Home / Knowledge hub / Infrastructure drift
Knowledge hub
Infrastructure drift
Live systems slowly differing from what your code says they should be.
What it means
Infrastructure drift is the gap between the infrastructure you have defined in code and the infrastructure that is actually running. It appears when someone changes a setting by hand in a cloud console, when an emergency fix is never written back, or when a tool changes a resource on its own. The difference may be tiny, like one open port, or large, like a whole server nobody remembers creating.
The code says one thing and the live system does another. Anything you reason about from the code, including its security, may no longer be true of what is running. That is why drift is a security concern as well as a tidiness one.
Why it matters
Drift is how safe configurations quietly stop being safe. A storage bucket made private in code can be made public in a console during a late-night fix. A firewall rule opened for testing stays open. Nobody decided to weaken anything, yet the exposure is real.
It also weakens recovery and audits. If you cannot rebuild an environment from code because the live one has diverged, disaster recovery is a guess. An auditor comparing your documented standard with the live setup finds a difference you cannot explain. Related to cloud misconfiguration.
How it shows up
You meet it in infrastructure as code tools, which can compare the stored plan with live state and report differences. You also meet it as one-off manual changes, hotfixes made on a server, and settings that differ between staging and production for no recorded reason.
The mistakes repeat: allowing console access for routine changes, treating a drift report as noise, and fixing the live system without fixing the code. Run drift checks on a schedule, restrict who can edit by hand, and make every emergency change get written back as a pull request.
Questions people ask
Infrastructure drift, answered
Is infrastructure drift a security problem or an operations problem?
Both. It starts as an operational habit, but the effect is security: a control you believe is in place may have been undone.
Treat an unexplained difference as something to explain, not just to tidy.
How do you detect drift?
Infrastructure as code tools can compare declared state with live state and list the differences. Cloud configuration monitoring can flag changes outside your pipeline.
Review the report and decide each time whether the code or the live system is right.
Should we automatically overwrite drift?
Sometimes. Automatic correction keeps things consistent, but it can also undo an emergency fix that was needed or hide a change someone should explain.
Many teams alert first and correct automatically only for low-risk settings.
Does using infrastructure as code prevent drift?
No. It makes drift visible, because there is something to compare against. Drift still occurs if people can change things outside the code.
Limiting manual access is the preventive step.
Can a penetration test find drift?
It finds the results of it: an exposed service, an open port or a permissive setting that the code says should not exist.
It does not compare code to live state, so pair it with drift checks.
Related
Terms that sit next to this one
Infrastructure as code
Describing servers and networks in files so they can be reviewed and repeated.
Cloud misconfiguration
A cloud setting left unsafe, such as open storage or an overly broad permission.
Terraform misconfiguration
An insecure setting written into infrastructure code and then deployed at scale.
CSPM
Tools that keep checking your cloud settings against security good practice.
Attack surface
Everything about your application an outsider can touch.
What is exposed that the code denies?
Drift leaves exposures the code never mentions. We find vulnerabilities in the running web app and its APIs, and report only what we actually exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.