Process abuse is the exploitation of business procedures, approval paths, or trust rules instead of a software flaw. An attacker uses the organization’s own workflow against it, for example by submitting a request that looks valid, urgent, or authoritative enough to bypass normal scrutiny. The goal is not to break code, but to get a person or team to take an action that the process would usually prevent.
This matters because many security controls depend on human verification: account recovery, data disclosure, payment approval, vendor onboarding, and incident response. If those steps are too fast, too trusting, or poorly separated, an attacker can obtain sensitive data, authorize fraud, or change records without ever exploiting a technical vulnerability. Defenses include independent verification through a separate channel, least privilege, strong logging, approval separation, and clear hold points for high-risk requests. In practice, process abuse is a common form of social engineering aimed at the workflow itself.