Volatile data is information that exists only briefly or changes quickly, such as RAM contents, active network sessions, process lists, open files, and live authentication tokens. Unlike disk files, it can vanish when a system powers off, a process ends, or a connection times out.
It matters in cyber security because these artifacts often show the clearest signs of what a system was doing at the moment of compromise. Attackers may leave payloads in memory, hide command-and-control connections in live sessions, or use fileless techniques that leave little on disk. Defenders and forensic teams collect volatile data early to preserve evidence, confirm whether malware is still active, and identify users, processes, or remote hosts involved. Common practice includes capturing memory, recording running processes and sockets, and documenting timestamps before making changes to the system.