A failure state is the condition a system enters when a component stops working or an important assumption no longer holds. In practice, it is the “what now?” moment in a design: a server is unreachable, an authentication step times out, a backup path is missing, or a user action is not what the system expected.
In cybersecurity, failure states matter because attackers often look for them. A broken error path, unsafe default, or incomplete recovery flow can reveal data, bypass checks, or leave services open to abuse. Defenders study failure states to build safer systems: fail closed instead of open, isolate damaged components, log unexpected transitions, and make recovery predictable. Good security engineering assumes that parts will break and designs for safe behavior when they do.