Compromise indicators are observable signs that a system may have been breached. They can appear in logs, files, network traffic, or system behavior: unusual login times, failed authentication spikes, new admin accounts, unexpected outbound connections, altered web files, or processes spawning in a suspicious chain. An indicator is not proof by itself, but several together can strongly suggest malicious activity.
In cyber security, compromise indicators matter because they help defenders detect intrusion, confirm scope, and decide what to isolate first. On exposed appliances such as remote-access gateways, analysts often review authentication logs, request patterns, configuration changes, and file integrity for evidence of abuse. During active exploitation, these signals can show whether attackers only probed the device or used it as a foothold to reach internal services. Good incident response treats compromise indicators as clues for scoping and containment, not as a single yes-or-no test.