In MQTT, a broker is the server that sits between clients and routes messages from publishers to subscribers. Clients do not usually talk to each other directly; instead, they send data to topics on the broker, which delivers it to every subscribed client. The broker also handles session state, access control, retained messages, and sometimes authentication and encryption.
This matters in cyber security because the broker can become both a chokepoint and a covert command layer. In legitimate environments, defenders use broker logs to see which clients connected, what topics they used, and whether unusual message patterns appeared. In abuse cases, attackers can publish commands to a topic and have compromised hosts subscribe to it, making the traffic look like ordinary messaging rather than direct malware beacons. Monitoring broker activity, topic names, client identities, and message volume helps expose misuse.