Cost was the only protection

There is a lot of talk these days about audits run by swarms of automated agents and the tone swings between wonder and panic. I would like to offer a calmer reading and to my mind a more useful one, because what is at stake is not the appearance of a novel threat, it is the disappearance of a protection that never really existed.

The idea in one sentence

A good share of what we judged “low-risk” was not really so, it was simply expensive to reach and the day that cost collapses, the protection it offered collapses with it. The rest of this post is only the unfolding of that sentence.

Why humans triage and why machines do not need to

A human auditor works with bounded time and budget and that is fine. With a few days ahead, they cannot look at everything, so they triage, they go first where experience says it is likely to pay off and they set aside what seems marginal, too long to dig into or too unlikely to deserve their day. This triage is no fault, it is even what sets a good professional apart from a beginner, knowing where not to waste time.

But this triage has a consequence we forget, it outlines by default an area nobody ever visits, not because it is safe, but because it costs too much to explore for someone counting their hours. A machine that does not tire, does not bill by the day and never gets bored has no need for that triage, it can afford to look also at what the human had reasonably set aside. The terrain is the same, the paths are the same, only the way their cost is assessed has changed and that change is enough to bring into view areas that were hidden only by economics.

That cost-shaped reading carries a blind spot worth naming, it assumes an attacker who does not arbitrate like a hacker.

Who attacks and why

The equation “not worth attacking” says nothing about the real attacker, it holds for a professional arbitrating in billable hours and the actual motivations of hacking have never fitted that single column. Beyond the lure of profit there is curiosity, the thrill of the challenge, payback, revenge and the need for freedom, now also outright geopolitical agendas. The two Phrack manifestos tell exactly that story, The Mentor’s in 1986 and its 2025 rewrite for the magazine’s fortieth, two texts that throw light on a good part of the behaviours we observe today.

The 1986 manifesto, written after an arrest, defines the hacker through curiosity, the need to belong and the refusal of assigned frames, it claims no skin colour, no nationality, no religion and turns the accusation back on a society that builds bombs while calling them criminals. For that profile, the “not worth attacking” half of the equation never carried any weight, budget-based protection was never anything but budget blindness, what a pentest budget could not reach stayed within reach of sheer perseverance, only slower and leaving more traces behind.

The 2025 one describes what those forty years made of the hacking world, curiosity has become a commodity that bug bounty platforms monetise, the title of hacker has become a job description and state APTs have industrialised, with exploits written by government employees and kept under embargo instead of being shared. The inversion is striking, the 1986 hacker blamed profiteers for selling dear a service that should have cost almost nothing, it is now states that appropriate knowledge and keep it to themselves. The magazine even published in the same issue as that manifesto an analysis of the files of a North Korean state operation , whose authors quote the 1986 manifesto word for word to tell Kimsuky he is no hacker.

In the end, three families never arbitrate on a pentest budget, the criminal whose return on investment is measured in monetisation, the hacker of the 1986 lineage who seeks something other than money and the state which reasons in intelligence, influence, sabotage and prepositioning, with targets chosen for their strategic value and a patience counted in years. A swarm of agents serves all three at once, it industrialises curiosity as much as intelligence collection. Those attacks are not noisier for all that, some are even very elaborate, but a swarm can by nature make volume, turning industrial what time and perseverance used to produce by hand. Cost-based protection therefore only ever protected against the attacker we had chosen to imagine.

The debt we thought was sheltered

Every organisation with some history carries a debt it chose to tolerate and that choice was often rational. An old service never migrated because migration cost too much, a component known to be dated but judged too marginal to interest anyone, a shaky configuration in a corner of the network nobody looks at. The implicit reasoning fit in one equation, “not worth fixing” because “not worth attacking” and as long as attacking was expensive, the equation held.

The trouble is that the second half of the equation did not depend on us. It rested on the cost borne by the attacker and that cost has just dropped, so choices that were defensible yesterday become fragile today without anything having changed on our side. It is the mechanism I describe about security through obscurity , it does not buy security, it buys time and that time always gets paid for one day. And it is also why counting flaws one by one, without looking at how they can chain together, already gave a false sense of calm .

Nothing new, except the price

One should beware the rupture narrative, because exploring a system methodically without tiring is no recent invention. Specialists and research labs have had modelling and decision-support tools for some twenty years that did exactly this systematic work and it is a lineage I extend myself in my own projects, augure and lictor . What changes is not the capability, it is who can afford it. What used to require a specialised team, time and rare know-how becomes a resource you rent and exhaustive exploration moves from rare skill to commodity. In other words, automation does not open a new door, it simply makes it ordinary to try every known door, patiently and for next to nothing.

What it changes for defense

The good news is that the answer requires neither magic nor panic, only a change of assumption. We have to stop reasoning as if the attacker gives up for lack of time and redo the inventory of everything we tolerate, asking for each item whether it was truly safe or merely expensive to reach. What falls into the second category deserves to be reprioritised, migrated, isolated or simply switched off and this is hygiene and inventory work, exactly what the craft should have been doing anyway. The same automation tools can serve defense too, by regularly running that exhaustive tour of your own estate before someone else does.

Negligence is no longer free

The risk is not that a novel threat appears, it is the end of a protection that never really existed. What was “low-risk because expensive” no longer is, since the cost has melted away. The capability to explore without tiring already existed, what changes is its price and therefore how many people can afford it. And the answer fits in one unspectacular word, inventory, carried out assuming an adversary who never gives up for lack of time.