A build artifact is any file or package produced by a software build process, such as an executable, installer, library, container image, or signed release archive. It is the output that developers, CI/CD systems, and deployment tools pass along to testing, release, and production.
Build artifacts matter in cyber security because they sit at the boundary between source code and delivered software. If an attacker can alter a build server, pipeline, or artifact repository, they may be able to replace a legitimate artifact with a malicious one, inject backdoors, or tamper with signing and versioning. Defenders therefore treat artifact integrity as part of the software supply chain. Common protections include restricted build access, code signing, checksum verification, immutable storage, and comparing released artifacts against trusted build logs. During incident response, teams often inspect artifacts and their provenance to detect unauthorized changes or hidden payloads.