Operational debt is the accumulated cost of temporary fixes, manual workarounds, policy exceptions, and rushed shortcuts that were meant to be short-lived but become part of day-to-day operations. It is similar to technical debt, but focused on people, process, and control surfaces such as approvals, access rules, configuration drift, and incident handling.
In cyber security, operational debt matters because every exception adds another path an attacker can abuse and another condition defenders must remember. Examples include expired access that is never removed, emergency firewall rules left open, or unique deployment steps that bypass normal checks. These gaps make audits harder, increase the chance of mistakes, and slow response during incidents. Good defense reduces operational debt by tracking exceptions, assigning owners, setting expiry dates, and reviewing whether a workaround should be fixed properly or retired.