A configuration error is a wrong or incomplete setting that changes how a system is exposed, controlled, or protected. It can be as simple as a firewall rule that is too open, a storage bucket that is public, a test server left reachable from the internet, or an authentication control that is turned off by mistake.
These errors matter because attackers often look for them first. A well-built system can become vulnerable without any code being exploited if the surrounding settings are weak. Configuration mistakes can reveal internal services, sensitive metadata, administrative interfaces, or paths into a network that were meant to stay private. In many breaches, the weakness is not advanced malware but an asset that was deployed with unsafe defaults or never reviewed after setup.
Defenders reduce this risk with secure baselines, change control, access reviews, segmentation, and regular scanning for exposed services. In practice, configuration management is a core security control: if settings drift, protection can disappear even when the software itself is unchanged.