Definition
The distance between what an action looks like on a computer and what it actually means.
The mismatch between syscall- or network-level visibility of agent actions and their intent or business meaning, which renders signature-based defenses blind to context-dependent agent misbehavior.