Because a model does not need perfect recall to create serious risk if it can cheaply generate many attempts. The practical question is how much exploit work an adversary can produce per dollar, since that determines how quickly weakness turns into operational pressure.
Why attacker economics matters more than perfect exploit recall
exploit recall is a narrow measurement: it asks how many known weaknesses a model can surface. Attacker economics is broader and more operationally important: it asks how much offensive work an adversary can generate for the cost they pay. A system with imperfect recall can still create serious pressure if it cheaply produces enough plausible attempts to scale exploitation faster than defenders can respond.
The practical reason is that real-world damage rarely requires one perfect exploit. Attackers benefit from volume, automation, and low marginal cost, because security teams must defend every exposed surface while attackers need only one workable path. That is why a model that can produce many viable attempts, even with misses, may be more dangerous than a model that recalls fewer exploits but does so at higher cost or lower throughput.
In other words, the security question is not just “Did the model remember the exploit?” but “Can the adversary afford to run this at scale?” When cost per attempt drops, weak spots become operationally actionable faster, and defenders face more noise, more triage, and more chances for one attempt to land. A metric centered only on recall can miss that shift in pressure.
What changes when offensive output gets cheaper
Lower attacker cost changes the balance between discovery, adaptation, and persistence. A modest model that can generate many probe variants, adapt payload wording, or speed up reconnaissance can materially improve an attacker’s throughput even if it does not perfectly enumerate exploits from memory. The advantage comes from iteration speed and cheap experimentation, not only from encyclopedic coverage.
This is especially important when exploitability depends on small variations in target, timing, or delivery. The attacker does not need the first attempt to be ideal if they can cheaply test dozens of candidates. That makes “good enough at scale” more relevant than “best possible recall once.” The defender’s burden grows because each low-cost attempt can expose a new control gap, misconfiguration, or unmonitored path.
For that reason, evaluation should combine capability and economics. Recall tells you about completeness. Economics tells you about feasibility. If a model makes exploitation cheaper, the risk can increase even when the model misses some known techniques. Cost, speed, and repeatability often determine whether a weakness stays theoretical or turns into real operational pressure.
How practitioners should think about the metric
Use exploit recall as a supporting signal, not the final judgment. It helps measure whether a model can recognize a set of known weaknesses, but it does not tell you whether an attacker can weaponize that knowledge efficiently. The more useful question is whether the model lowers the barrier to productive abuse, because that is what changes risk at the system level.
For this reason, compare models on attack throughput, cost per usable attempt, and the amount of human steering required to reach a viable result. A model that is slightly less accurate but much cheaper to operate may create more pressure than a higher-recall model that is expensive, slow, or easy to contain. FIRST EPSS is a useful reminder that prioritisation is often about likelihood and operational exposure, not just theoretical completeness.
Where exploit work is tied to known active threats, the right yardstick is whether the tool helps scale what attackers already do. Public tracking of exploited issues, such as CISA’s Known Exploited Vulnerabilities Catalog, reflects that defenders care most about what is being used in practice. For coverage of specific weaknesses and affected software, NIST National Vulnerability Database remains the standard reference point.
Risk and Threat Considerations
Cheap exploit generation creates risk because it can turn moderate capability into high-volume abuse. Even when individual attempts are mediocre, the attacker’s cost curve can collapse faster than the defender’s review and remediation curve, which increases exposure across exposed services, credentials, and workflows.
Failure mechanism: The attacker uses low-cost automation to generate repeated probes, payload variants, or phishing and exploit attempts until one path succeeds, while defenders are forced to evaluate far more activity than they can triage in real time.
Impact: Weaknesses become exploitable at scale, response queues grow, and the organisation faces more account compromise, service abuse, and incident churn even without a perfectly recalled exploit catalog.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Exploit economics depends on repeatable attacker infrastructure and staging capacity. |
| Recommendation — Map repeated offensive attempt generation to T1583-style staging and hunt for supporting infrastructure at scale. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The question is about turning weakness into operational pressure through exploit volume. |
| Recommendation — Prioritise continuous vulnerability management to reduce the window attackers can repeatedly abuse. | ||
| NIST CSF 2.0 | ID.RA-01 — Threat and Vulnerability Identification | Attacker economics changes how exposure becomes operationally significant. |
| Recommendation — Assess whether cheaper exploit generation changes your threat and vulnerability exposure. | ||
Practitioner Guidance
What to prioritise: Measure how much harmful output an adversary can produce per unit of effort, not just how many known exploits a model can recall. If a capability materially reduces attacker cost, treat it as a risk multiplier even when recall is imperfect.
What to verify: Test for volume, speed, and repeatability under constrained conditions. The key question is whether the model can keep producing usable attempts after initial failures, because persistence of effort is often more important than first-pass accuracy.
Practitioner takeaway: In offensive risk, scale beats elegance, so the defensible metric is attacker economics plus enough exploitability to matter, not perfect recall in isolation.
Related resources from NHI Mgmt Group
- Why does identity matter more when vulnerabilities are discovered faster than they can be patched?
- Why do still-valid secrets matter after public disclosure?
- Why do identity controls matter more when exploit development is automated?
- Why do phishing-resistant credentials matter more when exploit automation improves?