How drift works
Drift answers the question that matters most day to day: what changed since the last run? Not a score that wiggles, but the actual tests that started failing, started passing, appeared, or disappeared.
What gets compared
Every parsed run stores one row per test. A drift comparison takes two runs of the same report family (Maester with Maester, Zero Trust with Zero Trust, since diffing across families would be all noise) from the same tenant, and matches tests by their stable id (case-insensitively). By default the portal compares the newest run that has an older same-family run to compare against, so one fresh Zero Trust run never hides the drift available between your two latest Maester runs.
The categories
| Category | Rule |
|---|---|
| Regressions | The result changed to Failed, Error, or Investigate. Investigate counts as failing on purpose: it's Maester asking a human to look, which is exactly what a drift report is for. |
| Fixed | The result changed to Passed. |
| Added | The test exists only in the newer run (new Maester version, new checks enabled). |
| Removed | The test exists only in the older run. |
| Other changes | Movement between non-failing states (e.g. Skipped → NotRun): visible, but never dressed up as a regression. |
Posture
The posture number you see everywhere is
passed ÷ (passed + failed), where errors count as failures.
Skipped and not-run tests don't inflate it. The trend charts plot this
per run, drawing on real history, not an illustration.
Zero Trust specifics
Zero Trust Assessment results map onto the same model: the recommendation
risk becomes severity, the pillar becomes the grouping (and drives the
product), and the Planned state is bucketed with skipped, so
a recommendation moving Planned → Failed is a regression, but
sitting at Planned isn't noise in every report.
Where you see it
- The Overview shows the headline ("2 regressions") with the top offenders.
- The Changes page is the full diff with severity and product on every row, plus the raw report link.
- Drift emails bring regressions to your inbox.