A serverless function is cloud-hosted code that runs only when triggered, so the provider handles the underlying servers, scaling, and maintenance. Common examples include event-driven functions and edge workers that execute small tasks such as processing a request, transforming data, or relaying an API call.
In cyber security, serverless functions matter because they give attackers a fast, low-friction way to collect stolen data, proxy traffic, or automate abuse without operating a visible server for long. Their short-lived, legitimate-looking requests can blend into normal cloud traffic, making detection harder. Defenders watch for unusual function invocations, unexpected outbound connections, suspicious data handling, and cloud accounts used as lightweight infrastructure for exfiltration or command-and-control.