Glossary
Attacker Cost
Attacker cost reframes a security control's value around how much time, resource, and risk of detection it forces an adversary to spend, rather than around a claim that the control makes an attack impossible. Very few controls actually make something impossible; most raise the cost of succeeding, which changes an attacker's calculus about whether the effort is worthwhile relative to what they'd gain.
This framing is useful specifically because it avoids overselling what a given control does. A control described honestly as 'raises the cost of X' sets an accurate expectation; one implicitly promising X can never happen sets an expectation that a single counterexample can seem to falsify entirely, even where the control is doing real, valuable work.