You can still hear teams argue about whether “AI attacks” are real or just conference slideware. Then this week handed you a price tag. Dark Reading reported a campaign that pointed open-weight models at 105 sites, and another case where public models reached full domain control for $12. Twelve dollars. That’s less than the coffee run your incident response channel burns while someone is still assigning the ticket. If your cybersecurity program is still calibrated for adversaries who have to hire operators and rent noisy infrastructure, the market just moved without you.

Twelve dollars is a real campaign budget now

The joke writes itself until you inventory what “full domain control” actually unlocks in your environment.

For most of you that’s a cloud tenant, a leftover Active Directory domain, or a SaaS org-owner token living in a CI variable nobody rotated. Twelve dollars buys inference. Enough of it to walk the boring paths you stopped watching because they looked like scanners, researchers, or a junior admin with a bad password habit.

SentinelOne’s week-43 roundup added the detail your board will skip. Chinese-linked actors are already using agentic AI in a cloud supply chain attack. Debate the attribution in the parking lot if you want. The pattern is the part that pays the bills. The same class of tooling that used to generate awkward phishing copy is now pacing through control planes, chaining APIs, and treating your cloud like an IDE with an unlimited retry loop.

Open-weight models make the cheap campaigns durable. There is no vendor abuse mailbox that shuts them down at 2 a.m. There is a weights file, a rented GPU hour, and a script that does not need a coffee break. Your threat-protection stack was built to notice a brute-force spray from one netblock against the VPN login. A model can spread attempts across apps, protocols, and identity providers until something grants a role that was never supposed to be standing.

You spent years telling leadership that attackers are rational economic actors. They listened. Then they got a price cut you did not match on the defensive side.

Your cybersecurity stack still bills by the hour

Look at how your detections actually fire.

A classic brute-force signature wants repetition against one portal, one firewall log source, one identity store. That still happens, and you should still catch it. Cheap model-driven probing will not do you the favor of looking like 2019. It can look like a clumsy user, a partner integration, or a burst of API clients your SOC allowlisted last quarter because someone labeled it automation.

Threat detection that waits for a human cadence will miss the inexpensive campaigns on purpose. You tuned out high-volume noise so the queue would be livable. Livable queues are a discount. The other side can afford to be noisy in a way that never quite trips the rule you wrote for password sprays from a single IP.

Defense in depth on a slide is three products in a row. Defense in depth that survives a $12 campaign is friction the model cannot purchase its way through. Step-up authentication on privileged actions. Short-lived credentials. Admin surfaces that do not exist on the public internet. Rate limits tied to the identity and the action, not just to a source address the model will rotate without caring.

Cyber security programs that still lead with perimeter appliances will keep having the same week. The firewall is a sensor. Budget lives in identity, lockout, and blast radius. If a password and an unlocked portal sit between a public model and domain control, you already published the ROI calculation for whoever is running the loop.

Make the next campaign too expensive to finish

You do not need another dashboard to start. Tax the cheap path today, then keep taxing it every week after.

• Pull every identity that can create tenants, reset MFA, federate an IdP, or attach new cloud roles. If those actions are reachable with a password and a web form, put phishing-resistant MFA and a second person in that path before the next standup.
• Kill standing domain-admin and org-owner sessions. Issue break-glass accounts that are monitored, stored offline, and useless for API automation.
• Cap authentication and sensitive API calls per identity and per target resource. Per-IP limits are a suggestion to a model that can spread.
• Hunt the last 14 days of IdP and cloud audit logs for sequential, low-and-slow privilege checks across many apps from new user-agents. That is what machine-paced recon looks like before it gets loud.
• Yank public exposure from admin consoles, forgotten test IdPs, and “temporary” VPN profiles that never got temporary. That is security hardening with a receipt attached.
• Rebuild detections around actions that matter: role create, MFA reset, federation change, mailbox rule, new API key. Stop betting the queue on “lots of failures from one IP.”
• Run incident response drills where the first alert is a cluster of weak signals across 15 systems in 20 minutes, not a single ransomware pop-up.
• Review vendor and CI identities with the same blast radius as humans. Agentic campaigns love non-human identities because nobody is watching their coffee consumption.

None of that is glamorous. All of it changes the unit economics. A model that can try forever still chokes when the forever path requires a hardware key, a second approver, and a role that expires in an hour.

Your playbooks still wait for a person to get tired

Most incident response plans assume an adversary who pauses. They go to sleep. They reuse infrastructure you can sinkhole. They make a human mistake at 3 a.m.

A cheap model does not get tired. It retries the forgotten password-reset flow at 04:00 because that is when your on-call coverage is a forwarded phone and a hope.

If the first time you talk about machine-paced intrusion is during the outage, you will spend the opening hour arguing taxonomy while the model keeps clicking. Give yourself a severity path for clustered identity and control-plane events that does not require a named malware family. Containment starts with the identity and the role, not with a host you have not found yet. Rotate the tokens. Disable the new federation. Kill the API key that appeared in the last twenty minutes. Write the pretty timeline after the blast radius stops growing.

Spare me the victory lap for blocking the noisy brute-force that slapped the firewall. That was the campaign they could afford to lose. The $12 version is quieter, cheaper, and already priced into someone else’s weekend. Your job is to make the next one too expensive to finish.

Sources

• AI Tools Are Generating Massive Attacks for Little Cost
• The Good, the Bad and the Ugly in Cybersecurity – Week 43 (2026)