Infosec is full of bad analogies. The absolute worse is "technical debt". People think it's a good analogy for communicating with "business types", but it isn't, because techies don't understand "debt". Techies think debt is bad, business types think debt is good.
Techies think that debt is something that must be repaid. Business types understand that debt should never be repaid, and really, cannot be repaid. Techies think they are justifying why something needs to be fixed, when in fact they are explaining why it never needs to be fixed.
I mention this because of this HackerNews item which, yet again, misunderstands "technical debt".
news.ycombinator.com/item?id=213663…
news.ycombinator.com/item?id=213663…
It takes "capital" to run a business, such as money to build a factory. The word is the basis for "capitalism". You can get capital from two sources: sell stock, or take out a loan. When building a new factory, businesses are largely indifferent to the two sources fo capital.
Sure, with loans, you have to pay interest. But for stock, you have to pay dividends. You might think that a loan needs to be paid back, but that isn't really true. Corporations simply take out new loans to pay off old loans. Loans are essentially eternal.
Technical debt and real debt are the same thing, from the business point of thing. If they invest in paying down "technical debt", it means taking out a loan and incurring "real debt" to pay for it.
Paying down some technical debt may save $100,000/year in costs, but take such a large investment that it requires $100,000/year in interest payments (or issue of stock resulting in $100,000/year in dividends).
Technical debt is a useful concept when you don't have an axe to grind, when you aren't using it to win internal corporate political battles. Every release schedule should include some refactoring to address the most expensive technical debt. There's always cleanup needing done.
Building a business case for something doesn't mean using business buzzwords you don't understand. It means actually understanding the business case. "Debt", "ROI", and so on are widely misunderstood by techies.
It's like when business types sling technical buzzwords with laughable miscomprehension. It's the same going the other direction. You probably misunderstand them. You definitely misunderstand "debt".
Your concept of "debt" comes largely from consumer debt. Instead of studying it, you've reverse-engineered it. You observe it, and then come up with your own principles that explain to yourself what you see. These aren't the principles business types use.
