Initial-access brokers resell entry: what does that do to the cost of breaking early kill-chain links?

## Two economics either side of one handover The interdiction argument was written for a world with one adversary per intrusion, who pays for every link they traverse. A market in access breaks that assumption into two parties with opposite incentives. **The broker** optimises for volume. Their work is the front of the chain: finding exposed services, testing reused secrets at scale, exploiting whatever internet-facing thing is currently exploitable. They are indifferent to which estate they land in, they rarely go deeper than proving the position works, and their revenue is the number of positions they can sell. Their unit cost per position is low precisely because the work is untargeted and repeated. **The affiliate** optimises for value per estate. They buy one position, and everything they do afterwards is specific to that estate. Their cost structure is the back of the chain: time inside, and the effort of reaching something worth monetising. The handover between them is the point where the seven-stage cost model stops describing anybody. ## What an interdiction at an early link actually taxes Suppose you place a control class at Delivery or at Exploitation and it works perfectly. Who paid? Against a self-contained intrusion, the intruder paid, and paid on the path they were running. That is the model's intended case and the argument holds. Against a bought path, the broker paid — once, during production, months earlier, and spread across every other estate in the same sweep. The affiliate's cost went up by the change in the listing price, which for a market with many suppliers is close to nothing. You did not make the intrusion you are worried about more expensive; you made a wholesale input marginally more expensive for somebody who was not intruding on you at the time. This is why "we invested at the front of the chain" and "we raised the adversary's cost" are not the same claim once a market exists between them. ## Where the cost actually lands Two different placements move real money. **Make the position unsaleable rather than unusable.** A broker's inventory item is only worth listing if it works when the buyer tries it. An authentication requirement that a resold secret alone cannot satisfy — a bound credential the buyer does not possess — attacks *production*: the broker cannot manufacture the item, so it never reaches a listing. That is an early-link control that genuinely taxes the broker's economics rather than a buyer's. **Meet the buyer where their path begins.** The affiliate's cost is concentrated in the second half — establishing anything durable of their own, reaching across from the position they bought to the thing they want, and completing the objective. Those links are the ones their path genuinely requires, so the conjunction argument still applies there in full force. ## The interview framing A good answer resists two temptations. The first is to say the chain is useless against a market — it is not, it simply no longer prices one adversary. The second is to conclude that early-link controls are wasted — they are not, because a great many intrusions still begin at the front, and because one class of early control attacks the broker's ability to produce inventory at all. The precise claim is the useful one: **interdicting a link taxes whoever traverses that link, and in a market that is not necessarily the party inside your estate.**