An instruction-set architecture, or ISA, is the contract between software and a processor. It defines the instructions a CPU can execute, the registers it exposes, how memory is addressed, and how code is represented at the machine level. An operating system, compiler, or binary built for one ISA cannot run unchanged on another ISA without translation or emulation.
In cyber security, the ISA matters because malware, exploits, and defensive tools are often architecture-specific. Attackers may ship different payloads for x86, ARM, or IA-64, and shellcode must match the target instruction set to execute correctly. Defenders rely on ISA knowledge to reverse engineer binaries, build sandboxes, and emulate legacy systems when real hardware is unavailable. Understanding the ISA helps analysts identify compatible code paths, detect obfuscation, and safely inspect software built for rare or obsolete platforms.