Work factor is an estimate of the computational effort required to finish an attack. It is usually expressed as the amount of time, operations, memory, data, or specialized hardware an attacker would need. In cryptography, a higher work factor means the attack is less practical, even if it is mathematically possible.
Security teams use work factor to compare attack costs against real-world resources. A scheme may have a known weakness, but if the work factor is enormous, it can still be considered safe enough for current use. In research, work factor helps explain why reduced-round breaks or speedups do not automatically threaten full systems. For example, an attack that needs unrealistic chosen plaintexts or huge computation may be academically interesting while remaining operationally irrelevant. Defenders watch for changes that reduce work factor, because even a small structural shortcut can make a previously infeasible attack more realistic.