Intrusion reconnaissance is the process of probing systems, networks, and exposed services to identify weak points before a larger attack. It can include port scans, banner grabbing, service enumeration, credential checks, and testing for known flaws on routers, servers, or cloud endpoints. The goal is not immediate disruption; it is to map the environment and find the easiest path to persistence, lateral movement, or data theft.
In cyber security, this matters because reconnaissance often happens quietly and early in the intrusion chain. Attackers may use compromised devices as scanning nodes, proxies, or relays so the probing traffic blends in or hides its source. Defenders look for unusual connection patterns, repeated requests to many hosts, unexpected management logins, and outbound tunneling from devices that should be nearly silent. Good asset inventory, patching, segmentation, and monitoring of edge devices help stop reconnaissance before it turns into a foothold.