Rule bloat is the accumulation of redundant, stale, or overly broad security rules in a firewall, network access policy, or other control system. It usually grows over time as teams add exceptions for urgent business needs, keep temporary rules longer than intended, or duplicate existing permissions instead of refining them.
In cyber security, rule bloat matters because it makes policy harder to read, audit, and enforce. Large rule sets can hide dangerous access paths, create blind spots during reviews, and increase the chance that a misconfiguration leaves too much open. Attackers may benefit when old allow rules, broad source ranges, or forgotten exceptions still permit lateral movement or external exposure. Defenders reduce rule bloat by reviewing usage, removing unused entries, tightening overly permissive statements, and validating that live traffic still matches the intended policy.