A workload signal is a measurable indicator that demand, task volume, or processing pressure is rising. In practice, it can be seen in queue depth, CPU usage, request latency, ticket volume, authentication attempts, disk I/O, or the number of jobs waiting to run. The signal does not describe the cause by itself; it shows that a system or team is moving toward saturation.
In cyber security, workload signals matter because overload often appears before a service fails or a defense weakens. Attackers may create abnormal load through DDoS traffic, password spraying, brute-force logins, log flooding, or ransomware activity that spikes file and storage operations. Defenders watch the same signals to detect anomalies, trigger autoscaling, rate-limit abusive traffic, reassign analysts, and prioritize response when one component starts to strain others. A good workload signal is timely, baseline-aware, and tied to an action.