Diagnosis is the process of identifying which component, service, or subsystem is causing a fault. In cyber security, it is the step that turns a vague symptom such as slow traffic, failed logins, or repeated crashes into a specific technical cause. Good diagnosis reduces guesswork, prevents wasted effort, and helps defenders decide whether they are dealing with a configuration error, a broken dependency, malware, or active intrusion.
In real operations, diagnosis may involve checking logs, comparing normal and abnormal behavior, isolating endpoints, and testing individual services one at a time. Attackers also rely on diagnosis when they probe a target to find the weakest control, the exposed port, or the misconfigured account that will let them move forward. Defenders use the same discipline to contain incidents quickly: identify the failing subsystem, verify the root cause, and avoid assuming the first visible symptom tells the whole story.