Documentation drift is the growing gap between what a system record says and how the technology is actually used. It happens when devices are moved, repurposed, patched, or linked into workflows without the inventory, diagrams, or runbooks being updated.
In cyber security, documentation drift matters because defenders rely on records to know what exists, who owns it, and how it should be protected. If the documentation is stale, hidden dependencies and forgotten legacy components can escape monitoring, patching, and access control. Attackers benefit from that uncertainty: an untracked device or unexpected connection can become a weak entry point, especially in older environments. Good asset inventory, regular configuration reviews, and clear ownership help reduce drift and keep security decisions based on reality rather than outdated paperwork.