Attacking you costs $5 per try

Somebody typed a few lines of instructions ...

"Find real online shops in four countries, look for a way to run your own code on them, leave a file uploader behind."

Then they walked away.

The thing they'd set up tried more than a thousand sites across the US, Canada, Japan and Australia, with nobody watching it work.

The interesting part isn't that software did the attacking, but what the person stopped having to do.

By the end of this you'll know which of your defenses that removed, and you'll have a free, boring exercise to run this week instead.

The shield you didn't know you had

For years, small companies have been protected by something nobody puts on an architecture diagram. An attacker had to decide you were worth their evening.

Reconnaissance is just the homework before an attack, and it used to be done by hand. Humans only have so many evenings, so they ranked targets by what they looked worth and started at the top.

That is the real engine behind "we're too small for anyone to bother with." A bike lock doesn't stop a thief. It makes them walk to the next bike.

What a thousand attacks actually cost

A Norwegian security firm called NorForge got a look most researchers never get. Somebody running this operation had left more than twenty of their own control panels on the open internet with no password on them, so the researchers opened them and read the attackers' own books. Their writeup is where most of what follows comes from.

Three things in those books are worth your time.

About $5 a try. That's the AI bill for one attempt on one target, averaged across every attempt, including the ones that fizzled out in the first ten minutes. The researchers are honest that it's an estimate, with uncertainty that "is however considerable." Treat it as the right order of magnitude rather than the right number. Either way, it's less than a sandwich.

Roughly one in ten attempts got in, which is to say nine in ten bounced off. The report is careful here, and so should you be, since the groups it looked at "have different focus, go after different targets, and what constitutes success varies. They are not directly comparable." Don't multiply a thousand sites by ten percent and call it a breach count.

A bit under 23 hours. The average time from starting on a target to getting in, counting only the attempts that worked. One ground away for five days.

Why 23 hours is the number that should bother you

Twenty-three hours is embarrassing, from the attacker's side. A competent human with a working exploit is in within the hour. These agents took most of a day, scribbling roughly a hundred and forty notes to a shared scratchpad, and got there by sheer plodding.

So what changed isn't skill but patience, and what patience costs now.

An attacker was never short of knowledge about how to break things, published openly for twenty years. They were short of attention. Somebody had to sit down and spend an evening on you, and that scarcity is what did the triage.

An unattended 23-hour run costs about five dollars. There's your shield, gone.

Small didn't save you, but boring still might

Now the part that cuts the other way (headlines oversold this one).

The targeting was fussier than you'd think. A typical task, in the researchers' translation, asked for "confirmed real shopping/e-commerce websites in four countries (US/CA/JP/AU), with traffic of 200,000–1.5 million. Playwright has verified that orders can be placed."

Playwright drives a real browser automatically, so that last line means something had already clicked through to a working checkout. A sector, four countries, a traffic floor, proof you take money. If your site gets four hundred visits a month, you were never on this list.

What the machinery never did was rank whoever cleared that bar. My favourite detail in the writeup is that a bug in the attacker's own code for tidying up target names stripped a stray letter, so "wholesale" came out as "holesale." Nobody was reading these one by one, or they'd have caught it.

So be precise about which filter disappeared. The first one, "am I in a category anybody attacks," was always a yes for anyone who takes card payments. The second was "yes, but will they get around to me?" That one was priced in human attention, and attention just got cheap.

The agent had no opinion about how old your bugs were

The researchers verified one break-in by hand, at a hardware parts vendor, and the way in was two pieces of neglect stacked on each other: a cache server that accepted writes from anyone, and an old library that would happily run code hidden inside data it was handed. Neither was new or clever. A decade of deferred maintenance, collected in an afternoon.

The toolkit tells a different story, though. Next to free tools older than most of this, the agents carried a working exploit for CVE-2026-75650, a flaw in Adobe Commerce and Magento Open Source that lets an attacker run code without logging in. It scores a flat 10 out of 10 for severity, and the US cyber agency added it to its catalog of flaws known to be under active attack a day after publication.

That mix is the whole point. Some doors opened because of rot nobody had got round to, and one opened faster than any patching schedule could have closed it. The agent had no preference about which kind you were running, which is why "patch faster" is good advice that only answers half the problem.

Let me argue against my own article

I'd rather you distrust this story a bit than over-react to it, so here are the strongest objections.

