Unauthorized or unanalyzed configuration changes often leave a system:

1. A change that nobody reviewed may open a hole. 2. That is exactly what monitoring exists to catch. 3. Unauthorized or unanalyzed changes often render the system vulnerable to exploits. 4. So the answer is vulnerable. _Source: NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems and Organizations'_