Boot-time persistence is a property of malicious or unauthorized code that causes it to start automatically whenever a device powers on. Instead of running only as a temporary process, the code is tied into startup paths such as firmware, boot loaders, services, or scheduled startup hooks. That makes it harder to notice and remove, because the code can return after a reboot even if a running process is terminated.
In cyber security, boot-time persistence matters because it gives attackers durable control over endpoints, routers, and other infrastructure devices. It can let them preserve access, reapply settings, or launch a command channel before security tools fully load. Defenders look for unexpected startup entries, altered firmware, unsigned images, and unusual network activity immediately after boot. Protecting against it means verifying trusted firmware, monitoring startup locations, and treating firmware changes as high-risk events.