Post-market surveillance is the practice of monitoring a system after it has been deployed to detect failures, drift, misuse, or safety issues that were not visible in pre-release testing. In cyber security, this matters because a product’s real operating environment is often more hostile and unpredictable than its lab environment. New users, new data, configuration changes, and adversarial activity can all change how a system behaves.
In defense, post-market surveillance uses logs, alerts, telemetry, user reports, and incident reviews to spot problems early. It can reveal performance degradation, false positives, broken controls, or emerging attack patterns. In attacks, defenders may notice that a model, service, or device is being probed, manipulated, or fed poisoned inputs only after deployment. Good surveillance supports rapid patching, rollback, rule updates, and accountability, making security a lifecycle activity rather than a one-time launch check.