Someone fixes a security group in the console during an incident, and now the cloud no longer matches the code. Drift is that mismatch, and terraform plan shows it, so a scheduled plan in CI can catch it early. Then decide which side is right: apply to revert the manual change, or update the code to keep it, and use ignore_changes for values another system owns. "Someone changed prod by hand, what now?" is a common interview question.