Proportionality is the security and privacy principle that a control should match the actual risk, without collecting more data, watching more people, or restricting more access than necessary. In cyber security, it helps decide whether a measure such as logging, monitoring, MFA, endpoint inspection, or video surveillance is justified for the threat being addressed.
It matters because overly broad controls can create new risks: excessive data retention, sensitive exposure, user distrust, and compliance failures. Good defenders use proportionality to choose the least intrusive effective option, then limit scope, access, and retention. In real attacks, proportionality appears when teams decide whether to deploy full packet capture, deep inspection, or always-on surveillance; each can be useful, but each also increases operational and privacy risk. In defense, proportionality is the check that keeps security from becoming unnecessary intrusion.