With frontier models costing over 100x more than competent alternatives ($56 vs. 50¢ per million tokens), companies are burning cash. An estimated 98% of tasks sent to top-tier models don't require that power, an inefficiency driven by engineers who are disconnected from cost implications.

For monitoring tasks like detecting cybercrime intent, simple linear probes are surprisingly effective. They piggyback on the sophisticated processing the main model has already done, essentially just reading its conclusion. This makes them competitive with vastly larger and more computationally expensive models used for the same purpose.

For most enterprise tasks, massive frontier models are overkill—a "bazooka to kill a fly." Smaller, domain-specific models are often more accurate for targeted use cases, significantly cheaper to run, and more secure. They focus on being the "best-in-class employee" for a specific task, not a generalist.

The economics of AI security requires a tiered approach. The optimal strategy involves using low-cost, domain-adapted open models ("drones") for constant monitoring across the entire environment, while reserving expensive frontier models ("battleships") for selectively hunting novel threats, balancing cost and coverage.

A powerful AI workflow involves using cheap, 24/7 local models for high-volume, initial-pass tasks like finding potential security issues. These 'qualified leads' are then batched and sent to a powerful frontier model like Claude for the final, high-quality analysis.

As AI token consumption becomes a major budget item, companies are moving beyond using a single frontier model. Every organization will need a portfolio of models, including cheaper options for less complex tasks, to manage the "madness" of runaway costs.

As enterprises scale AI, the high inference costs of frontier models become prohibitive. The strategic trend is to use large models for novel tasks, then shift 90% of recurring, common workloads to specialized, cost-effective Small Language Models (SLMs). This architectural shift dramatically improves both speed and cost.

Palo Alto Networks' CEO argues that general-purpose AI excels at "90% problems," where 'good enough' is acceptable. Cybersecurity is a "1% problem," requiring extreme precision to stop the one critical breach. This reliance on domain-specific data and intolerance for error makes it less susceptible to disruption from LLMs that can hallucinate.

Instead of costly, constant monitoring by a large AI, an effective security model uses small, specialized 'intuition' models. These models' sole job is to flag suspicious actions for review by a more powerful AI, optimizing for cost, latency, and performance.