A lead indicator is an early signal that suggests a possible security issue and justifies closer scrutiny, even before full evidence is available. In cyber security, it is not proof of compromise; it is a clue that something may warrant investigation.
Lead indicators matter because attackers often reveal themselves in small, early ways: a victim page, unusual authentication attempts, new outbound traffic, or signs of data staging. Defenders use these signals to prioritize checks, collect corroborating logs, and decide whether to escalate response. A strong lead indicator can help teams act faster, but it should always be validated with technical evidence such as endpoint alerts, network records, backups, and identity activity.