Activity-based costing (ABC) is a method for assigning expenses to specific activities based on the resources they consume. Instead of spreading overhead evenly, it traces labor, tooling, infrastructure, and support effort to the exact work being done, such as patching servers, reviewing alerts, or handling user access requests.
In cyber security, ABC helps teams see the real cost of controls and operations. It can show that a “cheap” process actually consumes expensive analyst time or log storage, while a manual approval step may be a hidden bottleneck. Defenders use ABC to compare control options, prioritize automation, and justify security budgets with concrete cost data. It also helps during incident response, where repeated containment, forensics, and recovery tasks can be measured as distinct activities. Attackers can exploit organizations with weak cost visibility by creating alert floods, phishing follow-up, or denial-of-service pressure that drives up the cost of defense.