A hardware watchdog is a built-in reliability feature that monitors whether a device is still reporting “keepalive” signals. If those signals stop arriving, the watchdog assumes the system has hung and forces a reboot. This is common in embedded Linux devices, routers, industrial controllers, and other systems that must recover automatically after a crash or lockup.
In cyber security, watchdogs matter because malware can abuse them. An attacker may keep feeding the watchdog from a separate process so the device stays up while malicious code runs, or the malware may arrange to restart itself after every reboot. Defenders also rely on watchdogs, but they need to check whether reboot behavior is normal reliability handling or part of persistence and anti-remediation logic. During incident response, simply killing a process may be ineffective if the watchdog or boot-time scripts bring it back.