The TZ environment variable tells a process which timezone to use when converting, formatting, or comparing time values. In many shells and applications, it can change how a program interprets local time without changing the system clock. That makes it a normal part of everyday computing, but also a security-relevant input whenever software uses time for access control, logging, expiration checks, or policy enforcement.
In cyber security, TZ matters because time-based decisions must be predictable and consistent. If a privileged tool trusts timezone information from the environment, an attacker may try to influence deadline checks, scheduled access windows, or audit output. Defenders reduce risk by sanitizing environment variables in privileged contexts, normalizing time handling to a trusted source such as UTC, and avoiding security decisions that depend on user-controlled locale or timezone state.