Change monitoring is a defensive security practice that watches for unexpected modifications in files, system configurations, software updates, and privileged account activity. It compares a known-good baseline with current state so defenders can spot when something has been added, removed, or altered without approval.
This matters because many attacks succeed by changing trusted components rather than breaking them outright. An attacker may tamper with an update, replace a script, modify permissions, or use admin access to hide persistence. In supply-chain and insider scenarios, those changes can look legitimate unless they are tracked carefully. Effective change monitoring helps teams detect unauthorized code, suspicious package updates, altered logs, and unusual administrative actions early. It is often paired with file integrity monitoring, audit logs, configuration management, and alerting on privileged behavior, so defenders can quickly verify whether a change is expected or a sign of compromise.