Capital intensity is the amount of money a business must keep spending to build, run, and sustain a product or platform. In cyber security, it describes how much ongoing investment is needed for infrastructure, hardware, software licenses, cloud capacity, testing, compliance, and skilled staff. A highly capital-intensive security program may need frequent device refreshes, dedicated appliances, backup systems, and round-the-clock monitoring just to stay effective.
This matters because security outcomes are shaped by economics as much as by technology. Attackers often target capital-intensive environments because old equipment, patch delays, and complex dependencies can create weak points. Defenders use the term to plan budgets, compare controls, and avoid underfunding critical layers such as segmentation, endpoint protection, identity systems, and resilient backups. In practice, capital intensity helps explain why some defenses are hard to scale and why some attacks succeed by exploiting expensive systems that are difficult to replace quickly.