At 2:14 on a Sunday morning, the inline IPS between a hospital's clinical network and its cloud health record system freezes after a bad signature update. Whether nurses can still pull up medication histories depends on a setting someone chose months earlier: when the IPS fails, does traffic keep flowing or stop?
That setting is a failure mode, and choosing it is an architecture decision. On the CompTIA Security+ SY0-801 exam, failure modes and diversity both fall under objective 3.2, which expects you to make those decisions in a scenario. This lesson covers fail-open and fail-closed behavior in network devices and physical locks, how inline and passive placement change what a failure can break, and why using different vendors and technologies across layers limits the damage one flaw can do.
Every control needs a decided behavior for when it breaks
Every security control fails at some point. Power supplies die, software crashes, a bad update ships, a license or subscription expires, traffic exceeds what the hardware can inspect, or the control loses contact with something it depends on, such as an authentication server or a cloud lookup service. The failure mode is the state the control drops into when that happens.
There are two basic choices. A fail-open control lets traffic or access through when it fails. A fail-closed control blocks everything when it fails; fail-closed is also called fail-secure. Each choice protects a different part of the CIA triad. Fail-open preserves availability and gives up confidentiality and integrity protection while the control is down. Fail-closed preserves confidentiality and integrity and gives up availability.
If nobody makes the choice, the vendor's default makes it, and defaults vary by product and even by feature within one product. Failure behavior belongs in the design documentation, and it should be tested rather than assumed.
One term needs care. In physical security, fail-safe means a lock releases so people can get out, which is the open choice. Some IT writing uses fail-safe to mean failing into a safe, secure state, which is the closed choice; the classic design principle of fail-safe defaults, for example, means denying access unless it has been explicitly granted. On the exam, let the scenario decide: if it involves doors and people, fail-safe means unlocked.
Fail-open keeps traffic flowing and fail-closed keeps it blocked
Network devices show both behaviors, and the right one depends on what the device protects.
An inline IPS is often built to fail open. Many IPS appliances have hardware bypass, sometimes called fail-to-wire: if the appliance loses power or its inspection engine stops responding, a circuit connects the inbound and outbound ports so traffic passes uninspected. The log on the hospital's IPS might read:
2026-10-18T02:14:07Z ips-edge01 WARN engine watchdog timeout (sigpack 2026.10.17-3)
2026-10-18T02:14:07Z ips-edge01 CRIT hardware bypass ENGAGED ports=1/1-1/2 mode=fail-open
2026-10-18T02:14:08Z ips-edge01 INFO forwarding traffic uninspected
That CRIT line needs to page someone. A device that fails open silently looks healthy while inspecting nothing, and the organization learns about the gap only when something gets through.
Overload is a failure mode too. An IPS or next-generation firewall can be set to pass traffic it doesn't have the capacity to inspect, or to drop it. Attackers know this: flooding a fail-open device until it stops inspecting, then sending the real attack, is a known evasion technique.
A firewall usually fails closed by nature. It is a routing device, so when it dies, nothing is forwarded. That is why critical firewalls are deployed in high-availability pairs rather than with bypass: the organization gets the protection of failing closed and the availability of a second unit.
The same choice appears in services that depend on lookups. A web filter that can't reach its cloud categorization service can allow uncategorized sites or block them. A sign-in system whose MFA provider is down can allow password-only sign-in or refuse it; for administrator accounts the answer should be to refuse, with emergency break-glass accounts stored securely for exactly this situation. NAC switches that can't reach their RADIUS server can put new devices in a limited fallback VLAN or block them.
Software has failure modes as well. An authorization check that throws an error should deny access. Code that grants access whenever the permission lookup fails is a classic fail-open bug, and secure coding guidance calls the fix failing securely.