An affordability crisis in cyber security happens when the cost of basic defenses rises faster than an organization can sustainably pay. It is not about luxury tools; it is about whether a company can still afford the minimum controls needed to reduce risk, such as identity protection, endpoint security, backups, patching, staff training, and incident response planning.
This matters because attackers do not need a perfect target, only a weak one. When budgets are tight, organizations may delay patching, skip monitoring, outsource too much without strong oversight, or leave vendor access poorly controlled. Those gaps create real attack paths. Defenders respond by prioritizing a workable baseline, using managed services carefully, and focusing spending on the controls that reduce the most risk per dollar. The term is especially relevant for small and medium-sized businesses, where limited staff and thin margins can turn security into a unit-economics problem.