The TLS handshake is the setup phase of an encrypted connection. Before any normal application data is exchanged, the client and server negotiate protocol versions, cipher suites, certificates, key exchange material, and session parameters. If this process succeeds, both sides can create shared keys and begin protected communication.
In cyber security, the handshake matters because it happens before the server fully trusts the peer. Attackers often target this stage with malformed packets, repeated connection attempts, or resource-exhaustion tactics that force expensive cryptographic work or memory allocation. A weakness in handshake parsing can lead to crashes, service slowdown, or denial of service even when no login is completed. Defenders watch for incomplete handshakes, unusual connection spikes, and abnormal memory use, and they reduce risk by patching TLS libraries, enforcing limits, and monitoring exposed listeners such as reverse proxies and TLS terminators.