Cost Amplification Attack

When an attacker sends only a few requests per minute, never approaching rate limits; due to unmitigated control gaps, each request consumes extremely high resources, and the organization notices the anomaly only from the month-end billing statement, triggering compliance exposure and operational reputational costs.