Attackers run businesses. Raise their costs and the abuse often stops paying. In Inverted Podcast #6, the hosts show how strategic friction and infrastructure cost can defend products without crushing legitimate users.
The discussion covers what cost means in security, creative injections such as throttling and device locks, phone farms and geo defenses, balancing pain for abusers versus real users, attacker ROI in call center scams, threat sharing, and durable defense through collaboration.
About this episode
Jeroen, Dario, and Dana lead a hosts-only episode on injecting cost into attacker journeys. They cover phone farms, geo and IP defenses, call center scams, threat sharing, and practical steps to adopt cost-based thinking on a security roadmap.
Key takeaways
- Model attackers as businesses with margins, and target their ROI.
- Cost can be time, money, devices, IPs, reputation, or operational complexity.
- Throttling, locks, delays, and geo signals are tools when tuned to spare good users.
- Phone farms and similar infrastructure are leverage points for durable disruption.
- Threat sharing and collective action raise costs industry-wide.
- Adopt cost-based thinking as a product framework, not a one-off control.
Topics covered
- What cost means in security product design
- Breaking the attacker’s business model
- Phone farms, devices, IP, and geo-based defenses
- Balancing attacker cost vs legitimate user friction
- Attacker ROI and call center scam economics
- Threat sharing and collaborative durable defense
Chapters
00:00 Intro & Welcome
00:55 What Does “Cost” Mean in Security?
02:01 Breaking the Attacker’s Business Model
04:45 Creative Ways to Inject Cost
06:13 Phone Farms & Device Costs
07:44 IP Address & Geo-Based Defenses
08:59 Spectrum of Cost Injection
10:09 Balancing Cost for Attackers vs. Real Users
13:43 Real-World Hijack Example & Arrests
15:05 Attacker ROI & Call Center Scams
17:01 Infrastructure Costs & Threat Sharing
20:13 Durable Defense Through Collaboration
26:37 Practical Steps to Adopt Cost-Based Thinking
29:13 Wrap-Up & Final Thoughts
For inverted product managers, the practical test is whether your roadmap reduces measurable damage for real users without inventing vanity metrics. Use the chapters above to jump to the sections most relevant to your team, then bring one concrete change into your next planning cycle.
Cost-based defense works best when product, risk, and platform teams share a view of attacker unit economics. Start by naming the abuse business you are disrupting, estimate their variable costs, then pick interventions that raise those costs faster than yours. Revisit the model when attackers adapt, and measure whether legitimate conversion and support load stay within appetite.
FAQ
What is cost-based defense?
It is designing product and infrastructure controls that make abuse more expensive in time, money, or operations than the payoff, while keeping friction low for legitimate users.
Will more friction always hurt users?
Not if cost is targeted. Risk-based delays, device binding, and infra disruption can hit farms and bots harder than real customers.
How does this connect to inverted products?
Inverted products win when abuse stays unprofitable. Cost is a direct lever on that inverted outcome.
Related on Inverted PM
- Podcast #3: Critical Attacker Journey
- Podcast #4: Damage as the Ultimate Metric
- Podcast #7: Scraping, Extensions, Shifting Threats
- Podcast #8: Social Engineering
- Meet the hosts
- All Inverted Podcast episodes
Connect with the hosts and guests on the video or on LinkedIn to continue the conversation.
🎧 Find the Inverted Podcast on LinkedIn, Spotify, YouTube, Amazon Music/Audible, iHeartRadio, or invertedpm.com.
Explore more
Browse all Inverted Podcast episodes, read the blog, or meet the hosts.
Related: Episode 3 – Critical Attacker Journey · Episode 7 – Scraping and Extensions