An unused rule is a security control written into policy that does not appear to match real traffic or events. In firewalls, IDS/IPS systems, cloud security groups, and access-control lists, this often means the rule has a hit count of zero or no observable enforcement activity over time.
Unused rules matter because they can hide policy drift. A rule may be left behind after an application changes, a migration ends, or an exception is no longer needed. In defense, reviewing unused rules helps teams remove stale permissions, reduce clutter, and spot gaps where a control was expected but never actually enforced. In attacks, obsolete rules can also create risk by preserving access paths that defenders assume are blocked. Hit counts, logs, and configuration audits are common ways to identify them, but a zero count should always be reviewed in context before deletion.