Backlog drift is the gradual loss of connection between a work item and its original intent. In security teams, this happens when tickets, epics, or remediation tasks are edited over and over until the reason for doing the work is no longer clear. The item still exists, but the decision logic, risk statement, or expected security outcome has faded.
This matters because cyber security depends on preserving intent, not just tracking activity. A backlog item that drifts can turn a high-risk fix into a vague enhancement, delay a critical control, or make compliance evidence hard to defend. Attackers benefit when defenders chase busywork instead of the original threat. Good defenses reduce backlog drift by attaching the threat model, risk owner, success criteria, and approval notes to the work item itself, so later changes do not erase why the task was created.