Autoscaler exposure is a concept, a risk surface a thorough DDoS test is built to characterize. It describes what happens when an application-layer flood is absorbed not by failing but by scaling: the autoscaler reads high request volume as legitimate demand and provisions more instances, containers, or serverless invocations. The service stays up, but the attack converts directly into a cloud bill. This failure mode is sometimes called economic denial of sustainability.
Why it matters in DDoS testing
Availability is not the only thing a DDoS attack can break; cost elasticity is an attack surface too. A flood of valid-looking HTTP requests can trigger uncontrolled horizontal scaling, ECS task sprawl, or Lambda concurrency spikes long before any tier saturates. A test measures the scaling response under attack and validates the guardrails (max-instance caps, budget alarms, request authentication ahead of the scaling boundary) before the flood does.
How to run this kind of test without an unbounded bill is covered in running a DDoS test without disrupting production.