Root compromise means an attacker has obtained full administrative control of a system. On Unix-like systems, this usually means root access; on other platforms, it is the equivalent highest privilege level. At this point, the attacker can often run unrestricted commands, change settings, create or delete accounts, disable security tools, and alter logs.
This matters because root compromise turns a single vulnerability into total system ownership. In cyber attacks, it may follow privilege escalation, stolen admin credentials, or flaws in exposed management services and perimeter appliances. Defenders treat root compromise as a critical incident because the attacker can hide persistence, steal secrets, and use the system as a launch point into internal networks. Signs may include unexpected configuration changes, new privileged users, unusual shell access, and suspicious process or log activity. When root compromise is suspected, containment, credential rotation, and rebuilding the system from trusted media are often safer than trying to “clean” it in place.