Imagine a Tuesday night at 11:47 PM. A senior SOC analyst is pulled into a critical high-severity alert. A primary domain controller has flagged a deeply anomalous administrative command sequence originating from a mid-level employee's standard workstation. The analyst triggers AI agents to assist: mapping the account's full authentication timeline, cross-referencing internal network logs, scanning active threat intelligence feeds, and building secondary queries to hunt for lateral movement. The investigation moves at machine speed.
Then the screen changes: “You have reached your monthly AI limit. Upgrade to Enterprise Plus to continue. Your limit resets at 3:30 AM.”
While this scenario is illustrative, the underlying reality is already here. Every cybersecurity vendor is racing to embed AI to deliver faster detection, autonomous investigation, and agentic response. But the pricing models for these capabilities are not getting enough attention. As the industry rushes to adopt generative and agentic AI, security platforms are shifting from predictable software licensing to volatile, machine-driven consumption economics. The bill is landing on CISOs with little warning and no ceiling.
Understanding the Three Layers of AI in Cybersecurity
To grasp why token costs matter, it's essential to understand how AI has evolved inside cybersecurity platforms. The first layer is machine learning (ML), which operates on statistical matrices and behavioral baselines. ML calculates mathematical distances between numerical data points rather than reading language, so its token consumption is exactly zero. The cost is measured in CPU cycles or GPU compute time, with no variable token expense.
The second layer is generative AI (GenAI), which serves as an interactive assistant or translation layer. It depends on a human in the loop. A user types a prompt, and the AI returns an incident summary before going idle. Token usage is bounded entirely by human text entry, making it small, linear, and highly predictable.
The third layer is agentic AI, which removes the human bottleneck. Given a single high-level goal, such as determining if a server is compromised, the agent spins up a multi-step execution loop. It autonomously calls APIs, parses raw logs, evaluates payloads, and feeds context back into the large language model (LLM) to plan its next move. There is no human pacing the machine. The meter runs until the job is done.
The Token Meter Running in the Background
Enterprise software has historically billed on fixed, predictable metrics: per-seat licenses or per-device/endpoint licenses. Frontier AI model providers charge per token, roughly three-quarters of a word, billing fractions of a cent for every word the machine reads (input tokens) and writes (output tokens). For example, Anthropic’s Claude Sonnet 4.6 costs $3.00 per million input tokens and $15.00 per million output tokens. GPT-5.5 runs $5.00 per million input tokens and $30.00 per million output tokens. These are the costs vendors pay when they call commercial AI APIs, which are then passed through, marked up, or absorbed into SaaS subscription pricing.
LLM API prices have dropped roughly 80% between early 2025 and early 2026. That is genuine good news. However, token economics in cybersecurity are unlike any other enterprise AI application because the data volumes are orders of magnitude larger and security functions can be more complex. Alert triage for a single alert with basic context might consume 1,000 tokens. A guided investigation pulling relevant telemetry and reasoning across an event chain may use 20,000 to 50,000 tokens per incident. A fully autonomous agentic loop is different in kind, not just degree. The agent reads hundreds of thousands of lines of raw text logs, formats complex API calls, evaluates payloads, and continuously feeds context back into the model. A single complex, multi-stage incident investigation may burn millions of tokens in minutes. Multiply that by the number of security alerts generated daily.
Real-world cases confirm the explosive costs. A single unidentified company ran up a $500 million Claude bill in one month simply by failing to put usage limits on employee licenses. Uber’s CTO burned through his entire AI budget for 2026 by April. Within cybersecurity, when Palo Alto Networks began testing Anthropic’s Claude Mythos against its own source code, the model found more than two dozen critical vulnerabilities, but the company burned through more than $1 million worth of tokens doing it.
Consequences for Security Operations
These early signals reveal a structural mismatch between the cost of running frontier AI models and what security budgets are designed to absorb. The consequences are significant. First, the shift to token-based pricing turns cybersecurity into a variable operational expense with no natural ceiling. A major enterprise-wide malware outbreak or a prolonged insider threat campaign could require thousands of simultaneous autonomous investigations, potentially wiping out an entire quarter’s cybersecurity budget in a single weekend. No CISO has a contingency line for that.
Second, forced operational compromises arise. The SIEM industry spent years charging organizations for the amount of data ingested. Because of costs, organizations limited data collected, leading to blind spots. AI token pricing dynamics create the same risks at a larger scale and faster pace. When organizations hit consumption limits mid-incident, security operations managers face an impossible choice: pay the overage, throttle the investigation, or revert to manual triage. In practice, teams may begin disabling agentic workflows or skipping deep automated triage on lower-priority alerts simply to preserve monthly token credits. The result is poor security outcomes.
Third, organizations must reconsider deployment architectures. Cloud-based architectures pass volatile AI costs directly to the customer. Every reasoning loop, API call, and multi-agent orchestration step runs on someone else’s infrastructure at someone else’s price. On-premises architectures address this with fixed local compute, hardware that can execute complex reasoning loops without token meters running in the background. For organizations that need agentic AI to run continuously at full depth, not in metered bursts, on-premises is the only architecture that makes the economics work.
As AI consumption costs climb, expect a wave of new credit-based pricing models from cybersecurity vendors. Credit-based systems abstract tokens into operations or AI credits. For vendors, credits solve a real margin problem by recovering volatile AI infrastructure costs without repricing every contract. For CISOs, this shift means moving from predictable budgets to variable consumption economics, whether they are ready or not.
The underlying dynamic — frontier AI capability meeting security-scale complexity — is real. The cybersecurity ecosystem and frontier AI model vendors are permanently linked. Security vendors cannot maintain a defensive advantage against automated adversaries without elite reasoning models. But the winners in the machine-speed security race will not be the teams with the most powerful autonomous agents. They will be organizations that understand AI in security as three distinct layers, each with its own cost model and the right job to do. Machine learning handles continuous high-volume detection. Generative AI brings context and reasoning to investigation. Agentic AI closes the loop with autonomous action. The organizations that win will select the right platform, architectures, and AI models for optimal cybersecurity outcomes — without letting token costs become a constraint that adversaries exploit.
Related: Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed. Learn more at the AI Risk Summit.
Source: SecurityWeek News