IKEv2 SA_INIT is the first negotiation step in an Internet Key Exchange version 2 handshake. During this exchange, two peers agree on cryptographic algorithms, exchange nonces and Diffie-Hellman values, and create the initial Security Association that protects later IKE traffic. It happens before normal VPN access or application authentication is established.
This stage matters because it sits at the network edge and is often reachable from the internet on VPN gateways and IPsec responders. Attackers look for bugs in SA_INIT parsing or state handling because the code may run before user authentication, making pre-auth exploitation possible. Defenders reduce risk by patching responder systems quickly, limiting exposure of UDP 500 and 4500, and watching for unusual negotiation traffic, crashes, or repeated handshake failures.