Attack evidence is the collection of traces an incident leaves behind: logs, alerts, file changes, network connections, account activity, malware artifacts, and deleted-but-recoverable data. These traces may be small, but they help defenders reconstruct what happened, when it happened, and how far the attacker moved.
In cyber security, evidence matters because many attacks are invisible while they are happening. Spyware, phishing, and unauthorized access can be missed if logs are disabled, messages are erased, or device activity is brief. Features that preserve attack evidence try to keep useful traces intact so incident responders can investigate, confirm compromise, and decide whether containment is enough or a full reset is needed. Good evidence also supports attribution, reporting, and future hardening. Without it, defenders are left guessing, which slows response and can hide the attacker’s next move.