Configuration drift

Configuration drift is divergence between a device's approved configuration — a golden config or a published benchmark — and its running configuration. It accumulates through ordinary operations: a port opened for a vendor and not closed, a TLS policy loosened for an old client, a protection switched from prevention to detection during an investigation and never switched back.

Drift is rarely malicious and frequently dangerous, because it creates exactly the conditions attacks exploit while every compliance record stays green. It is detected by pulling configuration from devices on a schedule, versioning it, and re-evaluating policy rules against each new snapshot so a failure points at a specific line on a specific asset.