Speaker: Leonie Maenner

What an attack costs the attacker determines which attacks against you are realistic at all. And that, in turn, is what your security budget has to be argued against. The talk turns that one figure into three questions, and the answers show whether your programme was reasoned or merely negotiated.

First question: what is access to your organisation worth on the open market? Criminal markets price this surprisingly openly. A rented hacktivist DDoS campaign runs into the low hundreds of euros. Access to a large enterprise was listed by initial access brokers at an average of around 113,000 US dollars in the second half of 2025. A state-funded operation, with its own zero-day and an implant somewhere in the supply chain, runs into the millions and works ...