A security gap is any missing control, boundary, or review point that leaves part of a system less protected than intended. It can be technical, such as an unmonitored service or an open permission path, or procedural, such as a skipped approval, incomplete inventory, or absent verification step. The gap is often not a single flaw, but the space between security controls where assumptions take over.
Security gaps matter because attackers look for the easiest path, not the strongest layer. A missing boundary can let them move laterally, a missing review can allow unsafe changes to persist, and a missing control can create blind spots in logging, access management, or patching. Defenders reduce risk by mapping assets, checking coverage across the full workflow, and testing whether controls actually protect the intended surface, not just the parts that are easiest to see.