Residual trust is security exposure that remains after a policy change because an old relationship, route, credential, or system pathway was never fully removed. In other words, the rule changed on paper, but the technical dependency still exists. This often happens in telecom, cloud, and enterprise networks where legacy interconnections, reseller arrangements, shared administrative access, or dormant service paths continue to function long after they are supposed to be retired.
It matters because attackers frequently look for what defenders forgot to decommission. A leftover VPN account, stale routing arrangement, or trusted supplier link can provide access even when the formal authorization has ended. In defense, residual trust is reduced by inventorying dependencies, validating that policy changes are enforced in configuration, removing unused accounts and routes, rotating keys and certificates, and rechecking third-party access. The goal is to make trust explicit, current, and technically enforced rather than assumed.