A signed application is software that carries a valid digital signature from a recognized certificate authority or publisher. The signature confirms that the file was produced by the claimed signer and has not been altered since signing. It does not prove the program is safe, necessary, or benign.
This matters in cyber security because attackers can abuse trusted-looking signed binaries to reduce suspicion, bypass weak allow-lists, or blend malicious actions into normal enterprise traffic. Defenders should treat signature status as one signal, not a guarantee: check whether the signer is expected, whether the file path and parent process make sense, and whether the application’s behavior matches its role. A legitimate signature on hostile behavior is a common way malware hides in plain sight.