Opinion
Your cybersecurity pricing model is now an attack surface
"As AI agents take over security operations, attackers can drive up the cost of the systems built to stop them," writes Elik Etzion, co-founder and Managing Partner of AlphaDrive. "Founders, CISOs and investors need a pricing model that holds up under attack."
A few months ago, I sat with the founder of a mature cybersecurity company, one of the early players using AI agents to automate security investigations that previously required human analysts. The technology worked. Customers were renewing. But when our conversation turned to pricing, his confidence faded.
Selling the product was never the issue. Turning each sale into a profit was. Every complex investigation set off multiple rounds of AI reasoning, tool calls, and retries, and each one carried a real cost. The more sophisticated the threat, the more expensive it became to investigate. "The customers who need us most are the most expensive ones to serve," he told me.
I've encountered versions of this dilemma repeatedly over the past year, and it looks particularly troubling from the three perspectives that have shaped my career.
I spent years on the offensive side, in Unit 8200, where I learned to think about systems in terms of how they can be broken. I then sat in the CISO chair, where I learned to think about budgets in terms of what I could defend to a CFO. Today, working with founders as an investor, I think about revenue quality and margins. From every one of those seats, I can tell you: the economic model underpinning cybersecurity is being rewritten, whether the industry is ready or not.
The pricing playbook is breaking
For two decades, security vendor pricing rested on a simple bargain. Vendors sold subscriptions per seat or protected asset, expecting low marginal delivery costs to let margins grow as they scaled. Security grew up inside that bargain - budgeting per endpoint, per identity, per gigabyte of security telemetry.
Agentic AI is breaking that bargain in front of our eyes. Every query, reasoning step, and tool call now carries a real cost. Agents, not analysts, increasingly do the work, so headcount says less and less about value. The economics refuse to sit still: Epoch AI's 2025 analysis found annualized declines in LLM inference prices ranging from 9-fold to 900-fold at fixed benchmark performance, depending on the benchmark and performance threshold. Yet an agentic investigation can cost as much or more next year, because the agents reason deeper and longer. ICONIQ describes a builder who budgeted an agentic workflow at ten cents a run; it drifted past $1.50 as agents retried and corrected themselves.
That is the agentic AI pricing paradox: cheaper inference, costlier workflows. Cheaper tokens don't mean cheaper tasks.
Security's twist: the attacker gets a vote on your costs
Here is where my old instincts kick in. Much of what a security agent reads - phishing emails, malicious files, poisoned web content - is shaped by attackers. An adversary can deliberately drive up the cost of the very product built to stop them.
We call it denial-of-wallet - a term borrowed from cloud security, where attackers weaponize pay-per-use billing. Flood the customer with low-grade alerts until their credits run dry. Craft content that pushes an agent into recursive tool-call loops that keep burning tokens. Or simply launch a real incident - which legitimately multiplies investigation volume at exactly the moment coverage matters most.
The worst outcome? A spend cap that switches protection off mid-attack. If an attacker can make your product stop working by making it expensive, your pricing model has become an attack surface. I've spent a career looking for attack surfaces. This one is sitting in your contract, not your code.
Three seats, three dilemmas
Builders must protect unpredictable margins, decide what to charge for when seats no longer track value, and price outcomes that may be breaches that never happen - while "tokens," their most natural unit of cost, mean nothing to a procurement team.
Buyers must lock in a number they can budget, audit, and defend to their CFO, get assurance that protection won't switch off mid-incident, and claim their share as the vendor's delivery costs fall.
Investors must assess revenue quality once credit-based pricing enters the picture. Annual recurring revenue and net revenue retention can fluctuate with consumption. Look at margins by customer cohort and among the 10% of customers with the heaviest usage, not just the average. If margins don't expand as model costs fall, ask where the savings went.
In ICONIQ's January 2026 survey, 37% of the AI companies surveyed expected to change their pricing within a year. The rules are being written right now, in contract negotiations, board meetings, and diligence calls.
At AlphaDrive, those dilemmas led us to bring our portfolio founders' experience together with that of the enterprise CISOs in our Wisdom Team, who work alongside us on investment diligence and portfolio support. We combined research with structured discussions among founders, CISOs, and investors, testing pricing models against real contracts, incidents, and P&Ls. The result is our report, "Pricing Security Products in the Agentic AI Era," a practical framework we developed for the cyber community.
Price the protection, not the computation
One of the most consequential mistakes AI companies can make isexposing their internal cost structure directly to customers. Tokens, inference time, and GPU consumption are meaningful engineering metrics. They are not meaningful procurement units. A CISO doesn't buy tokens. A CISO buys coverage, incidents resolved, third-party risk assessed, remediation paths for top security findings, and ultimately, better security outcomes.
The solution is to separate the vendor's internal cost meter from the customer's external value metric, translating complex AI workloads into understandable, predictable units.
Take the emerging generation of identity and access management startups. They use AI to manage human, machine, and AI agent identities and move organizations toward least privilege - giving each identity only the access it needs. A hybrid pricing model makes sense: a platform fee per protected identity, plus credits for AI workflows such as access reviews. Role mining, which identifies access patterns to define roles, would cost more credits than just-in-time access. One credit pool, different meters - deterministic automation costs fewer credits than AI-driven reasoning.
The CISO can budget it ("this type of campaign = 10 credits") and experiment without a new procurement cycle. Alerts at 75%, 90%, and 100% utilization, alongside agreed rules for overages, help prevent surprise bills. Predictability, CISOs consistently tell us, matters more than the absolute price.
Protection must not expire when the credits do
But economic alignment alone isn't enough. In cybersecurity, the pricing model must also be resilient under attack. That requires safeguards built into both the product and the contract.
When consumption reaches a defined limit, expensive AI workflows should fall back to validated, lower-cost models or deterministic detection rather than disabling baseline protection. Incident-driven surges should have separately defined capacity. Recursive agent behavior must have technical limits. And the allocation of costs generated by malicious manipulation should be agreed in advance, with vendors absorbing defined adversarial-load costs up to negotiated limits.
Buyers should know what they're actually paying for. Credit consumption must be transparent, verifiable, and tied to delivered value. Changes in AI model routing that affect data processing should be disclosed.
These are not merely commercial details or legal fine print. They are part of the security architecture itself.
There is one question I believe every CISO should ask an agentic security vendor before signing a contract: "What happens to our protection when we hit our spending limit in the middle of an attack?" If the answer is anything other than "coverage continues," negotiate until it is. Then put the scope of that continuing protection and its limits in the contract.
The companies that define the next decade will be distinguished not by the sophistication of their agents and security language models alone. They'll build and price intelligently - engineering businesses whose margins expand as they scale - while giving customers predictable economics and maintaining protection when attacks intensify.
If an attacker can exhaust your security budget faster than your agents can stop the attack, the problem was never just your technology. It's your business model.
Elik Etzion is the co-founder and Managing Partner at AlphaDrive.
