Credential compromise is usually discussed as a data risk. For most engineering-led companies the realised loss is more often financial, and it arrives through the bill rather than through an exfiltration.
How stolen credentials get monetised
An attacker with cloud credentials has three broad options, and only one of them is the one security teams plan for.
Data theft is the assumed threat and the least common in practice, because it requires the data to be worth something to someone specific.
Cryptomining is the classic. Spin up as much compute as the account permits, in as many regions as possible, and mine until stopped. Immediate revenue, no buyer required.
Resold inference is the newer and now more common variant. Model API credentials are used to serve inference to a third party, sometimes sold on as cheap access. This is why AI provider keys are now targeted as aggressively as cloud ones.
The second and third are attractive precisely because they convert your credential into money without needing to understand your business at all.
The rates involved
Compute abuse scales with what the account permits. An attacker who can launch GPU instances across several regions can reach thousands of dollars an hour within minutes of gaining access. There is no ramp — provisioning is instant and they have no reason to be gradual.
Inference abuse is similar in shape. High-throughput calls against a model endpoint produce a curve that goes from baseline to enormous in a single hour.
The relevant property is not the peak rate. It is that the rate is constant and continues indefinitely until someone intervenes.
Why the loss is a function of time
Total loss is burn rate multiplied by duration. Burn rate is set by the attacker; duration is set by you.
At $5,000 an hour:
- Caught in one hour: $5,000
- Caught in one day: $120,000
- Caught at month end: catastrophic, bounded only by provider quotas
In practice quotas cap the ceiling, but the shape holds: every hour is linear additional loss, and the difference between hours and weeks is the whole outcome.
This is why detection latency, rather than prevention alone, deserves budget. Prevention reduces probability; detection reduces magnitude. You need both, and most teams have only invested in the first.
Why security tooling often misses it
Nothing the attacker does is technically unauthorised. They hold valid credentials and are making valid API calls to services the account is entitled to use.
Access monitoring looks for authentication failures, unusual principals, privilege escalation. Credential abuse produces none of those — it produces a successful authentication followed by a great deal of legitimate-looking work.
What is anomalous is volume and pattern, and those are cost signals. Which is why, uncomfortably often, the first alarm is a cost baseline rather than a security control.
The signature in cost data
Four characteristics together are close to diagnostic:
Vertical onset. Baseline to enormous within an hour, no ramp.
No diurnal rhythm. Legitimate spend is quiet overnight. Abuse runs flat, because it is not driven by your users. A service holding a high rate at 3am when it never has before is the strongest single indicator.
Unusual service or region. Compute or inference in places you do not deploy to.
Sustained. It does not error out or complete, because nothing is wrong from the attacker's point of view.
What it costs beyond the bill
Engineering time. A credential compromise consumes a team for a day or more — revocation, rotation, audit for persistence, root cause.
Rotation across the estate. If you cannot establish which credential leaked, you rotate everything.
Customer and compliance obligations. Depending on what the credential could reach, notification may be required even if no data moved.
Provider credits are likely but not guaranteed. Most providers will consider a credit for verified abuse, weighted by how quickly you detected and revoked. A documented timeline materially improves the outcome — which is another argument for detection you can evidence.
Reducing both terms
Probability: short-lived credentials, least privilege, secret scanning in CI, no long-lived keys in environment variables, alerting on credential creation.
Magnitude: statistical baselines per provider and service, evaluated daily, so a hundred-fold deviation reaches a human within hours rather than at month end.
We have run this. A compromised service role was firing thousands of requests at Gemini endpoints, nothing in the cloud console raised it, and the burn had reached $5,000 an hour when a baseline flagged the deviation. Revoked two hours later. The security fixes prevented the next one; the baseline is what made this one survivable.
FAQ
How much can a compromised cloud credential cost?
Thousands of dollars per hour where the account permits GPU or large compute provisioning. The total depends almost entirely on how long it runs before detection, not on the hourly rate.
Why is a stolen AI API key valuable to attackers?
Model inference can be resold, so a key converts directly into revenue without the attacker needing anything from your business. This is why AI keys are now targeted as heavily as cloud credentials.
Will my provider refund fraudulent cloud usage?
Often at least partially for verified compromise, and the speed of your detection and revocation affects the outcome. Keep a documented timeline of the incident.
How do I detect credential abuse if security tools do not flag it?
Watch cost against a per-service baseline. The abuse is valid API usage, so it is invisible to access monitoring, but the volume deviation is large and immediate — typically flat spend that does not follow your normal daily traffic rhythm.
