Security researchers judge risky releases by what they add beyond what attackers already have — does that work for defenders' tools?

This explores whether the 'marginal risk' idea, which judges a release by what it adds beyond what attackers already have, can be applied to what defenders publish (detection rules, incident reports, reproduction harnesses) and not just to open AI models. The corpus suggests it is the right question but not yet a usable measuring tool. It has no study that applies the framework to defensive releases directly.

The framework comes from the open-model debate. Instead of asking 'is this dangerous?', it asks 'is this more dangerous than what already exists?' Can we measure how much risk open models actually add? Its verdict is that for cyberattacks and bioweapons alike, current research can't measure that added effect. Defensive artifacts fit the same lens. Can defensive tools themselves become weapons for attackers? points out that detection rules and incident reports can tell attackers what to try. That moves the question from how capable something is to whether to publish, share, or keep back what defenders built. The baseline is what attackers could already work out. The framework names that comparison but doesn't supply a way to run it.

Three things make the measurement hard. First, the step where a capability becomes an attack is the least measured. Do cybersecurity benchmarks actually measure exploitation? finds that models do well at reproducing vulnerabilities and writing patches, yet exploitation is largely absent from benchmarks. Second, Does measuring exploit capability help or harm defense? argues that no single measurement separates the defensive benefit from the offensive uplift without knowing who has access and under what controls. So marginal risk belongs to an artifact together with its audience, not to the artifact alone. Third, the effects are hard to attribute. Do authorization rules or restricted tools prevent test modifications? shows that when an intervention bundles several changes, a good result can't say which part did the work. A release's protective value and its attacker uplift would need the same kind of separate testing. The clean design for this, Does added monitoring improve protection at acceptable cost?, compares monitoring setups at equal review cost, but it is only proposed and has no results.

There is one concrete case where a defensive tool gives measurable uplift. Can attackers evade skill scanners by refining individual skills? shows attackers using scanner feedback to refine each skill until it looks harmless, reaching 96% average attack success across six scanners. Scanners score skills one at a time, so their verdicts work as a signal the attacker can iterate against. Two related notes suggest a further blind spot, though the corpus doesn't test this for releases. Harm can hide in how steps combine Can task decomposition hide harmful intent across agents?, and defence works better when the unit is a coordinated set of actions, not one isolated action Should defence units span multiple executions and agents?. A marginal-risk check that scores one artifact at a time could understate what several released together would enable.

So marginal-risk frameworks can frame the question, and they do so better than absolute danger ratings. Measuring the answer for defensive releases depends on data the corpus says is missing: exploitation benchmarks, access-aware evaluation, and single-factor comparisons.