Why we stopped counting vulnerabilities

A count tells you how much your scanner found. It says nothing about how hard you are to break. Two APIs with the same number of open issues can differ by a factor of one hundred in what it costs to get in.

Adversarial Cost to Exploit, or Breakcost, measures the tokens and hours an autonomous attacker spends before it reaches a defined goal, such as reading another tenant’s data.

What we measured

We ran the same campaign against 40 production APIs, with their owners’ permission, inside isolated copies of each environment. Every run started with the same budget and the same goal.

The results

The cheapest break cost under $50 in tokens. The most expensive target held out past $25,000. Team size and funding stage predicted almost none of that spread.

What predicted the cost

Three habits did: tenant scoping enforced in one place, short-lived credentials, and regression tests for past findings. Teams with all three cost an attacker about 40 times more than teams with none.

How to use the number

Track Breakcost per target over time and report the lowest one. A CFO and a CISO can both read that number, and it moves when the work is real.