Clock drift is the gradual divergence between two clocks that are supposed to stay synchronized. Even a small rate difference can add up over time, especially in servers, routers, industrial controllers, and security appliances that depend on accurate timestamps or coordinated actions.
In cybersecurity, drift matters because logs, alerts, certificates, and authentication systems often rely on trusted time. If one device drifts too far, event ordering can become confusing, correlation rules may miss related activity, and incident responders may build a flawed forensic timeline. Attackers can also exploit weak time discipline by delaying detection, causing synchronization failures, or creating uncertainty about when actions occurred. Defenders reduce the risk with NTP monitoring, multiple trusted time sources, drift alarms, and hardware time references where precision is critical.