What is Posture Drift?
A definition, and how it applies in practice.
Posture drift is the gradual divergence of a cloud environment's actual configuration from its intended secure state, caused by ordinary changes — a permission widened for a deploy, a rule opened for debugging, a resource created outside the usual process — that are never reverted.
In depth
Understanding Posture Drift
Drift is not the result of carelessness so much as of normal operation. Every change is made for a reason by someone competent; the failure is that temporary changes are rarely temporary, and nothing in the system remembers what the intended state was.
This is why a point-in-time audit is a weak control against it. An environment that passed in January can be materially different by March, and the audit has no opinion about the intervening period. What matters is the time between a drift occurring and being noticed.
Detecting drift requires a baseline and repeated measurement — the same checks run on a schedule with results compared over time, so a newly public bucket registers as a change rather than as one row among hundreds.
In RedStrike
How RedStrike handles Posture Drift
RedStrike runs posture checks continuously rather than as one-off audits and tracks benchmark scores over time, so a newly public bucket, a stale access key, or an opened security group surfaces within a scan cycle. Posture drift tracking is available from the Team plan upward.
FAQ
Frequently asked questions
Common questions about Posture Drift.
Does infrastructure as code prevent drift?
It reduces it substantially but does not eliminate it. Drift happens when changes are made outside the pipeline — console access during an incident, a manual permission grant, a resource created by another team — and those are exactly the changes least likely to be reverted.
How quickly should drift be detected?
Faster than an attacker enumerates your surface, which is continuously. The practical target is within a scan cycle rather than within an audit cycle; the difference is usually days against months.
See Posture Drift in practice
Run continuous, verified security testing across your applications, APIs, and cloud accounts.