The SAM database, short for Security Account Manager, is Windows’ local store for security account material. It holds information about local users and groups, including password hashes for local accounts. In normal operation, the operating system and privileged components use it to authenticate local logons and manage account policy.
In cyber security, SAM matters because it protects credentials that can be abused if an attacker gains high privileges on a host. A user who reaches NT AUTHORITY\SYSTEM or gains offline access to the disk may be able to read SAM data, dump hashes, and try offline password cracking or reuse. That makes SAM a common target in privilege-escalation chains and post-exploitation activity. Defenders protect it by limiting local privilege escalation, hardening endpoint software, monitoring for credential-dumping tools, and treating any path to SYSTEM as a potential path to local account compromise.