Customizations are changes made to off-the-shelf software so it fits a specific business process. They can include custom fields, automations, workflows, reports, access rules, plugins, or handwritten code. In platforms like CRM and ERP systems, customizations often become as important as the base product itself.
From a security perspective, customizations matter because they can expand the attack surface and hide risky logic. Poorly reviewed scripts may bypass approval steps, weaken permissions, expose data, or introduce insecure dependencies. During migrations and audits, defenders review customizations to find what is truly in use, remove abandoned code, and test that business rules still work safely. Attackers also target customizations through malicious extensions, abused integrations, or tampered automation that persists inside trusted business software.