Indirect measurement means learning about a system by observing its effects instead of the thing itself. In cyber security, defenders often cannot see malware, credentials theft, or data exfiltration directly, so they infer them from symptoms such as unusual network flows, process behavior, authentication failures, DNS patterns, or changes in resource use. This approach matters because many attacks are designed to hide from direct inspection, while logs and telemetry still expose traces.
Indirect measurement is also part of attack technique. Adversaries may use side channels, timing differences, cache behavior, or traffic analysis to learn secrets they cannot read outright. Defenders use the same principle for detection, correlating weak signals across endpoints, servers, and networks to build confidence in an incident. The key challenge is separating real signal from noise: a single anomaly may be harmless, but repeated patterns across multiple measurements can reveal compromise, persistence, or data leakage.