What is Fail Open?

Understanding Fail Open

Fail open is a failure-handling design in which a system defaults to allowing access or traffic when a control fails or becomes unavailable. It prioritizes availability and continuity of service over security enforcement, accepting the risk that, during the failure, normally blocked access may be permitted. It is the opposite of fail closed (fail secure), which denies access on failure.

The behavior is determined by how a control handles its own outage. A device or service that fails open treats an inability to make a decision, such as an unreachable authentication server or a crashed inspection engine, as a reason to permit rather than deny. Some controls are deliberately built this way; for example, a network tap or inline appliance may include a fail-open bypass so the link keeps passing traffic if the appliance dies, preventing the security tool from becoming a single point of network failure.

This matters because the right choice depends entirely on what the control protects. Fail open is acceptable, even required, for safety-critical paths: electronically controlled doors on an egress route must unlock if power fails so people can escape, and some monitoring sensors fail open to avoid cutting connectivity. But fail open is dangerous for access control to sensitive resources, because an attacker who can crash or overwhelm the control gains the very access it was meant to block. Choosing fail open versus fail closed is a deliberate risk decision.

For example, a web application firewall placed inline could be configured to fail open: if it crashes under load, traffic flows directly to the application unfiltered so the site stays up, but attacks pass through unchecked. The same vendor's device could instead fail closed, blocking all traffic when it dies to guarantee no request is unprotected, at the cost of an outage. Security teams weigh which loss, exposure or downtime, is more acceptable for that specific system before selecting the mode.