A state change is any action that updates a system of record. In cyber security, that can mean changing an account password, editing a bank detail, approving a request, creating a new record, or submitting a claim. It is different from simply reading data: a state change alters what the system believes is true, and that can have lasting business or legal effects.
This matters because attackers often aim for integrity, not just theft. If an adversary can trigger an unauthorized state change, they may redirect payments, alter identity details, or create fraudulent transactions without needing broad access to all data. Defenders therefore treat state-changing actions as high-risk events and protect them with least privilege, step-up approval, audit logs, and rollback procedures. In agentic AI systems, the risk grows further because tools can perform changes automatically, so every action needs clear authorization and traceability.