Local optimization means improving one team’s metrics, output, or response time in a way that weakens the security goals of the wider organization. In cyber security, this happens when a group is rewarded for fast ticket closure, low alert volume, or minimal downtime, even if those choices leave systems less visible or harder to defend.
It matters because attackers exploit gaps between team goals. A development team may defer hardening to ship faster, an operations team may suppress noisy detections to reduce workload, or a business unit may block controls that slow sales. The result can be fragile defenses, delayed patching, and poor escalation. Good security governance reduces local optimization by using shared risk metrics, clear ownership, and cross-functional review so that one department’s gains do not create a larger enterprise exposure.