OpEx, short for operating expense, is the cost of running a business day to day rather than the cost of building or delivering a specific product. Common examples include cloud subscriptions, security monitoring, staff review time, and office overhead. In accounting, OpEx is usually treated differently from COGS because it supports operations instead of directly creating the service sold.
In cyber security, OpEx matters because many defenses are ongoing operational costs: SIEM licensing, endpoint protection, incident response retainers, and access reviews. It also appears in AI governance, where model usage, human review, and billing controls may be recorded as operating expense even when the workflow supports production work. If teams misclassify these costs, they can hide shadow AI use, blur accountability, or make it harder to detect unusual spend patterns that signal abuse, overuse, or compromised credentials.