The paper proposes a cost‑aware evaluation framework for security agents that jointly measures success rate and resource consumption, such as reasoning steps and tool calls, on offensive Cybench tasks and defensive Splunk BOTS v1 challenges. This approach reveals the true operational cost of achieving security objectives beyond peak vulnerability discovery.