Technical security debt
Accumulated gap between the security state of a system and the state it ought to present, created by trade-offs rational when taken and long lacking a maturity, a creditor and a unit of measurement.
The word debt is not a metaphor. Like a financial debt, security debt arises from a trade-off between present and future, it bears interest since the cost of remediation rises with the age of the component and the number of systems depending on it, and it falls due on a date the debtor does not choose. Its peculiarity lay until now in its accounting invisibility: it appears on no balance sheet, is measured in no shared unit, has no maturity, and omitting it is no irregularity. A business could therefore present entirely faithful statements while carrying a considerable liability whose size nobody, itself included, knew. The European cyber resilience regulation changed that status without changing the nature of the danger, by supplying the four missing attributes, a due date, a creditor in the form of the market surveillance authority, a unit of measurement through the software bill of materials, and a penalty scale. Not to be confused with developers' technical debt, which measures the upkeep cost of poorly designed code: security debt measures what a known and unpatched vulnerability will cost, and a third party can call it in. Where the word appears: in no policy; it appears in the underwriting questionnaire (time to patch critical vulnerabilities) and, for products sold in the Union, in Regulation (EU) 2024/2847, whose main obligations apply from 11 December 2027.
Textbook case: an obsolete library left un-upgraded because migration would cost three months of development is a rational choice at the moment it is made, and a liability that then grows silently. Dated case: the patch for the Apache Struts flaw (CVE-2017-5638) was released in early March 2017; Equifax had not applied it, the intruders came in through that component in mid-May, and the data of 147 million people was exposed.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.