Cybersecurity’s Expanding Role in the AI Economy: Opportunities Across a Growing Security Stack
Head of Global Technology
Key Takeaways
AI is intensifying the cyber arms race, increasing the speed and scale of attacks while raising the value of more sophisticated defense.
Advances in AI are expanding what enterprises need to secure, as new applications, data, identities, and autonomous workflows broaden the attack surface.
Cybersecurity is becoming critical AI infrastructure, widening the opportunity across the technologies needed to securely scale AI adoption.
As AI turns cybersecurity into critical infrastructure, the investment case is expanding alongside the role cybersecurity plays in the digital economy.
For decades, cybersecurity has been a game of cat and mouse. Attackers discover vulnerabilities, defenders patch them, and the cycle repeats. The technology has grown increasingly sophisticated, but the fundamental dynamic has remained largely unchanged: specialized human expertise on one side competing against specialized human expertise on the other.
Artificial intelligence is beginning to change that equation.
The emergence of increasingly capable AI models suggests cybersecurity may be reaching its own “ChatGPT moment,” an inflection point at which AI substantially changes the economics, speed, and scale of both cyber offense and defense.
Anthropic’s Claude Mythos preview provided an example. Announced in April 2026, Mythos demonstrated advanced cybersecurity capabilities, including identifying and exploiting software vulnerabilities at a level Anthropic described as exceeding all but the most skilled human practitioners. Through Project Glasswing, selected organizations gained controlled access to use the technology to identify vulnerabilities in critical software.1
The significance is less about any one model and more about what it demonstrates: cybersecurity tasks that historically required highly trained specialists are increasingly becoming automated, scalable, and potentially available at machine speed.
The Mythos momentAnthropic reported that approximately 50 initial partners in Project Glasswing identified more than 10,000 high- or critical-severity vulnerabilities, prompting the company to expand the initiative to roughly 150 additional organizations across more than 15 countries.2 This doesn’t mean there are 10,000 new immediately exploitable vulnerabilities. Severity classifications require validation and context. The more important takeaway is the dramatic increase in the speed and scale of vulnerability discovery. As AI becomes more capable and agentic—able to plan, use tools, analyze code, and take action—the time between vulnerability discovery and attempted exploitation could compress significantly. The industry is moving toward a world in which machines increasingly attack machines, while humans increasingly oversee AI systems defending them. |
AI creates a two-sided cyber arms race
AI does not simply make cyberattacks more sophisticated. It also makes cybersecurity more critical.
On the offensive side, AI can accelerate reconnaissance, vulnerability discovery, social engineering, and other technical tasks. On the defensive side, it can analyze enormous quantities of telemetry, identify anomalies, prioritize vulnerabilities, investigate alerts, and automate elements of incident response.
The World Economic Forum’s 2026 research underscores this convergence: 94% of cyber leaders surveyed identified AI as the defining force in cybersecurity, 77% of organizations were already using AI in cyber operations, and 87% viewed AI-related vulnerabilities as the fastest-growing cyber risk.3
AI is therefore becoming more than another feature in cybersecurity software. It is, increasingly, a catalyst for security spending across the technology stack.
The attack surface is expanding
The security challenge grows further as enterprises become more autonomous.
Cloud computing, SaaS, APIs, connected devices, and distributed workforces have steadily expanded the number of systems organizations must protect. AI adds another layer: autonomous software.
As enterprises deploy AI agents capable of acting on behalf of employees and organizations, the number of digital entities requiring security controls could increase substantially. These agents need identities, credentials, permissions, access controls, monitoring, and governance as they interact with applications, APIs, databases, and cloud infrastructure.
This creates two reinforcing drivers for cybersecurity:
The defenders’ window
Importantly, the AI arms race is not inherently one-sided. The same capabilities used to discover vulnerabilities can help defenders find and remediate them before adversaries exploit them. That is the premise behind Project Glasswing.
This creates a potential “defenders’ window” in which AI dramatically increases the productivity of security teams. An analyst can investigate only a finite number of alerts or vulnerabilities, while an AI system can continuously analyze code, correlate telemetry, identify patterns, and prioritize risks across enormous environments.
That shift could favor security platforms with broad visibility and the ability to automate workflows across multiple layers of the enterprise.
