In 2024, I wanted to show how most data breaches could be prevented by implementing a small set of security invariants. Security invariants are a well-known concept for eliminating attack surfaces and preventing security incidents. Companies like Google and Stripe rely heavily on them to protect their infrastructure. Unfortunately, most companies seem unaware of them and don’t know that there is a different way to secure their infrastructure. So, I wanted to prove the effectiveness of security invariants by analyzing publicly reported data breaches.
Back then, LLMs had just started to appear as very powerful tools, but competent coding harnesses did not exist yet. So, I decided to build a framework I called PlanAI that would allow me to assemble disparate public reporting on breaches into a cohesive technical analysis that could be used to determine whether any particular security invariant would have been effective in preventing the breach.
PlanAI assembles processing into a graph of workers that either run deterministic code, such as running a search query or retrieving a website, or process data with an LLM. Graphs can branch and have cycles, and more importantly, PlanAI natively supports multithreading and parallelism. This is how the first version of securityblueprints.io was created, and my analysis showed that over 65% of breaches in the sample could have been prevented by deploying just three security invariants.
Back then, I was primarily using OpenAI models, such as gpt-4o, gpt-4o-mini, and o1-mini, and a single breach report would cost less than ten cents. Since model capabilities have changed significantly since then, I wanted to see whether Claude Code with Fable 5.1 could help me refresh the framework and make it work with current models.
The first task I set for Fable 5.1 was to change the data flow. Previously, whole documents were carried across the graph and needed to be reviewed and rewritten in one go. Instead, I wanted to use a workspace where the models could read and edit files without having to read everything into context all the time. The new workflow used Haiku 4.5 for tasks that didn’t require reasoning and Sonnet 5 for anything that required more analysis.
Once the first version was running, I was dismayed to find that generating a single report from curated sources cost about $8 at published rates and took 35 minutes of wall-clock time. Fable 5.1’s original analysis put the cost at over $12 per report using Anthropic’s originally planned but now cancelled September price increase. After turning thinking off for the review workers and changing PlanAI so that notes could be cached as part of the system prompt, the estimated cost at published rates fell to $3.28 with 11 minutes of wall-clock time. However, this was still much too expensive for me. It turned out that with the Anthropic models, caching was more complicated, and the branching of the original graph was a big contributor to overall cost. Another round of refactoring turned the processing into a sequential flow of three conversations. The reconstructed cost at published rates was about $1.21, and the wall-clock time dropped to 10 minutes.
I had already suggested to Fable 5.1 that OpenAI’s models might be cheaper. Fable 5.1 was not aware of the OpenAI models and made several outdated assumptions about them. When I pushed it to use GPT-5.6 Luna instead, it suggested that it might be a replacement for Haiku 4.5, which is not what I meant. I wanted to use GPT-5.6 Luna as a replacement for Sonnet 5. Moving the report-writing workflow to Luna brought the estimated cost of a single data breach report down to about $0.11, including a conservative allowance for cache writes, with 7 minutes of wall-clock time.
The surprising finding for me was that one of the big cost contributors when using the Anthropic models was the cost of writing to the cache. At the published September 2026 prices, five-minute cache writes cost $2.50 per million tokens for Sonnet 5, versus $0.25 for GPT-5.6 Luna. Both charge 1.25 times their ordinary input rate for these writes. Cached reads were ten times cheaper with Luna: $0.20 for Sonnet 5 versus just $0.02 for GPT-5.6 Luna. See the Anthropic pricing and OpenAI prompt-caching documentation.
For writing data breach reports, GPT-5.6 Luna produced useful reports, with input and cached-input prices ten times lower than Sonnet 5 and output prices about eight times lower: $1.20 versus $10 per million tokens. I left invariant scoring on Sonnet because Luna struggled with parts of the scoring rubric.
In summary, I have a refreshed pipeline for creating data breach reports and analyzing how security invariants can help companies prevent breaches. I also learned that API costs really matter and that the token costs for the Anthropic models are surprisingly high. A lesson for Anthropic may be that they need to publish a new Haiku model that is on par with GPT-5.6 Luna for report writing. At current prices, Haiku 4.5 is still more expensive than Luna by roughly a factor of five per token. Choose your models carefully.