Skip to content

Misconfiguration

A system that is insecure because of how it was set up, rather than because of a flaw in the software.

Publicly readable cloud storage, overly permissive shares, verbose error messages, unnecessary services enabled, and permissions granted broadly to make something work are all misconfigurations.

They cause more breaches than software vulnerabilities do, and unlike a vulnerability there is no patch. The only fix is someone changing the setting, which requires knowing it is wrong.

Where this comes up

Misconfiguration sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Penetration testing Ask an engineer

Related terms

Default credentials The factory username and password a device or application ships with, unchanged after installation. Exposed service A system or application reachable from the internet that should not be, or should not be reachable without authentication. Least privilege Giving every account only the access it needs to do its job, and nothing beyond that. Vulnerability scan An automated check of systems against a database of known vulnerabilities and misconfigurations.

More in penetration testing

Blue teamBuffer overflowCross-site request forgeryCross-site scriptingCVECVSSCWEEnumeration

Back to the full glossary →

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.