Why this matters for cybersecurity stocks
This is where the technology story becomes an investment story.
Cybersecurity has historically benefited from the increasing digitalization of the economy. AI could accelerate that structural trend by simultaneously increasing the value of what needs to be protected, the number of things requiring protection, and the sophistication of the threats targeting them.
Gartner forecasts that worldwide information security spending will reach approximately $244 billion in 2026, representing 11.6% constant-currency growth, as organizations increase spending to address threats, improve resilience, and secure AI adoption.4
11.6% Global information security spending growth in 2026
The implications span multiple layers of the security stack:
- Identity and access: Securing human and machine identities, privileged access, and AI agents
- Cloud and application security: Protecting increasingly complex AI-enabled workloads
- Data security: Securing sensitive information used by AI systems
- Network and zero trust: Protecting interactions between users, applications, agents, and infrastructure
- Security operations: Enabling AI-led detection, investigation, and response
- Vulnerability management: Identifying and prioritizing vulnerabilities at machine speed
- AI security: Protecting models, agents, applications, prompts, and associated data
The AI opportunity extends across cybersecurity, not just a single category. As AI reshapes both the threats organizations face and the assets they must protect, demand could broaden across multiple layers of the security stack.
From cybersecurity software to digital infrastructure
The broader investment thesis is shifting. As AI becomes more deeply embedded across the digital economy, cybersecurity is becoming less of a standalone software category and more of a critical layer of digital infrastructure.
AI accelerates both sides of this equation: it enables enterprises to become more productive and autonomous, while creating new security requirements and making attackers faster and more sophisticated.
This creates a potentially powerful feedback loop:
The investment implication
The “Mythos moment” may ultimately matter less for any single AI model than for what it reveals about the changing economics of cybersecurity.
Vulnerability discovery is becoming increasingly automated, attack timelines could compress dramatically, and autonomous software is creating entirely new security requirements.
Together, these forces create a powerful structural relationship: more AI creates more reasons to invest in cybersecurity, while more capable cybersecurity platforms enable organizations to deploy AI with greater confidence.
For investors, the question is evolving from:
“How much will companies spend protecting themselves from cyberattacks?”
to:
“What security infrastructure will an increasingly autonomous digital economy require?”
The answer could span identity, data, cloud, applications, endpoints, networks, security operations, vulnerability management, and entirely new categories designed to secure AI models and agents.
AI creates a new structural tailwind for cybersecurityIf ChatGPT was the moment when generative AI became visible to the mainstream, Mythos may prove to be a similar signaling event for cybersecurity, demonstrating that AI can perform sophisticated security tasks at a scale and speed that challenge traditional, human-centric security models. For cybersecurity companies, the same technology accelerating the threat landscape may also represent one of the most significant secular growth opportunities of the next decade. Cybersecurity stocks offer a broad and growing opportunity set, supported by resilient enterprise demand, healthy recurring revenues, and continued investment across multiple segments of the market. AI is increasingly emerging as a net positive for the sector, creating new demand as enterprises secure AI applications, infrastructure, and agentic workflows. Cybersecurity vendors are also leveraging AI to enhance detection, automate operations, and broaden platform capabilities. With cybersecurity still in the early-to-middle stages of a multi-year investment cycle, we believe the sector offers significant medium- term growth potential. Digital transformation, platform consolidation, rising regulatory and geopolitical risks, and AI adoption continue to expand the role of security within enterprise technology spending. |
A note about risk
The principal risks are generally those attributable to investing in stocks and related derivative instruments. Holdings are subject to market, issuer, and other risks, and their values may fluctuate. Market risk is the risk that securities or other instruments may decline in value due to factors affecting the securities markets or particular industries. Issuer risk is the risk that the value of a security or instrument may decline for reasons specific to the issuer, such as changes in its financial condition. Smaller companies may be more susceptible to price swings than larger companies, as they typically have fewer resources and more limited products, and many are dependent on a few key managers.
Artificial intelligence (AI) may pose inherent risks, including but not limited to: issues with data privacy, intellectual property, consumer protection, and anti-discrimination laws; ethics and transparency concerns; information security issues; the potential for unfair bias and discrimination; quality and accuracy of inputs and outputs; technical failures; and potential misuse. Users of AI-based technology and tools should take these risks into consideration prior to use of the technology.