Scope of compromise is the verified extent of harm caused by a security incident. It answers what was actually affected: which systems were accessed, what data may have been exposed or altered, and which users or accounts were impacted. The key word is verified. A claim, alert, or victim listing may suggest an incident, but the scope is only known after logs, endpoint data, identity records, and forensic findings are checked.
This term matters because response decisions depend on it. If the scope is narrow, defenders may isolate a single host or reset a small set of credentials. If it is broad, they may need to disable accounts, segment networks, notify customers, and preserve evidence for investigation. In real attacks, threat actors often try to inflate the apparent scope to create pressure, while defenders work to separate rumor from confirmed impact. A clear scope of compromise helps teams prioritize containment, recovery, legal duties, and communications.