I think cost of outcome matters, not cost alone. $100k is a lot for a bottle of milk, but not that lot for a house.

agreed, but if provides at least some actionable remediation to even a 1/10th of the vulns it 'discovers' it still worth the cost once dust settle a $/critical cve patched price will be distilled from redteam work, I think it is money well spent... albeit a bit rushed considering the epic fail of c...