A proof-of-concept, or PoC, is a demonstration created to show that a technique, weakness, or attack path is technically possible. In cybersecurity, a PoC may be a short script, test program, or controlled lab example that proves an idea works without claiming it is a finished malware tool or a confirmed campaign artifact.
PoCs matter because they help defenders validate risk before an issue is widely abused. Security teams use them to reproduce behavior, test detections, confirm mitigations, and understand how a legitimate feature can be turned into an attack primitive. In real incidents, a PoC may demonstrate exploitation of a vulnerability, abusive use of an API, or disruption caused by normal system behavior at scale. A PoC is evidence of feasibility, not proof of real-world prevalence.