Skip to content
T threat.cafe

· Margot Reyes (editorial persona) · Economics and measurement · on threat.cafe

What one compromised developer laptop costs in the agent era: a P10/P50/P90 model you can adapt

One developer laptop compromised through a malicious package or skill that an agent installed costs, in internal response labour alone, roughly $2,300 at P10, $11,300 at P50 and $46,100 at P90 under the illustrative inputs below, priced at a loaded rate of about $93 an hour derived from US Bureau of Labor Statistics data. The breach averages usually quoted, such as IBM's $4.44 million, measure a different event. The variable that moves a laptop incident from five figures toward a claim-sized loss is whether any credential the agent could reach was used before it was rotated.

The headline average is the wrong unit

Budget requests for agent controls usually cite the global average cost of a data breach: $4.44 million in IBM's 2025 study of 600 organisations, covering breaches from March 2024 to February 2025, and $10.22 million in the US (TechRepublic on IBM, 31 July 2025).

That figure is a mean across breaches, which are already the expensive tail of security incidents. Most agent-related compromises described in 2026 write-ups end earlier. The finder isolates the machine, rotates secrets and rebuilds. StepSecurity's guidance after the axios compromise is the template: treat the machine as fully compromised, rotate all credentials from a separate clean machine, reformat and rebuild (StepSecurity, March 2026). That is labour, not a breach. It deserves its own model.

The model

The cost of one incident is the sum of five labour blocks, priced at a loaded hourly rate, plus external costs entered separately.

Cost = R x ( Hrot + Hinv + Hrebuild + Hdown + Hci ) + External

R         loaded hourly cost of the people doing the work
Hrot      credential rotation:  N credentials x hours per credential
Hinv      investigation and scoping across machines, lockfiles, CI logs
Hrebuild  reimaging and restoring the machine
Hdown     productive time lost by the affected developer
Hci       review of CI runs, cloud accounts and repositories the
          exposed credentials could reach
External  IR retainer hours, legal, notification, deductible, losses
          from any credential used before rotation

The loaded rate. The Bureau of Labor Statistics reports a median annual wage of $135,980 for software developers in May 2025 (BLS Occupational Outlook). Dividing by 2,080 hours gives $65.38 an hour in wages. In private industry, wages and salaries were 70.0% of total employer compensation cost in June 2026 (BLS ECEC, 9 September 2026). $65.38 divided by 0.70 gives $93.39. The model uses $93. Replace it with your own fully loaded rate; it is the easiest input to get right.

The scenarios

Illustrative example: the hour inputs below are round, hypothetical figures chosen to show the shape of the model. They are not measured from incidents. Swap in your own.

Block                            P10           P50            P90
-------------------------------  ------------  -------------  ---------------
Credentials the agent could      10            25             60
reach (N)
Hours per credential             0.5           1              2
Hrot  rotation                   5             25             120
Hinv  investigation, scoping     8             40             160
Hrebuild  reimage, restore       4             8              16
Hdown  developer time lost       8             24             80
Hci   CI and cloud review        0             24             120
-------------------------------  ------------  -------------  ---------------
Total hours                      25            121            496
x $93 loaded rate                $2,325        $11,253        $46,128
External costs                   enter yours   enter yours    enter yours

P10 describes a quick catch: a hook or scanner flags the install the same day, the machine holds a handful of personal tokens, and no CI secrets were exposed.

P50 describes a typical agent workstation: MCP servers with their own API keys and OAuth grants, cloud CLI sessions, Git and registry tokens, and a day of scoping to find which other machines pulled the same version.

P90 describes a machine that could reach CI secrets or production cloud credentials, where every pipeline run during the exposure window has to be reviewed. StepSecurity's axios guidance covers exactly that case: rotate any secret a workflow could access during a compromised run and treat self-hosted runners like compromised developer machines.

The load-bearing assumption

Two variables dominate the totals. The first is N, the number of credentials the agent could reach. Rotation hours scale linearly with it, and in the P90 column rotation plus CI review is 240 of 496 hours, or 48%. Agents raise N: an MCP configuration file can hold a separate key or OAuth grant for each connected service, on top of the developer's own CLI logins.

The second variable is not in the labour model at all. If any credential is used by the attacker before rotation, the incident stops being a laptop rebuild and becomes a breach investigation, with notification, legal and possibly a claim. Public data gives scale for that branch only at the claims level. Coalition reports, for its 2025 policyholder book across the US, Canada, the UK, Australia and Germany, an average claim severity of £87,000 across all claims, £202,000 for ransomware, £106,136 for funds transfer fraud and £20,320 for business email compromise (Coalition, 6 March 2026). The same page also states that report figures are in US dollars, so confirm the currency in the full report before quoting it. None of those categories is specific to developer machines or AI agents.

So the honest summary is a two-branch model. If rotation wins the race, the cost is a bounded labour figure in the low thousands to mid-tens of thousands of dollars. If the attacker uses a credential first, the cost moves into claim and breach territory, where the averages above become relevant ceilings rather than expected values.

Competing explanations for why your number may differ

Labour rate. The BLS median excludes contractors, high-cost metros and senior security staff. A team in a high-wage market can double R.

Organisation size. Hinv and Hci scale with the number of machines and pipelines that installed the same version. A shared dependency in a monorepo widens the review.

Tooling. A decision log that records which agent installed what, and when, shortens Hinv. Short-lived, narrowly scoped tokens cut both N and the hours per credential.

Detection delay. The longer the gap between install and detection, the more CI runs and cloud actions fall inside the window, and the higher the chance a credential is used before rotation.

How to collect your own inputs in one afternoon

The hour inputs are the weakest part of any version of this model, including this one. Four measurements replace them with your own data.

  1. Count N. On one representative developer machine, list every credential an agent session can read: MCP server keys and OAuth grants, cloud CLI sessions, Git and registry tokens, kubeconfig contexts, .env files in active projects. Do it for a light user and a heavy user. The spread between them is your P10-to-P90 range for N.
  2. Time one rotation of each type. Have the owner rotate one Git token, one cloud key and one OAuth grant on a test account, from a second machine, including the downstream updates to CI and secret stores. Record minutes, not estimates.
  3. Time a rebuild. Ask IT or your MSP how long a reimage and restore takes, from handover to the developer working again.
  4. Map CI reach. For each credential type, note whether it can read or write CI secrets or production cloud resources. Every "yes" adds review hours to Hci.

Plug the results into the formula and keep the sheet. When the next incident happens, the comparison between the model and the actual hours is the most useful calibration you will get.

Methodology and limits

The wage inputs are public and dated. The hour inputs are illustrative and should be replaced with your own estimates; the best source is a tabletop exercise where each owner times a real rotation of one credential type. The model omits regulatory fines, customer churn and reputational cost, which depend on the breach branch and on your jurisdiction. The Coalition figures are claims averages from one insurer's book; IBM's figures are breach averages across 600 organisations. Neither measures a developer laptop incident directly.

This is a sizing model for budgeting conversations, not financial or insurance advice; check coverage questions with your broker.

Decision consequences

Size preventive spending against the two branches separately. Controls that cut N (scoped tokens, no long-lived secrets in agent configs) and controls that cut detection delay (install-time checks, decision logs) reduce the labour branch. Controls that stop the install, or stop the second stage reaching the network, reduce the probability of entering the breach branch at all.

To measure your own N before an incident does it for you, walk the agent credential inventory in the threat.cafe first-hour runbook, then rerun this model with your numbers.

Sources

#cost-model #incident-cost #credential-rotation #budgeting #developer-security

All posts