Workflow risk is the security exposure built into routine business processes such as approvals, identity verification, ticket handling, content review, and automation. Instead of attacking only servers or networks, an adversary targets the steps people already trust to get work done.
This matters because workflows often carry implicit trust. A stolen account, a fake approval, a manipulated request, or a misconfigured automation can let an attacker bypass stronger perimeter defenses and gain access, move laterally, or trigger harmful actions. Defenders reduce workflow risk by designing security into the process: least privilege, step-up authentication, segregation of duties, audit logging, exception review, and safe defaults for automation and AI-assisted actions. Good workflow security makes the secure path the normal path.