1. A computer-implemented method for determining whether a software application is malicious, comprising: using a computer processor to perform steps comprising: identifying, by a security module executing on a computer system, a software application resident on the computer system; determining, by the security module executing on the computer system, cost characteristics for the software application, the cost characteristics reflecting financial costs incurred in developing the software application; determining, by the security module executing on the computer system, whether the software application is malicious based at least in part on the cost characteristics; and reporting, by the security module executing on the computer system, the software application as malicious responsive to the software application being determined malicious.