeds itself in a device’s firmware or adjacent low-level components, such as bootloaders, embedded controllers, or management modules. Because firmware runs below the operating system, the malicious code can survive reboots, disk wipes, and some software reinstallation efforts.
This matters in cyber security because firmware-level threats are harder to detect and remove than ordinary user-space malware. Attackers may use it to keep long-term access to routers, firewalls, servers, or other trusted infrastructure, especially in the management plane. Defenders respond with signed firmware, secure boot, hardware-backed integrity checks, inventorying device images, and, when compromise is suspected, rebuilding or replacing the device rather than trying to clean it in place.