Security debt is borrowed future effort
Deferring security work is borrowing, and the interest is real.
The unpatched system, the missing inventory, the credential nobody rotated. Each becomes more expensive to fix as more things come to depend on the current state. Like financial debt it is sometimes the right decision, and like financial debt it needs recording, because the problem is not taking it on but forgetting it exists.
More on Security leadership and economics
- Security competes for finite organisational attentionEverything else is on the same bench
- Security spend should follow risk concentrationThe same trickle everywhere
- Security creates option value during incidentsThe siding was laid years ago
- The cheapest control can be removing the featureUnbolt it and the rest goes too
- Executive decisions need ranges, not false precisionMeasure the width
- Security strategy means not protecting everything equallyYou only have so much fence