The best investment returns in cybersecurity will come from startups tackling security for emerging technologies. New attack surfaces, such as those from Agentic AI, represent a 'blue sky problem' where a startup can build a category-defining company without facing incumbents.

Investors are bidding up AI-enabling stocks like NVIDIA while selling off cybersecurity firms. The market falsely believes that agentic AI will fully automate security, making these companies obsolete. This ignores the massive demand for trusted human validation and specialized solutions needed to counter AI-driven threats.

Just as new platforms like operating systems and cloud computing spurred independent security companies, AI is creating a need for third-party safety providers. Even with strong in-house efforts at major labs, there is a distinct market demand for specialized, external security services like those from Gray Swan.

The market panic selling cybersecurity stocks post-Anthropic's leak is illogical. The coming "agentic era"—with AI rapidly building and deploying code—will create an explosion of new security threats. This represents a golden age for cybersecurity companies, not a threat to their existence.

Contrary to fears that AI would replace security firms, the consensus has shifted. Analysts now believe AI massively increases the surface area for vulnerabilities, compounding the need for security. This creates a multi-billion dollar opportunity for firms protecting new AI-driven attack vectors, making cyber a resilient software sector.

The long-term trajectory for AI in cybersecurity might heavily favor defenders. If AI-powered vulnerability scanners become powerful enough to be integrated into coding environments, they could prevent insecure code from ever being deployed, creating a "defense-dominant" world.

Generative AI's positive impact on cybersecurity spending stems from three distinct drivers: it massively expands the digital "surface area" needing protection (more code, more agents), it elevates the threat environment by empowering adversaries, and it introduces new data governance and regulatory challenges.

Security's focus shifted from physical (bodyguards) to digital (cybersecurity) with the internet. As AI agents become primary economic actors, security must undergo a similar fundamental reinvention. The core business value may be the same (like Blockbuster vs. Netflix), but the security architecture must be rebuilt from first principles.

While AI will increase cyber risk by enabling faster vulnerability scanning and generating potentially insecure code, it will also be the solution. AI agents will be needed to review code and defend systems, creating a massive new market for "agentic security" companies.