State drift is the gap between what a system is supposed to be doing and what is actually running. In cybersecurity, this often means the live configuration, services, interfaces, or access paths no longer match the approved configuration or change record. On network devices, drift can show up as an unexpected tunnel, route, firewall rule, account, or process that exists in memory even though it is missing from documented settings.
It matters because defenders rely on recorded state to judge whether traffic paths and privileges are legitimate. If drift is not detected, an attacker can hide persistence, bypass controls, or create a management path that survives normal review. Defenders look for drift by comparing running state to desired state, auditing commits, checking interface and process inventories, and validating remote access methods. Treat unexplained drift as a security signal, not just a configuration problem.