File Integrity Monitoring (FIM) is a security control that watches files, configurations, and other critical objects for unexpected change. It compares current state to a trusted baseline and flags additions, deletions, or edits that should not have happened. That makes it useful for detecting tampering in system files, web content, scripts, or compliance-sensitive settings.
FIM matters because many attacks depend on making quiet changes: planting web shells, altering startup files, weakening security settings, or modifying logs to hide activity. In defense, FIM can surface these changes early, giving analysts a chance to investigate before the alteration spreads or is abused. It is most effective when baselines are maintained, alerts are tuned, and someone owns response. Otherwise, frequent legitimate changes can create noise and alert fatigue. FIM is not a replacement for endpoint protection, access control, or backups, but it adds a valuable layer for spotting configuration drift and unauthorized modification.