An event-driven pipeline is a workflow where each completed step emits a signal, or event, that starts the next step. Instead of repeatedly polling a system to see whether data has changed, components react when something happens, such as a file upload, a message arriving, or a scan finishing. In cyber security, this design is important because it supports fast automation, loose coupling, and clear audit trails across tools and services.
Defenders use event-driven pipelines in SIEM, SOAR, cloud security, and malware analysis to chain detections, enrich alerts, quarantine files, and launch response actions as soon as a trigger appears. The same pattern can be abused by attackers: if an attacker can write to a watched folder, queue, or object store, they may trigger malicious processing, stage payloads, or hide activity inside normal workflow noise. Good security therefore depends on authenticating events, validating inputs, and limiting which actions a trigger can start.