Novelty is something that stands out because it feels new, unusual, or surprising. In cyber security, novelty matters because attackers often rely on unfamiliar techniques, file types, or visual tricks to bypass both human suspicion and automated detection. A payload that looks unlike known malware may avoid simple signatures, and a spoofed login page or document may seem more convincing when it uses a fresh design or an unexpected format. Novelty can also work as a social-engineering tool: people are more likely to click, trust, or inspect something that appears rare or interesting.
Defenders care about novelty too. Security teams watch for novel behavior such as unusual process chains, new network destinations, or first-time-seen binaries, because “new” is often a useful indicator of compromise. At the same time, novelty alone is not proof of malicious activity; legitimate software updates and new business tools also introduce change. Effective defense combines novelty detection with baselines, reputation checks, and behavioral analysis to tell harmless change from an attack.