Security professionals can discuss what cybercrime costs an enterprise at great length. But what does the actual cybercriminal make from the endeavor?

Palo Alto Networks and the Ponemon Institute recently set out to answer this question. They worked together on a new report called “Flipping the Economics of Attacks,” and there are some surprises in their findings.

About the Cybercrime Survey

To get the answers, the two groups surveyed 304 “threat experts” — also known as the bad guys — in the U.S., U.K. and Germany. Ponemon built this panel of experts based on their past participation in Ponemon Institute activities and IT security conferences.

Their first finding was that attackers are opportunistic and go after the easiest targets first. According to the report, 72 percent of respondents said that they won’t waste their time on targets that don’t have a quick and high payoff.

They are also put off by a good defense. Attackers will quit when the targeted company has a strong defense, according to 69 percent of study respondents.

Defense Does Work

One of the biggest takeaways was that time plays a strong role in how lucrative an attack is — or isn’t. “The longer an organization can keep the attacker from executing a successful attack, the stronger its ability to safeguard its sensitive and confidential information,” the report said.

“The inflection point for deterring the majority of attacks is less than two days (40 hours), resulting in more than 60 percent of all attackers moving on to another target.”

But it’s getting cheaper to attack. About 53 percent of respondents said the total cost of a successful cybercrime attack has decreased. This aligns with 53 percent of the respondents reporting that the time to plan and execute an attack has decreased.

That easy process may be due to a number of factors. According to the study, 67 percent of attackers agreed the number of known exploits and vulnerabilities increased, while 52 percent said attacker skills have improved and 46 percent believed hacking tools improved.

The study confirms that if enterprises can make it hard on an attacker, costing them time and effort, then they are more likely to prevent an attack from having a harmful effect. As previously noted, 40 hours of additional effort for attackers seems to be when 60 percent of them will call it quits.

The Real Profit

So why do they do it? Although 69 percent of respondents were motivated by money, the average attacker received $28,744 for about 705 hours spent on attacks annually. This is 38.8 percent less than the average hourly rate of IT security practitioners employed in the private and public sectors, and only 25 percent of their yearly wage, according to IT Business Edge. That is not the big money that legends are made of.

Cybercrime doesn’t pay. Even ignoring the legal consequences of the actions, the end results are small. It’s a mug’s game, for sure.