A security token is a Windows data structure that represents a user’s identity after logon. It carries the user’s SID, group memberships, privileges, integrity level, and other authorization details that Windows uses to decide what the session may do. When a process starts, it usually inherits or receives a token, and that token becomes the basis for access checks.
This matters in cybersecurity because many defenses depend on tokens being created and enforced correctly. Least-privilege controls, User Account Control, Remote Desktop logon, and administrator elevation all rely on token handling. If token creation, filtering, or assignment fails, a user may lose access unexpectedly, or a malicious process may try to abuse a higher-privileged token to gain more rights. In real attacks, defenders look for stolen or duplicated tokens as a sign of privilege escalation; in defenses, they verify that tokens reflect the right user and restrictions before allowing a session or command to proceed.