A security signal is a data point or event that may indicate a meaningful change in exposure, behavior, or control health. It is not always proof of an incident; instead, it is a clue that something in the environment may deserve closer review. Signals can come from logs, alerts, configuration changes, user behavior, threat intelligence, or compliance checks.
Security teams rely on signals to separate routine noise from real risk. A spike in failed logins, a new admin account, an unusual outbound connection, or a missing patch can all be signals that support investigation. Attackers may generate signals through reconnaissance, credential abuse, or malware activity, while defenders create signals through monitoring, detection rules, and control testing. The key is correlation: one weak signal may be harmless, but several aligned signals can reveal an active threat or a weakening control.