Drift monitoring is the practice of tracking whether an AI model’s outputs, scores, or decisions change over time in ways that reduce quality, reliability, or policy compliance. In cyber security, this matters because models that look safe in testing can become inconsistent in production after prompt changes, new data, software updates, or shifts in user behavior. For security teams, drift is a warning that an AI system may no longer be trustworthy for access control, triage, detection, or response support.
In real deployments, drift can appear as more false positives, missed malicious activity, weaker content filtering, or new failure patterns that attackers may exploit. An adversary can also try to force drift through data poisoning, prompt manipulation, or repeated edge-case inputs. Defenders use drift monitoring with baseline metrics, golden datasets, threshold alerts, and rollback or revalidation steps. The goal is not to stop every change, but to detect behavior shifts early enough to keep the system accurate, auditable, and secure.