Denial-Of-Wallet Attack

Expanded Definition

A denial-of-wallet attack is a cost-amplification abuse pattern, not a classic availability outage. The attacker intentionally drives billable activity by forcing repeated model calls, function invocations, data retrieval, or other metered operations until the victim absorbs the expense. In NHI and agentic AI environments, the risk is especially acute when an AI agent, service account, or API integration can execute actions without tight spend controls. Industry usage is still evolving, but the core idea is consistent: the target is the wallet, not only the workload. For adjacent context, NIST SP 800-53 Rev. 5 frames this as an access and resource governance problem, while identity-centric controls in the Ultimate Guide to NHIs — Key Challenges and Risks show how overprivileged machine identities can magnify impact. The most common misapplication is treating runaway spend as a pure cloud-finops issue, which occurs when teams ignore the identity or tool path that allowed the expensive activity to be triggered.

Examples and Use Cases

Implementing detection and throttling rigorously often introduces latency and false positives, requiring organisations to weigh cost containment against user and agent experience.

• An exposed API key is used to trigger thousands of inference requests against a paid model endpoint, rapidly inflating usage charges.
• A compromised service account loops through function calls in a serverless workflow, turning low-cost automation into a high-bill event.
• A malicious prompt causes an AI agent to enumerate resources, fetch large documents, and retry failed tool calls, increasing metered consumption.
• Cloud logs and billing telemetry are correlated with identity activity to identify whether a specific NHI is creating abnormal spend, as described in the 52 NHI Breaches Analysis.
• Teams apply usage caps and alerting based on guidance from CISA cyber threat advisories and map repeatable abuse patterns to the MITRE ATT&CK Enterprise Matrix.

Where the term is used in practice, it usually sits at the intersection of billing controls, NHI governance, and abuse detection rather than under one team alone. The Top 10 NHI Issues and OWASP NHI Top 10 both help explain why tool access and secret exposure matter here.

Why It Matters in NHI Security

Denial-of-wallet attacks turn identity compromise into immediate financial damage. When NHIs carry excessive privileges, valid tokens, or long-lived API keys, an attacker does not need to break availability to cause harm. They only need a path to invoke expensive services repeatedly. NHI Management Group’s research shows that 96% of organisations store secrets outside secrets managers, 73% of vaults are misconfigured, and 97% of NHIs carry excessive privileges. Those conditions make cost abuse more likely because the same weak control plane that exposes credentials also enables unbounded usage. The problem is not limited to cloud accounts: agentic systems can chain tool calls, fetch large context windows, and retry operations in ways that multiply spend. The NHI posture described in the Ultimate Guide to NHIs shows why visibility, rotation, and least privilege are financial controls as much as security controls. Organisations typically encounter the real business impact only after a billing spike or budget overrun exposes the abuse, at which point denial-of-wallet becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Denial of Wallet
• Why does Agentic AI make NHI attack surface expand so significantly?
• What is the difference between attack surface management and NHI governance?
• Why do NHIs create a larger attack surface than human users?