arXiv: Beyond Success Rate: Cost-Aware Evaluation of Offensive and Defensive Security Agents

This paper, published on arXiv, introduces a new evaluation framework for AI agents used in cybersecurity, specifically for offensive and defensive operations. It argues that traditional metrics like "success rate" are insufficient because they ignore the costs of false positives, false negatives, and resource consumption. The authors propose a cost-aware evaluation method that accounts for the operational and financial impact of an AI agent's decisions, making it more relevant for real-world deployment.

This publication is primarily relevant to organizations developing or deploying autonomous AI agents for cybersecurity, including technology firms, financial institutions, critical infrastructure operators, and defense contractors. It also affects compliance teams overseeing AI safety and risk management, as the framework challenges existing validation standards that may overlook cost-related risks, such as unnecessary system shutdowns or missed threats due to overly cautious or aggressive agents.

Compliance teams should review their current AI agent evaluation protocols to ensure they incorporate cost-based metrics alongside success rates. They should assess whether their risk management frameworks account for the financial and operational consequences of false positives and negatives. Additionally, teams should monitor if this approach influences future regulatory guidance on AI safety testing, particularly for autonomous security systems under the EU AI Act.