Tokenmaxxing is out. How to minimize AI spend without sacrificing security capability.

Security teams are learning the expensive lesson after the invoice lands: the strongest AI models are often too costly for routine, high-volume work. One security operations lead says his team has pushed detection costs down to roughly $1 per day for trust and safety. The trick isn’t magic. It’s refusing to send every case straight into a model and designing the workflow so only the right cases make it that far.

This is really old-school security engineering wearing an AI badge. Before LLMs, teams already used layers of filters to shrink huge event streams into a manageable set for human review. The same idea now controls spend. Rules-based checks on things like account age, email provider, and behavior can clear out a large share of obvious abuse before any model runs. Only what survives that first pass gets to the expensive part.

And the expensive part should still be tiered. In the setup described here, a lightweight model makes the first call and returns a structured result: malicious or benign, with high or low confidence. High-confidence cases are handled automatically. Low-confidence ones move up to a stronger model with more context and better reasoning. In testing across the models used for these workflows, the difference in accuracy was only 1 to 2 percent, while frontier models cost about five times more per token. That gap matters only if the high-end model is reserved for cases that actually need it.

Prompting is part of the budget too. One agentic detection prompt mentioned here runs to more than 1,900 words because it has to cover many scenarios, including when the system should escalate and when it should act on its own. Other trust and safety prompts can be just two or three sentences. The point isn’t verbosity for its own sake; it’s matching the prompt to the job so the model doesn’t waste cycles guessing what to do.

The other key ingredient is context. An abuse report alone can mislead a model, but the underlying artifact plus the report gives it something real to inspect. That matters because the hardest cases are the ones automation still can’t settle cleanly: the researcher hosting malware samples for analysis, the bad actor hiding behind the same setup, the dispute where policy and context blur together. Those should go to humans. Everything else should be designed to stay cheap.