An invocation is one execution of a serverless function. In platforms such as AWS Lambda or similar event-driven services, each trigger produces a separate invocation, whether the function is called by an API request, a queue message, a schedule, or another cloud event.
Invocation counts matter because they are both a billing unit and a monitoring unit. Security teams use them to spot unusual spikes, repeated failures, or patterns that suggest abuse, such as a function being hammered by automated requests or re-triggered by malicious event loops. Defenders also watch invocations for signs of privilege abuse, secret exposure, or suspicious inputs at runtime. In practice, invocation-level visibility helps distinguish normal bursts of serverless activity from attack traffic and can reveal where controls need to block, not just log, risky behavior.