Reach Security found 97% of surveyed organizations experienced a confirmed breach or near miss tied to security tool misconfigurations in the past year, underscoring configuration drift as a persistent cybersecurity risk.
The report also found organizations take an average of 8.3 days to remediate identified issues, leaving security controls exposed even as teams review configurations multiple times each month.
Configuration drift creates persistent security exposure
Configuration drift occurs when the actual settings of a computer system or cloud environment slowly change – no longer matching the original planned baseline state – due to untracked changes over time.
This can be caused by manual changes, inconsistent automation, software updates, and external integrations.
Drift increases the risk of outages, security vulnerabilities, compliance failures, and unexpected costs.
Reach Security’s 12-month telemetry report, Security Intent vs. Security Reality: Configuration Drift in the Age of AI, surveyed 250 U.S. cybersecurity professionals to understand the impact of security control misconfigurations and configuration drift.
The research’s findings exposed the scale of configuration drift, prompting Reach to analyze telemetry data from more than 50 production environments to examine how it manifests in real-world environments, where it originates, and the level of risk it poses.
This independent analysis supporting the report found that 97% of surveyed organizations had experienced a confirmed breach or near miss linked to cybersecurity tool misconfigurations in the past year.
Further, organizations take 8.3 days to remediate identified issues, despite reviewing security tool configurations an average of 6.5 times per month.
Firewalls emerge as the biggest source of drift risk
Firewalls were identified as the most common source of drift-related data breaches, with 42% reporting a breach or near miss originating from a firewall. Endpoints were second most – reported by 40%.
“Configuration drift is no longer just an operational issue; it is a growing security risk. Our research highlights a widening gap between how quickly attackers can exploit weaknesses and how long it takes organizations to identify and remediate them,” said Garrett Hamilton, co-founder and CEO of Reach Security.
In Reach’s analysis of its own telemetry, the findings were similar to the organizations surveyed in the broader research.
Firewalls were the most significant source of drift in Reach’s telemetry, accounting for 47% of all alerts and nearly 88% of material security findings.
Endpoint Detection and Response (EDR) ranked second, generating 23% of alerts and 10% of material findings.
“In the age of AI, security teams need to move beyond reactive processes and adopt continuous assurance,” said Hamilton. “Not every configuration change carries the same level of risk, which makes threat-informed prioritization essential.”
Operational ‘danger zones’ increase misconfiguration risk
Reach’s report also found that drift frequently spikes during predictable operational “danger zones.”
These “danger zones” include vendor updates, patch cycles, holidays, end-of-week periods, and month-end activities. These instances allow security controls to deviate from their intended state, creating hidden exposures that enable new opportunities for attackers.
Continuous assurance could reduce configuration drift
To help organizations address configuration drift, Reach made several recommendations:
- Adopt continuous security assurance across the entire technology stack to move beyond reactive, point-in-time assessments.
- Prioritize remediation based on real-world exposure and attacker relevance, rather than the volume of configuration changes.
- Reduce time between drift detection and remediation with clear, actionable, and risk-prioritized guidance.
- Focus assurance efforts on high-risk areas, such as firewalls and other network security controls.
- Strengthen monitoring and validation during high-risk operational periods, like patch cycles, major updates, and organizational change windows.
- Recognize configuration drift as a persistent operational challenge that requires continuous management rather than periodic review.
“By continuously validating control effectiveness and focusing on the exposures that matter most, organizations can reduce risk, respond faster, and ensure their security investments are delivering the protection they were designed to provide,” Hamilton added.