A suspect is a person under investigation, not someone proven guilty. In security work, this distinction is critical: suspicion can justify further inquiry, but it is not evidence of responsibility on its own. Investigators may name a suspect when there are leads, patterns, or links worth testing, while courts require proof before any finding of guilt.
In cyber security, the word appears often in reports about intrusions, fraud, extortion, or account abuse. A suspect may be linked to aliases, IP addresses, devices, payment trails, or chat logs, but each clue still has to be verified and connected to a larger evidentiary picture. For defenders, using the term carefully helps avoid false attribution, protects the integrity of an investigation, and reduces the risk of treating an allegation as fact. For reporters and analysts, it is a reminder to separate under investigation from proven actor.