Ad hoc signing is a macOS code-signing mode that records file hashes but does not include a CMS signature or a trusted developer identity. It can be created locally and is useful for testing or internal builds, but it does not provide the same assurance as a Developer ID signature or notarization.
In cyber security, ad hoc signing matters because it is a weak trust signal. Defenders may use it as one clue when triaging suspicious binaries, especially if a sample is unsigned or inconsistently signed. Attackers may also rely on it to make software appear more structured than a completely unsigned file, even though it does not establish provenance. For detection, analysts should combine signing state with path, process behavior, parent-child relationships, and network activity rather than treating ad hoc signing as evidence of legitimacy.