Key-person risk is the exposure created when critical security knowledge, approvals, or access are concentrated in too few people. In practice, it means one administrator knows the backup restore steps, one engineer understands the firewall rules, or one manager holds the only approval path for urgent changes. If that person is absent, leaves, or is unavailable during an incident, the organization can lose speed and control.
This matters in cyber security because attackers benefit from single points of failure. A ransomware event, credential incident, or recovery failure becomes harder to contain when no one else can operate the tools or explain the process. Defenders reduce the risk by cross-training staff, writing runbooks, testing handovers, using shared credentials safely, and separating duties so essential work does not depend on a single person. Well-managed teams make their controls repeatable, not personal.