Cybersecurity definition
What is IOA?
IOA stands for Indicator of Attack.
By Cyber Tool Stack Editorial TeamUpdated
Definition
A signal that describes an attacker's intent and behavior in progress — such as a process trying to dump credentials — rather than a static artifact left behind, letting defenses catch an attack while it's still unfolding instead of only after the fact.
Where IOA fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
IOCIndicator of CompromiseForensic evidence that a system has already been breached — a malicious file hash, a known-bad IP address, a suspicious registry key — used to detect or confirm past or ongoing compromise.MITRE ATT&CKAdversarial Tactics, Techniques, and Common KnowledgeA free, continuously updated knowledge base, maintained by the MITRE Corporation, that catalogs real-world attacker behavior as a matrix of tactics (the attacker's goal, like lateral movement) and techniques (how it's done), giving defenders a shared vocabulary for describing and detecting threats.