Context shift is when a message changes meaning as it moves from one setting to another. The words may stay the same, but the surrounding cues — sender, channel, timing, format, and audience — change how people interpret them.
In cyber security, context shift matters because attackers often rely on it to make malicious content look normal. A phishing link copied into a chat app, a screenshot stripped of email headers, or a warning reposted on social media can all lose the details that help users verify it. Defenders also have to manage context shift by preserving metadata, using consistent branding, and confirming messages through official channels. If a security alert is forwarded without its original source, it can be misunderstood, ignored, or exploited. Checking context is a basic defense against spoofing, social engineering, and misinformation.