The security of software is increasingly determined by how much AI compute was spent trying to break it. Companies use diverse AI agents to autonomously attack their own code. The amount of money spent on APIs from labs like Anthropic to find vulnerabilities is becoming the best indicator of a system's robustness.

AI models are highly effective at finding security flaws faster than humans. While their defensive capabilities (e.g., auto-patching) are unreliable due to false positives, their offensive power creates urgency for enterprises to fix vulnerabilities, ultimately strengthening the cybersecurity ecosystem.

Contrary to the focus on offensive AI, its greatest impact to date has been on defense. AI tools are being used to find and fix thousands of software vulnerabilities before release. They also enable network monitoring at a scale impossible for human teams, suggesting AI is currently a "defense dominant" technology.

AI enables attackers to launch scalable, rapid attacks, overwhelming defenders who are left to manually monitor, validate, and patch vulnerabilities. This dramatically shifts the balance of power, creating a significant strategic disadvantage for cybersecurity teams in a way not seen before.

Historically, many organizations only implement robust cybersecurity after being attacked, despite knowing the risks. AI-powered offense dramatically raises the stakes by increasing the speed and scale of threats, making this reactive posture untenable and potentially catastrophic.

Contrary to fears that AI would replace security firms, the consensus has shifted. Analysts now believe AI massively increases the surface area for vulnerabilities, compounding the need for security. This creates a multi-billion dollar opportunity for firms protecting new AI-driven attack vectors, making cyber a resilient software sector.

Experienced CISOs are less concerned about AI models 'going wild' and becoming malicious hackers. The more practical and immediate problem is that AI will dramatically increase the volume of vulnerabilities discovered in codebases. Security teams will be overwhelmed not by sophisticated AI attacks, but by the sheer quantity of legitimate issues to triage and fix.

The long-term trajectory for AI in cybersecurity might heavily favor defenders. If AI-powered vulnerability scanners become powerful enough to be integrated into coding environments, they could prevent insecure code from ever being deployed, creating a "defense-dominant" world.

Generative AI's positive impact on cybersecurity spending stems from three distinct drivers: it massively expands the digital "surface area" needing protection (more code, more agents), it elevates the threat environment by empowering adversaries, and it introduces new data governance and regulatory challenges.