Degraded performance means a service is still running, but it is slower, less responsive, or less reliable than users expect. In practice, the system may time out, reject logins intermittently, or complete requests only after delays. Unlike a full outage, degraded performance can be easy to miss at first because the service has not fully stopped.
In cyber security, degraded performance matters because it can be an early sign of overload, misconfiguration, failing infrastructure, or an attack such as denial of service. It can also appear during defensive actions like rate limiting, traffic filtering, or failover to backup systems. For defenders, tracking performance drops helps distinguish normal load from an emerging incident and supports faster response before a partial disruption becomes a complete outage.