A feature flag is a software switch that turns a specific behavior on or off without requiring a new product version. Developers use it to expose experimental code, limit a feature to certain users, or disable risky functionality quickly if something breaks. In Windows preview environments, for example, flags can control whether an Insider feature is active, changing how the system behaves while the underlying build stays the same.
In cyber security, feature flags matter because they change the effective behavior and attack surface of a system. A disabled path may hide vulnerable code from normal users, while an enabled flag can reveal new services, UI actions, or APIs that need hardening. Attackers sometimes look for misconfigured or hidden flags to reach unfinished functionality, and defenders use flags to test mitigations, roll back unsafe changes, or stage protections gradually. For reliable analysis, security teams should track which flags are enabled on each system and treat flagged features as part of the trust boundary.