A detection signal is evidence that makes suspicious activity easier to identify with higher confidence. It can be a single clue, such as an unusual login pattern, or a stronger combination of events, such as a decoy being touched, a rare process starting, and a network connection to an unexpected host.
In cyber security, detection signals matter because defenders rarely get perfect proof from one alert. They instead combine signals from logs, endpoint telemetry, identity systems, network traffic, and deception tools to decide whether activity is normal, noisy, or malicious. Strong signals help reduce false positives and speed up response, while weak or poorly tuned signals can create clutter. During attacks, signals often appear in reconnaissance, credential abuse, lateral movement, or interaction with traps and honeypots. Good defenders look for patterns that increase confidence, not just isolated alerts.