Progress Per Dollar

A way of measuring how much useful security work an AI system can do for each unit of cost. In offensive security, this matters more than raw benchmark rank because attackers optimise for repeated attempts, runtime, and affordability rather than isolated peak performance.

Expanded Definition

Progress per dollar is the practical measure of how much security-relevant work an AI system can perform for each unit of spend, rather than how well it performs on a single benchmark. In NHI and agentic security, the metric matters because an attacker, red teamer, or defender rarely cares about peak capability alone. They care about repeatability, throughput, latency, and the ability to sustain many attempts without making the operation too costly. This is especially relevant when comparing automated reconnaissance, credential abuse detection, phishing analysis, or malware triage workflows where marginal cost changes the viable scale of the activity.

Definitions vary across vendors because some teams use the phrase to mean inference cost efficiency, while others include tooling, orchestration, and human oversight. NHI Management Group treats it as an operational decision metric: useful output divided by total deployed cost across the full workflow. That framing aligns with NIST Cybersecurity Framework 2.0 thinking about outcomes, not just isolated technical performance, and it keeps attention on what can be sustained in production. The most common misapplication is equating a top benchmark score with high progress per dollar, which occurs when teams ignore runtime cost, rate limits, and repeated-use overhead.

Examples and Use Cases

Implementing progress per dollar rigorously often introduces a tradeoff between maximum capability and scalable affordability, requiring organisations to weigh single-run brilliance against sustained throughput.

• An offensive testing team compares two AI agents for web reconnaissance and selects the one that finds slightly fewer issues but can run 10x more checks within the same budget.
• A detection engineering group uses an AI pipeline to classify suspicious service-account activity, prioritising a model that handles higher alert volume at lower per-case cost, informed by the NHI realities described in Ultimate Guide to NHIs.
• A SOC benchmarks automated enrichment for API-key exposure events and chooses a workflow that is marginally less accurate but dramatically cheaper to run across continuous monitoring cycles.
• An agentic AI team evaluates tool-using assistants for credential review and prefers the system that sustains more iterations per dollar, rather than the one with the highest one-shot score on a lab task.

This metric is also shaped by deployment architecture. Model choice, prompt length, retrieval overhead, and orchestration logic can all change whether a system remains economical at scale. For implementation patterns that emphasise resilient identity operations and repeated verification, NHI Management Group’s Ultimate Guide to NHIs is a useful companion reference, while NIST Cybersecurity Framework 2.0 helps frame measurable security outcomes.

Why It Matters in NHI Security

Progress per dollar matters because NHI security problems are usually persistent, high-volume, and operationally expensive. The same economics apply to defenders and attackers: if a process is too costly, it will not be run often enough to keep pace with secret sprawl, service-account abuse, or large-scale token review. NHI Mgmt Group reports that only 5.7% of organisations have full visibility into their service accounts, which means many environments cannot afford slow, manual, one-off analysis if they want meaningful coverage. A security control that looks excellent in a demo can still fail in production if it cannot be repeated across thousands of identities, workloads, and alerts.

Understanding this term helps teams choose automation that actually scales: not the fanciest agent, but the one that produces durable security work for the lowest total cost. That is particularly important when secrets live in code, CI/CD systems, and other places that require continuous scanning and verification, as highlighted in Ultimate Guide to NHIs. Organisations typically encounter the true cost of weak progress per dollar only after a breach investigation or response surge, at which point repeated analysis becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What do teams get wrong about per-seat licensing in agentic environments?
• Should security teams prefer tenant-scoped sync over per-realm provisioning models?
• What breaks when session policy is global instead of per application?
• How should security teams enforce per-client authorization in MCP environments?