Pull up almost any breach post-mortem and you'll rarely find a company that had no security. You'll find one that had good security — for the environment it ran three years ago. The firewall was tuned, the access list was tight, the patch cadence was real. Then the business kept moving, and the controls quietly stopped keeping up.
I call this security drift: the widening gap between the defenses you designed and the ones you actually have today. Nobody votes to weaken them. They weaken because everything around them changes and they don't.
Your defenses are a snapshot; your business is a movie
Every control you deploy is a bet on a specific moment — this network, these users, this threat model. That moment expires. A rule written for a 40-person company still runs at 400. An exception granted "just for the migration" outlives three CTOs. The control didn't fail. Reality moved out from under it.
Drift is dangerous precisely because it's quiet. There's no alert for "this policy stopped matching how we work." Everything stays green until the day it very much isn't.
Where drift creeps in
In my engagements, the same handful of places leak protection over and over:
- Identity and access. Joiners get accounts; leavers keep them. Contractors accumulate roles they never shed. Six months in, half your privileged access has no living justification.
- Firewall and cloud rules. The "temporary" 0.0.0.0/0 rule someone opened at 2 a.m. to unblock a launch. It's still there. It's always still there.
- Configuration baselines. You hardened the golden image in 2023. Every server since has drifted a little — a debug flag here, a downgraded cipher there — and nobody re-baselined.
- Dependencies and patches. A library that was current at ship time is three CVEs behind by the next quarter. The code didn't change; the world's opinion of it did.
- People and process. The security champion who ran the phishing drills left. The runbook now points to a Slack channel that was archived months ago.
Why your audit says you're fine
Because most audits test whether a control exists, not whether it still fits. A point-in-time report is a photograph — useful, and out of date the moment it's printed. Attackers don't work in snapshots. They probe continuously, and they find the gap between your last review and today.
Compliance measures whether you passed. Drift measures whether you'd still pass if someone checked right now.
That's the trap of treating security as a project with an end date. It's a running system, and running systems need maintenance, not just launches.
How to stop the slide
You don't beat drift with more tools. You beat it by making the current state visible and by giving every control an expiry.
- Make state continuous, not annual. Config-drift detection, cloud posture scanning, and dependency alerts should run daily and page a human on deviation — not wait for an auditor.
- Give access a lifespan. Default to time-bound, just-in-time grants. Access that has to be renewed can't silently accumulate. Review privileged roles quarterly and actually delete, don't rubber-stamp.
- Put an expiry on exceptions. Every "temporary" firewall rule or policy waiver gets a ticket and a kill date. If it's still needed, someone re-argues for it. If not, it dies on schedule.
- Re-baseline on a cadence. Treat your hardened config as code, diff live systems against it, and alert on the delta. Drift you can see is drift you can fix.
- Assign an owner. A control with no name attached rots. Every critical defense needs a person accountable for its fitness, not just its existence.
Where to start Monday
Don't boil the ocean. Pick your single highest-value asset and ask three questions: Who can reach it today, and does each of them still need to? What rules and exceptions guard it, and when did we last justify them? How fast would we notice if its configuration changed? Getting honest answers for one system usually exposes the pattern across all of them.
Security isn't something you install. It's something you keep — and drift is the interest you pay for not paying attention.