Change detection is monitoring that identifies modifications to security rules, configurations, or other controlled settings. In cybersecurity, it is used to spot when a firewall rule is added, a policy is weakened, an access control list is edited, or a system setting drifts from the approved baseline. The goal is not just to record the new state, but to reveal what changed, when it changed, and whether the change was authorized.
This matters because many security failures start with small, hard-to-notice edits. A single rule change can open an unexpected path into a network, expose a service, or bypass a control that teams assumed was still active. Defenders use change detection for alerting, auditing, and incident response, especially in large environments where manual review is impractical. Attackers may try to hide persistence by altering configurations, so rapid change detection helps teams catch unauthorized edits before they become lasting exposure.