During a new desktop refresh, all hosts are hardened at the OS level before deployment to comply with policy. Six months later, the company is audited for compliance to regulations. The audit…

Even when devices are properly hardened before deployment, users, administrators, or applications can alter OS-level settings post-deployment, causing gradual configuration drift away from the compliant baseline. Without continuous compliance monitoring and automated enforcement, these accumulated changes result in a significant portion of the fleet falling out of compliance. The six-month gap between deployment and the audit is consistent with drift caused by ongoing production modifications rather than a deployment-time error.

Patch management systems apply software updates but do not typically override OS-level hardening settings unless a specific patch explicitly changes security configuration values.

Default credentials on desktop applications would represent an error present at initial deployment, not explain why devices that were initially compliant subsequently became non-compliant six months later.

If 40 percent of devices had been compromised, the audit would likely detect security indicators and anomalies well beyond mere non-compliance with configuration hardening requirements.