I keep talking about the black hats using the leverage of the Internet. Dan Geer summarizes the situation:

The thing to remember is that the attacker’s workfactor is the cost of a new variant, and as the production of variants (whether of malware or URLs) is now automated, the arms race between attacker and defender can be manipulated by the attacker to bankrupt the defender.

— A Quant Looks at the Future Extrapolation via Trend Analysis, by Dan Geer, v6xi07, accessed 13 Nov 2007 “Rescaled, cumulative,” page 22,

He’s got lots of data from various viewpoints to back up that assertion.

-jsq