Default enrollment is a policy state where people are included in a data use, feature, or security program unless they actively change a setting. Instead of an explicit opt-in, participation is assumed until the user opts out. This can apply to analytics, data sharing, AI training, email routing, or security controls such as beta protection features.
In cyber security, default enrollment matters because defaults shape real-world behavior at scale. If the safer or more private choice is buried behind a toggle, many users never change it, and data may be collected, retained, or reused more broadly than expected. Defenders use secure defaults to reduce exposure, while attackers may exploit confusing enrollment settings, hidden consent screens, or preselected permissions to gain access to data or trust. Good practice is to make the default clear, document what it covers, and log when a user changes it.