The Cost Floor

Attacking a target costs something: research, tooling, exploit development. That cost sets a floor, and below it you were not worth an attacker's time.

AI is lowering the floor. Reconnaissance, target selection, and exploit development all get cheaper, and the skill barrier that limited who could attack at all is falling with them. More attackers, more targets, each cheaper to reach (see AI-04).

Being too small to bother with was never a security control. It was a price, and it is dropping.

Discussion prompts

• Where does "we're not worth targeting" show up as an unstated assumption in your security decisions?
• If attacking each of your customers got ten times cheaper, which of them becomes worth attacking who wasn't before?
• What in your product raises an attacker's cost, rather than lowering your own?