CISA: Certified Information Systems Auditor

Unchanged default database settings can retain known default credentials, excessive permissions, enabled services, or insecure configurations that attackers can readily exploit. This creates a more immediate and potentially critical exposure than password-expiration policy, data-retention gaps, or incomplete logging.