Security Debt
Security debt is the accumulated backlog of known but unresolved security issues — unpatched vulnerabilities, risky dependencies, and deferred fixes — that a team carries over time, increasing risk the longer it goes unaddressed.
Security debt is a form of technical debt specific to security. It builds up whenever a team defers fixing a known vulnerability, postpones a dependency upgrade, ships code with an accepted-risk exception, or lets scanner findings pile up unresolved. Like financial debt, it accrues interest: older vulnerabilities become harder and riskier to fix, and the attack surface grows.
Security debt accumulates for practical reasons — competing priorities, fear of breaking changes when upgrading dependencies, or simply more findings than capacity to remediate. Teams track it by inventorying open findings, tagging their age and severity, and monitoring metrics such as the number of overdue high-severity issues or the trend in unresolved findings over time.
Managing security debt matters because unaddressed vulnerabilities are the raw material for breaches, and a large backlog makes it hard to tell which risks are urgent. Teams keep it under control by preventing new debt with quality and security gates on new code, by prioritizing paydown of the most exploitable and reachable issues first, and by budgeting recurring time for remediation rather than letting the backlog grow unchecked.