DeviceIoControl is a Windows user-mode API for sending IOCTLs, or Input/Output Control requests, to a device driver. An application opens a device handle and uses this call to ask the driver to perform a specific operation, such as reading device state, changing configuration, or triggering privileged functionality exposed by the driver.
It matters in cyber security because DeviceIoControl is often the bridge between untrusted user space and trusted kernel code. If a driver exposes sensitive IOCTLs without strong authorization checks, any process that can reach the device may be able to abuse those operations. In attacks, a legitimate but compromised client can become the “trusted caller” that forwards dangerous requests into the driver. Defenders should restrict device access with security descriptors and ACLs, and validate the caller and request at the moment each IOCTL is processed, not just when the device is first opened.