A non-default configuration is any feature, option, or deployment setting that is not turned on in a product’s standard install, but becomes active after an administrator changes it. It matters because many serious security issues only appear when a specific feature is enabled, especially in legacy components, client-side persistence, or unusual authentication and serialization paths.
In attacks, adversaries often look for these edge cases because they can create a narrower but higher-impact path than the default product behavior. A setting such as cookie-backed storage, custom error handling, or an alternate encryption mode may unlock weaknesses that are invisible in ordinary testing. In defense, the lesson is to inventory not just software versions, but also active features and site-specific settings. Secure defaults reduce risk, but a single overlooked option can turn a normally safe product into a vulnerable one.