The security of software is increasingly determined by how much AI compute was spent trying to break it. Companies use diverse AI agents to autonomously attack their own code. The amount of money spent on APIs from labs like Anthropic to find vulnerabilities is becoming the best indicator of a system's robustness.

While many fear AI will enable a "cyber Pearl Harbor," the evolution of drone warfare serves as a cautionary tale. Initially seen as an offensive tool, drones became a defense-dominant technology. Similarly, advanced AI could be used to create powerful agentic defenses, neutralizing offensive cyber capabilities.

Investigating the OpenAI cyber incident required using powerful AI models that racked up a $400,000 API bill. This signals a future where effective cyber defense against sophisticated AI attacks may be financially inaccessible for smaller companies, local governments, and critical infrastructure operators.

Contrary to the focus on offensive AI, its greatest impact to date has been on defense. AI tools are being used to find and fix thousands of software vulnerabilities before release. They also enable network monitoring at a scale impossible for human teams, suggesting AI is currently a "defense dominant" technology.

The perception that AI currently favors hackers over defenders is causing CISOs to increase cybersecurity budgets by 20-30%. This spending surge is a short-term reaction to catch up with new threats. Success is measured not by preventing breaches, but by a massive increase in newly discovered vulnerabilities found by defensive AI tools.

Since regulating the global proliferation of open-source AI models is practically impossible, the offensive risks will inevitably rise. This creates a classic arms race, forcing companies and governments to massively scale their cyber defense budgets, using AI to fight AI.

Advanced AI models, like Anthropic's, that can identify deep cybersecurity risks and zero-day exploits transform the need for computing power from a commercial want to a national security imperative. This ensures that demand for compute will be funded regardless of economic conditions.

An AI model capable of executing complex cyberattacks is equally capable of identifying and fixing those same vulnerabilities. A government like China's will likely first deploy the model for defense—patching critical systems—before any public or commercial release, thus mitigating risk.

While AI gives attackers scale, defenders possess a fundamental advantage: direct access to internal systems like AWS logs and network traffic. A defending AI stack can work with ground-truth data, whereas an attacking AI must infer a system's state from external signals, giving the defender the upper hand.