A dormant rule is a policy entry that exists in a firewall, IDS/IPS, cloud security group, or other control but rarely or never matches traffic. It may be a legacy exception, a test rule left behind after a change, or a control placed so low in the evaluation order that it is effectively unreachable.
Dormant rules matter because they create security drift. If a rule is supposed to protect or block something but never fires, defenders may be relying on a control that no longer reflects real traffic. Attackers can also benefit from dormant exceptions when old allow rules or stale whitelist entries stay open longer than needed. In defense, hit counts, logs, and periodic rule reviews help identify dormant rules so teams can remove dead weight, fix misordered policies, and reduce the chance of overlooked exposure.