Insecure settings, defaults or unnecessary features left enabled in systems, applications or cloud services.