A defined scope
Start from a specific monitor and finding. Supported settings and comparisons depend on the connected source.
Drift Detection
Understand security policy drift before deciding what to change.
Compare observed policy and configuration settings with an expected baseline or an earlier snapshot. See the difference, examine the evidence, and decide what needs review.
From visibility to investigation
Give every meaningful change a point of comparison.
Configuration drift is a difference between an observed configuration and the state you expect. Policy drift applies that comparison to security policy settings. GreyAware keeps findings connected to their monitor, source, and comparison evidence so your team can assess the change in context.
Choose the comparison
Define the monitor scope and tracked settings. Compare against a selected baseline or a previous observation, as supported by the monitor.
See what differs
Review the affected policy or resource, changed setting, and available old and new values. Keep the source and evaluation time alongside the finding.
Decide what needs review
Use severity and available assessment context to prioritize investigation. Check approved changes and exceptions with the policy owner.
An investigation in practice
Review a changed endpoint prevention setting.
An observed prevention setting differs from the Finance policy baseline. The difference is clear; whether it is an intended change still needs an owner’s review.
Illustrative workflow and sample data.
POLICY / FINANCEIllustrative example
Prevention policy
- Tracked setting
- Prevention mode
- Expected state
- Enabled
- Observed state
- Disabled
- Next check
- Change approval and affected scope
A difference may reflect an approved change or exception. Validate the context before changing policy.
Compare the values
Review the baseline and the observed setting, with the source evidence used for the comparison.
Establish the context
Check the policy owner’s change record, the affected scope, and whether the observation is current.
Review and re-evaluate
Decide whether to restore the expected setting or record an approved exception, then review a subsequent evaluation.
Evidence for the next decision
Keep assessment connected to the evidence.
Where enabled, GreyAware’s drift assessment agent adds review context to existing findings. It helps explain the evidence and its limitations so the policy owner can make an informed decision.
Explore the platformA reviewable explanation
Use available severity, baseline, and change context to understand why a finding needs attention. Keep missing or uncertain evidence visible.
A deliberate response
Drift assessment provides investigation and recommendation context. It does not automatically change policies or remediate devices.
Plan your evaluation
Questions to bring to the conversation.
Start with your tools, the evidence you need, and the decisions your team makes.
Read our privacy policyWhat is the difference between policy drift and configuration drift?
Configuration drift describes a difference from an expected configuration or previous state. Policy drift focuses on policy settings, such as endpoint protection configuration. The relevant comparison depends on the monitor and the source data.
Which baselines and settings can we monitor?
Monitor configuration determines the source, objects, comparison, and tracked settings. Support varies by integration and object family. We can use your priority policies in a demo to confirm what evidence and comparisons are available.
Is every detected change a security problem?
No. A change can be planned, an approved exception, or something that needs correction. Review its source, freshness, affected scope, and approval context before deciding how to respond.
Does GreyAware automatically remediate drift?
The drift assessment capability supports investigation and recommendations. It does not automatically modify policy, remediate devices, or send external communications. Your team remains responsible for the approved response.
How frequently is drift evaluated?
The evaluation cadence depends on the monitor configuration and available source data. Confirm collection and evaluation timing for your integrations during the demo; detection should not be assumed to be instantaneous.
Is agent-assisted assessment available for every deployment?
Assessment capabilities depend on deployment enablement and supported integrations. We’ll confirm the available assessment scope during your evaluation, including any design-partner capabilities relevant to your use case.
See GreyAware in context
Start with a policy your team needs to understand.
Bring a baseline, a change scenario, or a recurring investigation. We’ll explore the supported comparisons and how the evidence can guide your review.