Attacker Economics / Adversary ROI
Which findings are actually worth a real adversary's time?
Every other AgentSmack lens over the kill-chain rates the DEFENDER side — how likely a path succeeds (exploitability), what it touches (blast radius), what one fix breaks it (chokepoint). NONE model the ATTACKER's economics: the required skill tier, the step-count / prerequisite effort, and the blast-radius payoff a rational adversary weighs before bothering. This is that lens — a path-level adversary-ROI verdict that re-prioritises a flat findings list by what is actually worth a real attacker's time. It is purely compositional: it re-runs nothing, reusing the kill-chain correlation, the exploitability rating, and the blast-radius magnitude verbatim. And it is honestly humble — a structurally-complete but causally-UNCONFIRMED chain costs the attacker MORE effort (lower ROI) than the same chain with confirmed shared-token lineage, so it never overstates attacker advantage on unproven paths. It adds no new surface and no new dimension.
Vulnerable sample — a confirmed end-to-end exfil chain
Attacker economics — is this finding worth a real adversary's time?
Prime targetAdversary ROI
72/100
Advanced / persistent- Distinct surfaces
- 4
- Lifecycle stages spanned
- 4
- Complete chain
- yes
- Causal confidence
- Causally confirmed
- Blast-radius payoff band
- catastrophic
Adversary ROI 72/100 ⇒ prime_target: a advanced_persistent attacker, effort 92/100 (4 surface(s) × 4 stage(s)) vs payoff 100/100 (blast radius catastrophic); the chain is causally CONFIRMED (cheap to weaponise).
Benign sample — a lone, theoretical low-severity ding
Attacker economics — is this finding worth a real adversary's time?
OpportunisticAdversary ROI
32/100
Script kiddie- Distinct surfaces
- 1
- Lifecycle stages spanned
- 1
- Complete chain
- no
- Causal confidence
- Incomplete path
- Blast-radius payoff band
- contained
Adversary ROI 32/100 ⇒ opportunistic: a script_kiddie attacker, effort 51/100 (1 surface(s) × 1 stage(s)) vs payoff 25/100 (blast radius contained); the path is incomplete — the attacker has not yet reached an end-to-end compromise.
Related read-only meta-lenses over the same findings envelope: Attack-Path / Kill-Chain Correlation · Blast-Radius / Impact · Risk Register · Cyber-Risk Quantification (ALE). POST the same { findings, evidence? } envelope to /api/v1/attacker-economics to run it on your own findings.