A company's public web application runs on autoscaling compute billed by usage. A botnet floods it with requests that look legitimate; the service stays online because it scales out, but the monthly bill rises to several times the budget. Which threat does this describe, and what control helps most?

Economic denial of sustainability, sometimes called economic denial of service, targets the cloud's pay-per-use model. Elasticity absorbs a flood of plausible requests, so availability survives, but every scaled-out instance and unit of bandwidth is billed, driving costs high enough to make the service financially unsustainable. Effective controls combine maximum scaling limits sized to legitimate peak demand, budget thresholds and anomaly alerts on spend, and upstream filtering through DDoS protection, web application firewall bot management and rate limiting so malicious traffic is dropped before it triggers scaling. Treating it as a classic denial of service and removing autoscaling would convert a cost problem into an outage, giving the attacker a traditional DoS success instead. The provider is not exhausted; pooled capacity is working as designed, and asking for more physical capacity would only let the bill grow further. Account hijacking involves misuse of stolen credentials, but here the charges stem from inbound traffic triggering legitimate scaling, not from anyone provisioning resources through the management plane. Exam caveat: elasticity is a benefit and an attack surface, so cost should be monitored as a security signal. Operational check: confirm budget alerts and maximum instance counts are configured and that a synthetic traffic surge triggers both before spending exceeds the limit.