What is configuration drift?

More context

Drift is rarely the result of malice; it is the natural entropy of a live environment. A setting is loosened to unblock an incident at 2 a.m. and never tightened again, a default reverts after a patch, a temporary firewall exception outlives the reason it was created. Each change is individually reasonable, but collectively they move a system away from the hardened state it was signed off in, without anyone deciding to weaken security.

What makes drift dangerous is the detection lag. If systems are only checked at audit time, a control can sit broken for a whole cycle before anyone notices, and by then the audit finding is the first signal. Detecting configuration changes against a known baseline shortly after they happen converts that slow, invisible decay into a prompt alert an operator can act on while the context is still fresh.