The default state is the setting a feature has before a user changes it. In security, that starting point matters because most people never open advanced menus or revisit a setting after installation. If a protection is off by default, it often remains unused even when it could reduce risk.
Attackers benefit when insecure defaults stay in place, such as broad sharing, weak privacy options, or unnecessary network exposure. Defenders try to make safer defaults the standard so protection is active immediately, with no extra action required. In practice, the default state can decide whether a control is only available or actually effective. A feature like ad blocking, multi-factor prompts, or logging may exist, but if it is not enabled by default, its real-world impact depends on user awareness and follow-through.