Grounding context is external or curated evidence supplied to an AI system so its answers are based on facts rather than guesswork. In practice, this can include approved documents, ticket histories, threat intel feeds, log data, or database records that the model is allowed to reference while generating output.
In cyber security, grounding context matters because unsupported answers can misclassify alerts, invent remediation steps, or hide important indicators. A grounded SOC assistant can summarize an alert using the actual event log, a policy document, and a known-IOC list instead of relying on memory. Defenders use grounding with retrieval systems, schema checks, and human review to reduce hallucinations and make outputs auditable. Attackers may try to poison the context with false documents or prompt injection, so the source set must be trusted, narrow, and regularly validated.