• Ensign’s Jeremy Moke says low-cost models can widen the pool of people who can attempt AI cyberattacks 
• He also agrees the firm’s 40% EDR-bypass figure, from models tested without attack frameworks, is a baseline rather than a ceiling

China’s DeepSeek V4 Pro was the cheapest of the ten models Ensign InfoSecurity put through simulated AI cyberattacks, and it delivered the most success for the money, at less than a twentieth of the price of OpenAI’s GPT-5.6 Sol.

The results come from the AI Cyber Range Assessment in Ensign’s 2026 Cyber Threat Landscape Report. The firm took the ten top scorers from more than 150 models. It ran each 16 times against a simulated university network protected by endpoint detection and response (EDR), giving every model the same instructions and the same eight attack goals.

One of Ensign’s key findings was that Z.AI’s GLM-5.2 matched GPT-5.6 Sol and Anthropic’s Claude Opus 4.8, with all three achieving High Success, at least eight successful runs out of 16, on seven of the eight objectives.

Ensign compared costs using each model’s price per 100 million tokens, the chunks of text a model reads and writes. GLM-5.2 was priced at US$ 230 against US$ 1,250 for GPT-5.6 Sol, and delivered more than five times the results per dollar spent.

DeepSeek V4 Pro, at US$57, recorded High Success on only four objectives and Partial Success on the other four. Its low price still gave it the highest score on Ensign’s measure of success per US$1,000 spent, at 1,097, roughly 15 times GPT-5.6 Sol’s 75

Cheaper models change who can attempt AI cyberattacks

Jeremy Moke, Senior Director, International Business & Commercial at Ensign InfoSecurity Malaysia, sees the two models as different kinds of risk.

“A frontier-matching model like GLM-5.2 raises the ceiling of what a capable adversary can do, while a lower-cost, ‘good enough’ model like DeepSeek V4 Pro lowers the floor of who can attempt an attack,” he said in an email interview with Tech Wire Asia.

Across the ten models, breaching the network’s learning portal had 100% mean reliability and compromising the database had 90%, the two highest results in the test.

“A model does not need to match the strongest model across every objective to be useful to an attacker,” Moke said. “If a lower-cost model can perform these parts of an attack reliably and repeatedly, it can make offensive capability accessible to a wider pool of threat actors.”

How Ensign measured cost

The cost comparison is based on each model’s price per 100 million tokens. Asked whether Ensign also counted the tokens each model used in a run, Moke said the report compares price per 100 million tokens with success per US$1,000. He didn’t say whether actual usage was factored in, and Ensign didn’t provide per-run usage or cost figures.

That matters because a model that needs more attempts to complete a task would cost more in practice than its price suggests.

Tested without attack frameworks

Bypassing EDR while the attack was running was the hardest objective in the test, at 40% mean reliability. No model achieved High Success there, and only six managed Partial Success.

The models were tested without harnesses, the agent frameworks that add retry logic and other support around a model, which real attackers can use.

“The 40% EDR-bypass reliability should be read as a conservative baseline rather than a ceiling,” Moke said. “In a real attack, an adversary could wrap the models with harnesses, potentially making certain capabilities more repeatable.”

East versus West

Ensign’s report frames its findings around five Western and five Eastern models, but its own pricing data cuts across that line. Meta’s Muse Spark, at US$215 per 100 million tokens, was cheaper than GLM-5.2, while Moonshot AI’s Kimi K3 was among the most expensive at US$660.

“The ‘East-versus-West’ framing is a simplified way to broadly compare the models in this assessment, but geography is only one part of the picture,” Moke said, adding that the numbers suggest cost and accessibility are becoming just as important as where a model was developed.

The report notes that Hugging Face used the open-weight GLM-5.2 to investigate an attack on its systems because closed models’ safeguards blocked the work. Moke said defensive tasks can look like malicious ones to a model, and that Ensign uses both open and closed models.

Malaysia and regulation

Moke was cautious about linking real incidents in Malaysia to AI. Stolen credentials, vulnerability exploitation, reconnaissance and lateral movement all predate the technology, he said.

“We need to be careful with attributing a specific cyber incident to AI,” he said. “What AI changes is the speed, scale and cost of carrying out some of these activities.”

Asked whether testing under Malaysia’s Cybersecurity Act 2024 and Bank Negara Malaysia’s expectations keeps pace with models that Ensign says advance on a roughly two-month cycle, he did not point to specific gaps. Regulatory requirements provide a baseline, he said, but compliance cycles should not be the only time organisations test their defences. Testing should be repeated when an organisation’s systems or the threat environment change materially, he added.

The vendor question

Ensign sells detection and response services, and the report’s first recommendation is to pair autonomous detection with deterministic controls. Moke argued the findings do not simply favour his company, because the controls that come out strongest in the report, such as identity protection and network segmentation, are ones organisations build rather than buy from Ensign.

“Positioning has a tell: every finding converges on the thing being sold. Ours doesn’t,” he said.

His advice to boards is to look past whether attackers can be kept out. The better question, he said, is “show me how quickly we would know if an attacker got in, and how far they would get.”

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.