Off-balance-sheet refers to an accounting setup where some obligations, assets, or liabilities are not shown on the main balance sheet in the usual way. The arrangement can be legitimate, especially in project finance or asset isolation, but it can also make the true economic risk harder to see. In practice, the details depend on control, consolidation rules, guarantees, and disclosure.
In cyber security, this matters because hidden obligations can mask who is responsible for security controls, incident response, maintenance, or breach costs. A company may appear well funded while critical infrastructure, data, or services sit in separate entities with different protections and weaker oversight. Attackers and fraudsters can benefit from that opacity, while defenders should review vendor contracts, retained liabilities, third-party dependencies, and exit plans to understand where risk really lands.