Free cash flow is the money a company has left after paying operating expenses and funding capital investment. It shows how much cash is available for debt service, acquisitions, dividends, or new projects after the business has covered its basic costs and long-term spending.
In cyber security, free cash flow matters because it reflects how much room an organization has to fund controls such as endpoint protection, backups, monitoring, and incident response. Strong free cash flow can support sustained security investment; weak free cash flow can force tradeoffs that leave systems underprotected. Threat actors also pay attention to it indirectly: financially motivated attackers often target companies with healthy cash generation because they may have more to lose, more ability to absorb downtime, and a greater chance of paying extortion demands. For defenders, tracking free cash flow helps explain whether a security program is financially sustainable, not just technically sound.