Capacity loss is the productive time and throughput consumed by fixes, checks, and exception handling instead of normal operations. In cyber security, it describes how much defender effort is diverted by alerts, false positives, malware cleanup, patching, recovery, and manual verification. The system may still be running, but a portion of its real capacity is being used to absorb problems rather than deliver value.
This matters because attackers often aim to create friction, not just steal data. Ransomware, repeated login attacks, misconfigurations, and unstable endpoints can force teams into constant remediation and review. That hidden drain reduces the time available for detection engineering, hardening, and proactive monitoring. Measuring capacity loss helps organizations see whether security tools and incidents are consuming too much operational bandwidth, and it supports better staffing, automation, and control design.