Return on tokens (ROT) is a proposed efficiency metric for AI systems. It compares the business value produced by a model or workflow against the number of tokens consumed. In practice, ROT asks a simple question: does the output justify the compute, latency, and cost spent to generate it?
In cyber security, ROT matters because AI is increasingly used for SOC triage, phishing analysis, log summarization, and automated response. Low ROT can reveal wasteful prompts, oversized context windows, retry loops, or agent workflows that consume tokens without improving decisions. Attackers can also exploit token-heavy paths through prompt injection, tool abuse, or conversation loops to drive up cost and exhaust quotas. Defenders use ROT alongside logging, budgets, and policy controls to spot runaway automation, reduce exposure to denial-of-wallet behavior, and keep AI aligned with measurable security outcomes.