Publish/subscribe is a messaging model in which senders publish data to named topics and receivers subscribe to the topics they want to monitor. A broker usually sits in the middle and forwards messages from publishers to all matching subscribers, so clients do not need direct point-to-point connections.
This design matters in cyber security because it is efficient, scalable, and often trusted inside telemetry, IoT, and automation systems. Attackers can abuse it for command and control by publishing tasking to a topic that infected hosts subscribe to, then collecting replies through the same broker. That can make malicious traffic look like ordinary application messaging rather than obvious malware beacons. Defenders look for unusual topic names, unexpected client behavior, and hosts using protocols such as MQTT without a business need. Broker logs, network metadata, and endpoint telemetry together help distinguish legitimate pub/sub traffic from covert control channels.