Root cause analysis is a structured method for finding the underlying reason a failure or recurring issue keeps happening. In cyber security, it goes beyond the visible symptom - such as an alert, outage, account takeover, or repeated policy violation - to identify the control gap, technical flaw, or process weakness that allowed it. The goal is not just to fix what broke, but to stop the same class of problem from returning.
It matters because security teams often see repeated incidents caused by the same hidden issue: a missing patch, weak authentication, an exposed service, a bad script, or an overly permissive role. A good analysis uses logs, endpoint telemetry, network traces, configuration review, and change records to separate trigger from cause. In defense, root cause analysis supports remediation, hardening, detection tuning, and lessons learned. In attacks, investigators use it to understand initial access, persistence, and why existing controls failed.