Security debt is the accumulated set of known weaknesses a company has chosen, knowingly or by neglect, not to fix. Explain it like financial debt: each item has a principal (the work to fix it), interest (growing exposure and extra effort) and a risk of default (an incident). Show a few numbers and a repayment plan.
What counts as security debt
Typical examples include end of life software still in production, unpatched systems waiting on a maintenance window, old accounts with excess access, missing tests on critical code, and exceptions that were granted once and never reviewed.
It is not every finding. A new low severity issue is a backlog item. Debt is what has aged past the point where it should have been handled, and keeps costing you.
Make the analogy honest
The financial comparison helps, but use it carefully. Borrowing can be smart: shipping a feature with a known gap to meet a market window may be a sound choice. The problem is debt nobody tracks, and debt that compounds. An unsupported component gets harder to replace each year as more code depends on it.
Three numbers to show
- Size. How many items are open past their target date, grouped by severity or business impact.
- Age. The median and oldest age. An old critical item is a different story than a fresh one.
- Trend. Is the pile growing or shrinking quarter on quarter?
Add one sentence on concentration, such as "most of it sits in three legacy systems." That points to a bounded fix.
Attach cost and risk
For the top five items, give a rough effort estimate in weeks and a plain description of what could go wrong. Avoid technical identifiers in the main text. For each, offer options: fix now, fix on a date, retire the system, or accept the risk with an owner and an expiry.
Propose a repayment plan
Executives respond to a rule they can approve. Examples: reserve a fixed share of engineering capacity each quarter for debt, or set a ceiling on how many aged critical items may exist at once. Report progress with the same three numbers every quarter.
Avoid asking for a big one off cleanup unless something is truly urgent. Steady, funded paydown usually works better, because it keeps debt from rebuilding.
Prevent new debt
Add gates so that new debt is a decision, not an accident. Require an exception with an owner and date before code ships with a known critical issue. That keeps the pile visible instead of hidden.
Quick check
Is all security debt bad?
No. Taking on known risk to meet a deadline can be reasonable if it is recorded, owned and given a repayment date.
How do I prioritize which debt to pay first?
Start with items that are exposed to the internet, hold sensitive data or are known to be exploited, then the oldest within each group.
Last reviewed: 19 October 2026.
