Secure by default is a security strategy of ensuring Avaya products only install software, services required for the operation of the product. For Avaya turnkey products, this includes a hardened configuration of the operating system, and wherever possible the default configuration of the product is to by default enable security features of the product.

In many cases, for Avaya products that run on the Linux operating system, modified kernels are used. The Linux operating system limits the number of access ports, services, and executables and helps protect the system from typical modes of attack. At the same time, the reduction of Linux services limits the attack surface.