Amortization mismatch is the gap between the period an asset is financed or paid down and the period it remains economically useful. In practice, a company may still be making payments on equipment, software, or infrastructure after that asset has become obsolete, undersized, or too costly to operate.
In cyber security, this matters because security controls depend on timely refresh cycles. If hardware ages out before its debt is serviced, budgets can tighten just when patching, monitoring, backup capacity, and incident response need more funding. Attackers often benefit from this kind of strain: old systems linger, unsupported devices stay online, and upgrades get delayed. Defenders reduce the risk by matching financing to realistic hardware lifetimes, tracking depreciation against threat-driven replacement schedules, and avoiding contracts that hide the true cost of keeping exposed infrastructure alive.