Attack Costs $5 a Month. How Much Does It Cost to Protect Your Company?

Fireworks AI was hacked twice in a few months. A supermarket’s refrigerator was taken over. An innocent person was arrested due to facial recognition errors.

The common thread in these news stories is one thing: the cost of attacks is frighteningly low.

Hacking tools have become subscription-based, with services available for unlimited use at just $5 a month. Attackers can now launch cyberattacks with a “Netflix-like” ease. On the other hand, what about those trying to defend? Hiring a security expert can cost several million yen annually, and implementing solutions from major vendors can run into hundreds of thousands of yen monthly.

The asymmetry between attack costs and defense costs—this is the essence of cybersecurity in 2026.

But let’s get to the conclusion: Even small businesses can establish a minimum defense line for just $125 a month (approximately 19,000 yen). In this article, we will organize what has been happening based on recent incidents and delve into “So, what should we do?”.

—

The Reality of “API Key Management” Highlighted by the Fireworks AI Incident

The data breach at Fireworks AI symbolized the fragility of security systems in AI startups. Attackers accessed chat transcripts related to Notion’s customers, obtaining information unlawfully. Moreover, this was the second breach in just a few months.

The key point is that the method of attack was not particularly sophisticated. They merely exploited existing vulnerabilities. Poor API key management, lax access permissions, and lack of log monitoring—these are all issues that could have been prevented with proper measures.

This is not a distant issue for small businesses; it is rather a direct hit.

Many small businesses are now starting to integrate AI APIs like ChatGPT and Claude into their operations. Where are those API keys stored? Are they pasted in Slack? Are they uploaded to public repositories on GitHub?

The Fireworks AI incident has raised the new defensive area of “security for AI-utilizing companies.” If just one API key is leaked, customer data, internal chats, and business processes can be compromised in a chain reaction. The investment for attackers is nearly zero, while the returns are enormous.

—

Refrigerators Being Hacked—The Bomb of IoT “Neglected Devices”

The incident where a supermarket’s commercial refrigerator was hacked may seem like it doesn’t concern you. But take a look at the structure.

The problem with IoT devices is simple: Once sold, there are no updates, and the passwords remain at their default settings. Security researchers refer to these as “internet trash.”

Look around your small business office. Network cameras, multifunction printers, smart locks, Wi-Fi routers. When was the last time you updated their firmware? Are the admin passwords still set to “admin”?

Attackers can scan exposed devices on the internet using search engines like Shodan. Devices left with default passwords are literally “unlocked front doors.” They can use these to gain access to your internal network.

It’s not the refrigerator that’s the problem. The issue lies with the “devices that are connected and forgotten.”

The solution is straightforward. First, take inventory of what is connected to your internal network. Disconnect any devices that are not in use. For those that remain, change the passwords and update the firmware. This alone can significantly reduce risks, and it costs nothing.

—

Misidentification Arrests Due to Facial Recognition—How “Cheap Technology” Distorts Society

The number of misidentification arrests due to facial recognition technology is on the rise. There have been reports of police treating facial recognition match results as “evidence” and detaining innocent individuals. Multiple studies have pointed out that the misidentification rate is particularly high for people of color, highlighting a serious issue where technological bias exacerbates social injustice.

How does this connect to cybersecurity? The structure is that “cheap technology is more likely to be used without verification.”

Facial recognition APIs can be used for just a few dollars a month. Because the implementation cost is low, they are deployed in the field without verifying accuracy or establishing operational rules. As a result, misidentification arrests occur.

This is also relevant for small businesses introducing AI into their operations. The reduced cost of AI tools has made it easier to think, “Let’s just try it out.” While this is a positive development, if you use outputs for business decisions without a verification process, incidents similar to misidentification arrests in facial recognition can occur. Incorrect customer billing, erroneous credit assessments, biased hiring screenings—while the scale may be small, the impact on reputation can be fatal for small businesses.

—

Defenders Also Have Weapons—Defense Tools for 2026

Just as the cost of attacks has decreased, the cost of defense has also dropped. This is crucial.

1. AWS Local Emulator (Free)

AWS has released emulators for over 200 services. This allows for security testing without touching the production environment. You can preemptively address configuration errors that lead to public S3 bucket incidents (one of the most common cloud mishaps among small businesses). The cost is zero.

2. Privacy Proxy for LLM Prompts (Free to a Few Dollars a Month)

Proxy tools that automatically mask personal and confidential information from prompts sent to AI APIs are emerging. This can prevent employees from inadvertently leaking customer names or contract amounts to ChatGPT—this “accidental leakage” can be structurally prevented.

3. Password Manager (Approximately $40 per Year per Person)

Centralizes password management for all employees and eliminates reuse. With 1Password, it costs about $3 per person per month. For a company of 10 people, that’s $360 annually. It can also be used for managing API keys.

4. Security Awareness Training (Approximately $500 to $1,000 per Year)

Training that includes simulations of phishing emails. Services like KnowBe4 offer plans for small businesses. Since “people” are the biggest vulnerability, the return on investment in this area is the highest.

—

The “Minimum Defense Line” for Small Businesses—Breakdown of $1,500 Annually

Assuming a small business with 10 to 50 employees, here’s a breakdown:

When converted to a monthly basis, that’s about $85 to $125 (approximately 13,000 to 19,000 yen).

In an era where attackers can strike for $5 a month, establishing a minimum defense line for $125 a month is essential. While this asymmetry cannot be completely resolved, by transforming from an “unlocked house” to a “locked house,” most attackers will simply move on to the next house. Most cyberattacks are indiscriminate scans. Targeted attacks are aimed at large corporations. What small businesses need to protect against is “not getting caught in indiscriminate attacks.”

—

Three Things to Do Today

Long-term plans can wait. Here are three things you can do today.

1. Inventory API Keys
Check where the API keys for AI services used in-house are stored. If they are pasted in Slack or spreadsheets, move them to a password manager immediately.

2. Create a List of Devices on the Internal Network
Routers, cameras, multifunction printers, IoT devices. List everything that is connected and disconnect any unnecessary devices. Change the passwords for those that remain.

3. Share How to Identify Phishing Emails with All Employees
A 15-minute meeting will suffice. “Check the sender’s address,” “Hover to verify before clicking URLs,” “Be suspicious of urgent emails.” Just these three points can prevent most damages.

All of these have zero cost. They can be done today.

—

Don’t Misinterpret the Structure

The cost of attacks has dropped to $5 a month. This is unstoppable. The democratization of technology also means the democratization of attacks.

However, at the same time, defense tools are being democratized. Free emulators, proxy tools for a few dollars, password managers for $3 a month. We have entered an era where defense measures that were once only accessible to large corporations are now available to small businesses.

The issue is simply whether you “know” and whether you “act.”

$125 a month is less than the labor cost for one hour of work for one employee. With that, you can become a company that “does not get caught in indiscriminate attacks.” There’s no reason not to do it.

Attackers are looking for unlocked doors. First, let’s lock them.