• Nine in ten attempts failed. Patched, dull, inventoried infrastructure held the line, which is the least-reported fact in all of this. Although the report notes plenty of the failures still scraped up information for later, so it isn't nine in ten clean defensive wins.
• Nobody knows what was taken. Reuters, reporting on the same researcher, couldn't establish how much data, if any, left. What's confirmed is back doors left for later, which means access rather than loss.
• Most of the counting is the attacker's own. The researchers verified two break-ins themselves. The rest, including every "goal met" flag, comes out of the attackers' own dashboards, and dashboards record claims. Nobody even confirmed which AI was driving it. The evidence is a label in a config file, about as trustworthy as a handwritten name tag.
• The feared wave still hasn't shown up in the data. Root Evidence went through every confirmed real-world exploitation of a published flaw since January 2018 for The Vulnpocalypse Report and found only a hair over one percent were ever used in an attack. Google's threat team, on a separate dataset, landed in the same neighbourhood. The authors sell vulnerability management, so read them with that in mind, but two unrelated datasets agreeing that closely is a serious argument.

A zero-day, by the way, is a flaw under attack before any fix exists, which is the tiny sliver on the end. The thick band is everything that had a patch available and simply didn't get patched.

One more number argues against alarm. The gap between a fix shipping and anyone attacking that flaw has been widening, not narrowing.

Read that caption before you relax, though. A median is the midpoint, so half of everything landed faster than it, and a third of last year's cases arrived within a month of the fix going out. You get more breathing room than you used to, typically. Typically is not a promise.

None of which rescues obscurity. A one-in-ten hit rate is a perfectly good business when each try costs five dollars and you don't care who picks up. You don't have to be good at this anymore. You just have to not mind who answers the door.

Meanwhile, we got slower

The harder problem is on our side.

Verizon publishes an annual breach study built from more than 31,000 real incidents across 145 countries. In the 2026 edition, exploiting a flaw in software has overtaken stolen passwords as the most common way attackers get in. Unpatched software is the front door now.

And on that list of flaws known to be under active attack, where the prioritising is already done for you, organisations finished fewer fixes than the year before.

So trying to break in got cheap, and stopped caring who you are. Finishing the repair got slower, on the easiest list in the business.

What to do instead: find out what you're exposing

The useful question changes shape. It stops being "does anything about us look worth attacking" and becomes "what of ours is reachable from the internet, and do we even know it's there?" That one is cheaper to answer, and it needs no product and no budget.

• Read your own certificate list. Every time anyone sets up HTTPS on one of your domains, that name goes into a public, permanent log, which makes certificate transparency a free index of your own infrastructure. Put your main domain into crt.sh and read every name that comes back. The ones that make you squint are the exercise: the staging site from a rebuild two years ago, the subdomain a contractor stood up, the thing an agency never mentioned.
• Check your DNS points where you think. Pull up every record you have (Route 53 docs if you're on AWS) and look for ones aimed at an address you no longer own. A record still pointing at a vendor you stopped paying is a sign hanging on an empty shop, and whoever claims that address inherits your traffic. For five dollars, somebody will. Fill the gaps with OWASP Amass, which maps a company's internet-facing footprint and sat in the attacker's toolkit too.
• Then make it keep itself honest. Any inventory you build by hand is stale in a month, so have AWS Config or Google Cloud Asset Inventory track it, scan it with AWS Inspector, and work the known-exploited list first. Switch off anything nobody will claim, and put a human's name next to whatever stays.

Inventory is boring and never really finishes. It's still the best hour you'll spend this week.

The ending nobody planned

One last thing, since it's too good to leave out.

Remember why the researchers could read any of this, those control panels were wide open because nobody had secured them. Inside were hundreds of leftover credentials, a chunk still working, plus full admin controls for anybody who knew the web address.

Other people found them too. In a follow-up, the same researchers reported that strangers began feeding malicious instructions into at least seventeen of those panels, harvesting AI keys and in several cases talking the attacker's own agents into installing remote-control software.

So the operator who industrialised the hunt for other people's forgotten infrastructure lost his own to the same economics, inside a week. Nobody looked him up and decided he mattered. Nobody looked him up at all.

Go pull your certificate list this week and read the names. The one you can't account for is the one this was about.