First-run setup is the initial onboarding flow a device shows after a proper factory reset. On a Chromebook or similar endpoint, it usually includes language selection, network setup, account sign-in, and any owner or management enrollment steps. If the device skips this flow and goes straight to a desktop, that can be a sign it was not fully reset or that some configuration remains from a previous user.
In cyber security, first-run setup is a practical trust check. Defenders use it to confirm a refurbished or transferred device is behaving like a clean endpoint, not a reused one with hidden settings, enterprise enrollment, or unwanted persistence. Attackers may try to interfere with this stage by leaving management links in place, preloading unwanted profiles, or redirecting the user into a controlled sign-in path. Verifying the genuine first-run experience helps ensure the device is ready for a new owner and safe for real accounts.