Runtime overhead is the extra CPU, memory, I/O, or scheduling work a program environment spends to manage code while it runs. That cost comes from interpretation, safety checks, logging, sandboxing, encryption, instrumentation, and other control logic that sits between the code and the hardware.
In cyber security, overhead matters because defenders often add it on purpose: EDR sensors, application sandboxes, memory protections, and audit logging all make execution a little heavier, but they also improve visibility and containment. Attackers notice the same cost and may use it as a signal for anti-analysis, delaying payloads or probing for virtual machines and instrumented runtimes. On small devices and embedded systems, too much overhead can also become a reliability problem, creating lag or missed timing that affects both operations and security controls. Reducing overhead can improve responsiveness, but it can also remove safety checks, so the trade-off has to be measured carefully.