The break-even point is the level at which total costs and total benefits balance out. In cyber security, it is used to decide when a control starts paying for itself. For example, a company may compare the cost of multi-factor authentication, endpoint protection, or logging against the losses it helps avoid, such as account takeover, fraud, downtime, or incident response work.
This concept also matters to attackers. Criminals estimate whether a campaign is worth the effort by balancing tool costs, infrastructure, access fees, and time against expected payoff. If a phishing kit, botnet rental, or brute-force attempt cannot reach break-even, the attack is economically unattractive. Defenders use the same logic to choose layered controls, set thresholds for alerts, and prioritize protections where reduced risk justifies the expense.