Process bypass is an attack that succeeds by sidestepping a security control through weak procedures, human judgment, or broken approval flow rather than by hacking a system directly. Instead of defeating encryption, authentication, or access control, the attacker convinces someone or some team to treat a malicious request as legitimate.
This matters because many sensitive actions depend on workflows such as support verification, compliance review, legal requests, or identity checks. If those steps rely on trust cues like email formatting, sender reputation, or informal escalation paths, an attacker can exploit the gap and obtain data or approvals without a conventional breach. In real defenses, process bypass is reduced by strict verification rules, dual approval, logging, callback validation, and least-privilege handling of sensitive disclosures. The security lesson is that the workflow itself is part of the attack surface: when legitimacy checks are weak, the attacker may not need to break in at all.