> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/runtime-security/drift-anomalies.md).

# Drift / Anomalies

Drift & Anomaly Detection identifies **deviations from the expected or approved state** of systems, workloads, and configurations in production. In dynamic cloud environments, changes happen continuously — some intentional (deployments, scaling, configuration updates) and others unauthorized or malicious.

Drift and anomaly detection ensures that **what was tested and approved is what actually runs in production** — and that any deviation, however subtle, is caught and investigated.

## **Two Types of Deviations Detected**

**Configuration Drift** — when the actual state of a system diverges from its intended baseline:

| Example                                                         | Risk                        |
| --------------------------------------------------------------- | --------------------------- |
| Unauthorized changes to Kubernetes RBAC configurations          | Privilege escalation        |
| Modified security group rules in cloud infrastructure           | Unexpected network exposure |
| Changes to container images or runtime parameters post-approval | Supply chain compromise     |
| Altered security policies or admission control rules            | Policy bypass               |

**Behavioral Anomalies** — unusual patterns in system activity:

| Example                                         | Risk                          |
| ----------------------------------------------- | ----------------------------- |
| Unexpected process execution within a container | Malware or exploit running    |
| Abnormal API usage patterns                     | Account takeover or API abuse |
| Sudden spikes in resource consumption           | Cryptomining or DDoS          |
| Unusual outbound network traffic                | Data exfiltration             |

## **Why Drift & Anomaly Detection Is Used in OpsMx**

Many sophisticated attacks do not rely on introducing new vulnerabilities — they exploit **changes or inconsistencies in the environment**. Drift detection closes this vector by:

* **Continuously comparing running state against approved baseline** — any deviation triggers an alert
* **Creating a continuous validation loop** — ensuring approved configurations persist across deployments and scaling events
* **Detecting silent failures and insider threats** — changes that should not have happened are immediately visible
* **Improving compliance posture** — continuous drift detection provides always-current evidence that systems match their approved configurations
* **Reducing time to detect** — anomalies are surfaced in real time, not discovered during periodic audits

## **Benefits for the User**

* Organizations know immediately when production deviates from what was approved — no more waiting for quarterly audits to surface drift
* Behavioral anomalies are detected before they escalate into incidents
* Continuous drift evidence supports regulatory frameworks requiring ongoing compliance validation (SOC 2, PCI DSS, HIPAA)