Capacity headroom is the unused infrastructure margin a service keeps above its normal load. It can mean extra bandwidth, compute, memory, queue space, or routing capacity that is reserved by design or left available so the system can absorb a sudden spike without failing.
In cyber security, headroom matters because many attacks try to push systems past their safe operating limit. A DDoS flood, burst of abusive logins, or traffic surge from automated bots can exhaust links, overload scrubbing systems, or trigger cascading failures if there is no spare capacity. Defenders use headroom to keep legitimate users connected while they filter, reroute, or rate-limit hostile traffic. Good architecture, autoscaling, load balancing, and overprovisioning all increase headroom. Poorly sized services often work in normal conditions but collapse when traffic rises faster than the defense can react.