An indicator of compromise (IoC) is a piece of information indicating that a cyberattack may have breached an IT system. IoCs provide important knowledge about potential data breaches, allowing security teams to investigate incidents.
Typically, a computer security incident response team (CSIRT) uses IoCs to detect malware threats, implement sandbox security, and evaluate the accuracy of heuristic analysis. Indicators of compromise also help identify, prevent, or block attacks, reducing the damage to an organization.