A local artifact is data stored on a device that can reveal user activity, application state, or recent workflow context. Examples include caches, logs, preference files, timeline records, browser data, and app-specific history kept on disk or in local databases.
In cyber security, local artifacts matter because they often survive after an app closes and may be readable by malware, forensic tools, or an attacker with local access. Infostealers and endpoint malware look for these traces to reconstruct what a user opened, which services were used, or what files and accounts may be present. Defenders also use local artifacts during incident response to understand execution, persistence, and user behavior. Reducing exposure means limiting what is stored, protecting file permissions, encrypting sensitive data, and reviewing whether convenience features create unnecessary endpoint breadcrumbs.