Compliance overhead is the extra work an organization must do to satisfy different legal, regulatory, or administrative requirements. In practice, this can mean separate approval steps, reporting, identity checks, audit logs, data-retention rules, or region-specific delivery controls. The more jurisdictions or policy layers involved, the more time and cost go into staying compliant.
In cyber security, compliance overhead matters because it affects how secure systems are built and used. Defenders often need to balance control and usability: if legitimate access is too complicated, users may bypass approved channels or choose less trustworthy services. Attackers can exploit that friction by posing as easier alternatives, phishing users who are confused by real requirements, or targeting weak points in fragmented workflows. Good security design reduces compliance overhead by automating checks, standardizing policy, and making authorized paths clear and predictable.