Capacity is the maximum amount of work, traffic, or output a system can handle before performance degrades or failures begin. In cybersecurity, it matters because every control, service, and process has limits: bandwidth, CPU, memory, storage, queue depth, and staff response time.
Attackers often target capacity instead of trying to break encryption or bypass authentication. A denial-of-service attack can flood a server until it cannot answer legitimate requests. Brute-force login attempts can exhaust authentication systems, and log flooding can overwhelm monitoring tools so real alerts are buried. Defenders manage capacity with rate limiting, load balancing, autoscaling, caching, and resource monitoring. Good capacity planning helps keep services available during attacks, busy periods, and incident response.