Compliance drift is the slow, often unnoticed divergence of a live system from the security baselines, governance rules, or configuration standards it was supposed to follow. In SaaS and cloud environments, it can happen when admins add exceptions, teams connect new apps, permissions expand, or default settings change without a formal review.
It matters because small deviations can create real exposure: overprivileged accounts, disabled logging, weak authentication, or unapproved integrations may all appear “normal” until an audit or incident reveals them. Attackers benefit from drift because it creates gaps between policy and reality, while defenders use posture management, configuration monitoring, and periodic access reviews to detect it early. In practice, compliance drift is less about one bad setting than about control erosion over time.