A standards candidate is a proposed algorithm or protocol that is being evaluated before it is formally adopted as a standard. In cryptography, this means the design is still under review for security, performance, and implementation risks. It may be published, tested, and attacked by researchers, but it is not yet the final trusted choice.
This matters because security tools often depend on standards for interoperability and long-term trust. A candidate can look strong on paper and still contain mathematical weaknesses, side-channel exposure, or parameter problems that reduce its real security margin. In practice, defenders track candidates closely, compare alternatives, and avoid treating them as production-ready until the standards process is complete. Attackers, meanwhile, look for flaws during evaluation because this is often the best chance to expose weakness before wide deployment.