3270 screens are terminal-style user interfaces used to interact with IBM mainframe systems. Instead of windows and mouse-driven controls, they present text fields, function keys, and fixed-screen workflows designed for fast transaction processing. They remain common in banking, insurance, government, and other environments where mainframe applications still handle critical data.
In cyber security, 3270 screens matter because they often sit at the boundary between modern networks and older business logic. Attackers may target the accounts, sessions, or middleware that expose these terminals, while defenders must protect them with strong authentication, session controls, logging, and careful access segmentation. Their simplicity can also hide risk: if an interface looks outdated, teams may underestimate it, but it may still provide direct access to sensitive records and privileged functions. In practice, 3270 screens are a sign of legacy operational patterns that need the same hardening as any modern application.