Each attack has a price. The goal is to make this price higher

An attacker running agents against thousands of organizations still has a finite budget for compute and infrastructure. AI lowered the cost of each attempt, yet each target gets only a limited share of that budget. So, I’d measure defense partly by how much extra work a given target forces the attacker to do on it.

Delays and IP blocks add little to that. An agent can work on a hundred organizations in parallel, and a proxy pool absorbs a lost address. Which measures add noticeable cost depends on the stage. From outside, challenges and traps that lead the agent into plausible dead ends cost it tokens and time on that target. Inside, decoy credentials and accounts matter more, because using one gives an almost certain signal and lets you burn a foothold the attacker has already paid for.

For opportunistic campaigns this can change the calculation enough for them to spend less on you. The vulnerability itself stays until the fix gets a slot in a change window, which is often the real constraint, but less automated activity reaches it in the meantime. Targeted attacks are a different case and are handled by other means.

I wrote about the different cost of mistakes for attackers and defenders in “A Vulnerability Is Not an Exposure”.