The Adversary Has a Budget

Adversary Economics · July 8, 2026 · 10 min read

Security arguments improve considerably the moment somebody asks what the attack costs to run.

Not in the abstract sense of “attackers are motivated”, but in the ordinary operational sense in which every other activity has a cost: someone paid for the access, someone spent hours on the tooling, someone rented the infrastructure, someone is carrying the risk that the whole apparatus gets burned. Intrusion is production. It has inputs, and the inputs are finite.

That framing does something a threat-actor profile cannot. It tells you where a control has leverage, because a control only ever works by making one of those lines longer.

The cost lines

Access acquisition. Getting the first foothold: a credential, an exploit, a convincing message, a compromised supplier, an insider. In a market where initial access is bought and sold, this is a literal price. Elsewhere it is labour and luck.

Capability. The tooling. Development, testing against defensive products, maintenance as those products change. Purchased or developed, it depreciates, because the environment it was built against keeps moving.

Infrastructure. Hosts, domains, certificates, proxies, the effort of standing them up in a way that survives contact with takedown processes.

Labour and time. Somebody has to be at a keyboard. Skilled operators are the genuinely scarce input in almost every adversary category, criminal and state alike, and their hours are the resource most likely to be rationed.

Risk of loss. The distinctive one. Using a capability exposes it. An exploit that gets caught, analysed and patched is gone — for this target and every future one. A well-built access route that is noticed is worth less than one that is not. This cost is invisible in the moment and often dominates the operator’s decision-making.

Monetisation friction. For financially motivated activity, access is not the product. Converting access into money involves negotiation, laundering, cash-out, and counterparties who may defraud them. A surprising share of criminal effort sits after the intrusion, not during it.

Different adversaries face different prices

A framework is only useful if it distinguishes.

Commodity criminal operations run on throughput. They need many targets, low per-target cost, and predictable conversion. Their binding constraint is usually labour and monetisation friction, not capability. They are highly sensitive to anything that makes a target take longer than the median, because time spent on a stubborn victim is time not spent on the next one.

Targeted criminal operations — the ones that select a victim and work it — trade throughput for value. They will spend weeks and can absorb setbacks, but they are still governed by an expected return, and that return has a ceiling set by what they think they can extract.

State-aligned operations invert several of the numbers. Time is abundant. Capability development is a fixed cost carried centrally. Labour is allocated rather than priced. What is genuinely scarce is exposure: a capability revealed is a capability lost across the whole programme, and a diplomatic incident is a cost paid by someone far above the operator. This is why the same adversary can be simultaneously extremely capable and extremely reluctant — the constraint is not what they can do, it is what they are willing to spend to do it here.

Insiders face an almost entirely different structure: negligible technical cost, substantial personal risk, and access already granted.

Any statement of the form “attackers will always X” that does not specify which of these is being discussed is unlikely to survive contact.

Controls as cost imposition

Once the lines are named, a control can be evaluated by which one it moves.

Multi-factor authentication raises access acquisition cost, moving it from “credential” to “credential plus a real-time interception or a session theft”. Application allow-listing raises capability cost, forcing tooling into forms that survive it. Segmentation raises labour and time — more steps, more chances to be seen. Detection raises risk of loss, which is the line that most affects a patient adversary. Backups and rehearsed restoration attack monetisation directly, which is why they change ransomware economics more than any preventive control does.

Stated this way, an uncomfortable question follows immediately: which line does your largest control expenditure move, and is it the line that binds the adversary you actually face?

Programmes get this wrong in a characteristic direction. They accumulate controls that raise capability cost — the technically satisfying kind — against adversaries whose constraint was never capability. An operator using valid credentials and native administrative tooling has spent nothing on capability and will not notice that you made it expensive.

Relative, not absolute

For opportunistic adversaries, the useful target is not “unprofitable”. It is “more expensive than the alternative”. A target that takes three times the median effort gets abandoned in favour of one that does not, and the abandonment happens early, often before anyone at the target notices anything.

This is a real and underrated effect, and it has a hard boundary. It works only where substitution is available. An adversary that wants you — because of what you make, who you supply, what you hold, or what you represent — has no alternative target to move to. For them, raising cost buys time and forces noisier methods, and that is all it buys. Time and noise are worth having; they are not deterrence.

Confusing the two is how organisations arrive at the belief that they are adequately defended because their control set matches a general-purpose baseline. Baselines are calibrated against substitutable attackers.

Attacking the payout

The most underused lever is monetisation, because it sits outside the part of the problem security teams instinctively own.

If the value of the access depends on data being exclusive, encrypting it at rest under keys the intruder cannot reach reduces the payout. If it depends on disruption, tested restoration reduces it. If it depends on fraudulent transactions, limits and out-of-band confirmation on the specific flows that move money reduce it. If it depends on extortion leverage, having already decided — in advance, with counsel — what the organisation will and will not do reduces it.

None of these prevent the intrusion. All of them reduce what it was worth, which is the number the adversary was actually optimising.

Measuring the right thing

The metrics most programmes report — attacks blocked, vulnerabilities closed, alerts handled — measure activity on the defender’s side of the ledger. They say nothing about the adversary’s.

Better questions are awkward and few, which is a sign they are the right ones. Which of our controls forces an adversary to spend something they cannot reuse against the next target? How long does an intruder have to remain present before they can reach anything that matters, and how long can they remain present before we would notice? What is the most valuable thing here, and what would it actually take to convert it into money or advantage?

A programme that can answer those has a model of its adversary. A programme that can only report throughput has an inventory of its own effort.