Where does threat modeling's rational cost-versus-gain assumption about attackers break down?

## What the assumption actually says Cost-versus-gain reasoning models an attacker who is *economically rational*: they hold a budget, they price an attempt, they compare it to what a success is worth to them, and they walk away when the numbers stop working. Under that model a control is judged by the price it sets. The assumption is a good one for most volume crime, and it is the reason friction, rate limits, devalued loot and fast clawback are effective at all. It is still an assumption, and a threat model that never states it will quietly apply it to attackers it does not describe. There are four recognisable ways it breaks. ## 1. The gain is not denominated in money Consider a fitness-tracking social app with route sharing and a followers graph. One user wants one specific other user's location history, and that person is an acquaintance with a legitimate account. There is no resale market and no revenue; the payoff is personal, and the effort budget is whatever the person is willing to spend, which can be effectively unbounded. Every price you set is a price they will pay. Worse, the asset is not a data record whose loss you can absorb — it is where someone sleeps, and the consequence is physical safety. For this threat "we made it expensive" is not an answer. The controls that hold are the ones that do not depend on effort: not collecting or not retaining precise location, coarsening it by default, never exposing exact start points, defaulting sharing to closed rather than open, making the audience of every field explicit and revocable, and giving the victim a way to sever a follower's access completely. Notice these are data-minimisation and default choices, not friction — the attacker with legitimate access cannot be priced out, so you remove the data they would obtain. ## 2. Someone else pays the bill, and your loss is the payoff A competitor-funded actor wants a ticketing platform unavailable during a rival's on-sale window. The gain here is denominated in *your* loss: the value of the attack is the revenue and reputation you do not get, which is a number you can compute and the attacker cannot capture. There is no theft to devalue and no proceeds to claw back, so the two normal levers are both inert. The attacker's cost is also not theirs — it is funded, so raising it spends someone else's money. What survives is capability-and-consequence reasoning: assume the attempt happens at the worst possible moment, and ask what the platform does under it. That points at capacity headroom, shedding load gracefully, keeping the queueing path independent of the paying path, and having a practised response for the specific window rather than a control that hopes to deter. ## 3. Cost is already sunk, or rounded to zero Indiscriminate automated scanning has a per-target cost that rounds to nothing: the tooling was written once, the infrastructure is often already compromised and free to the operator, and the marginal cost of adding your host to the sweep is a packet. When cost is approximately zero, *any* nonzero gain clears the bar — a host to relay from, a bit of compute, a credential to test elsewhere. This is the reasoning error behind "there is no money in attacking us, so nobody will bother." Low value does not protect you when the price of finding out is nothing. ## 4. The attack is its own reward Ideological actors, people demonstrating a capability, and insiders acting out of grievance all generate gain that never appears on a balance sheet. The same treatment applies: the deterrent is consequence and detection, not price. ## How to handle it in the model Do not throw the economics away — most of your threat list still obeys it. Instead mark the ones that do not, and change the acceptance test for those: | Economically rational threat | Non-economic threat | | --- | --- | | Test: cost per attempt above realisable gain | Test: control holds under unbounded effort | | Levers: raise friction, devalue proceeds | Levers: remove the data, hard invariants, isolation | | Detection reduces retained gain | Detection buys response time and evidence | | Residual exposure is a price | Residual exposure is a consequence you must survive | The cheapest tell at design-review time is the **asset**, not the attacker. If the harm is physical safety, silencing someone, personal privacy, or a rival's loss, the payoff is not the attacker's revenue and pricing is the wrong instrument. If the harm is money or resaleable data, economics is usually the right instrument and the pricing conversation is the productive one. The failure mode this prevents is the most expensive one available in threat modeling: a team correctly reasons that an attack is not worth an attacker's while, deprioritises it, and finds out that the one attacker who matters was never doing arithmetic.