Orphaned infrastructure is public-facing system resources that were left behind after a migration, project shutdown, rebrand, or ownership change. These assets may still answer on the internet even though no team is actively monitoring them, patching them, or keeping their access controls current.
It matters because unmanaged public systems are easy targets. Attackers scan for forgotten domains, cloud instances, APIs, storage buckets, and web apps, then exploit weak passwords, unpatched software, or exposed data. Defenders use external attack surface management, asset inventories, and decommissioning checks to find and remove these leftovers before they become entry points. In practice, orphaned infrastructure is often less a new vulnerability than a visibility failure: the system still exists, but nobody is responsible for it.