AI Security

AI is doing two things to cybersecurity at once, and they carry very different economics. It is re-pricing the existing security market — changing how security products and services are built, delivered, and priced (the supply side), while making attackers cheaper and more capable and thereby expanding the demand for defense (the demand side) — and it is creating an entirely new category: the securing of AI systems themselves. Understanding the business of cybersecurity in the AI era means keeping these apart, because value is forming in some and being competed away in others.

Related: Security for AI (the new attack surface) · The Agentic SOC (AI for defense).

How AI intersects cybersecurity

A new category — security for AI. Models, agents, training data, and the pipelines that build them form a net-new attack surface that existing defenses were not designed for. Securing them — against prompt injection, data poisoning, model theft, and over-privileged agents — is the youngest and fastest-growing pool in the sector, and the subject of an active platform land-grab (detailed in section 1 below).

The supply side — AI for security. AI is changing how security itself is built and delivered, in two ways worth holding apart because their economics differ:

• AI makes products better. AI raises the ceiling on security software through agentic features, copilots, and greater autonomy in the platform. For vendors this cuts both ways: better products, but also capabilities that were once a standalone product becoming a feature inside a larger platform.
• AI makes services better — and software eats services. AI improves how managed detection, consulting, incident response, and testing are delivered, but in doing so it converts variable human labor into fixed software cost. Software steadily encroaches on work once sold by the hour, prices compress, and services firms must move toward software-like economics — recurring, automated, higher-margin — or risk being rolled up. This is the services re-rating; see Software Eats Services.

The demand side — AI-driven offense. AI also makes attackers cheaper and more capable — AI-written phishing and malware, AI-discovered vulnerabilities, and now autonomous agents that can run a full intrusion. A cheaper, broader threat surface raises what organizations must spend on defense. Because AI is reshaping the supply of security and the demand for it at the same time, its overall effect on the industry is expansionary even as it disrupts individual categories. See AI for Offense and Threat Economy.

Beyond these, AI is also starting to reshape the business of cybersecurity itself — how companies are sourced and evaluated for acquisition, and how frontier models are treated as strategic, export-controlled assets (covered in the sections below and in The AI Deal Machine).

Market re-pricing (Wall Street research)

A mid-2026 Wall Street sector note describes AI as "the most consequential inflection in cybersecurity since the cloud" and quantifies the re-pricing across all four branches. Its central finding is that cyber's growth is not a rising tide: budgets are being reallocated away from legacy tools toward AI-enhanced categories rather than simply added on top.

The non-AI segment shrinking at ~−7% CAGR while AI-enhanced compounds ~60% captures the thesis in two numbers: AI is not adding a new line item so much as transferring spend from legacy point tools and human-delivered work to AI-native, platform-integrated architectures. The note's bull case is that an expanding attack surface, AI-armed adversaries, and accelerating enterprise AI adoption make AI a secular demand catalyst — the demand side (branch C) — that more than offsets the frontier-model risk to individual categories. The identified winners are platform vendors with autonomous capabilities, broad data access, and integrated architectures; endpoint becomes "the epicenter of AI usage" (greenfield sensor demand), and non-human-identity governance scales with agents.

(Source: mid-2026 Wall Street cybersecurity sector research, citing Gartner market estimates. The seat-based → consumption/outcome pricing shift this note documents is treated under branch B — see Software Eats Services.)

1) Security for AI — the new attack surface

Existing defenses (firewalls, EDR, human-built IAM) were not designed for models, prompts, or autonomous agents. The OWASP LLM Top 10 defines the new vulnerability classes:

Prompt injection has reached commodity crime (Jul 2026). Zscaler documented two in-the-wild campaigns using indirect prompt injection in web content to exploit autonomous AI agents browsing the web: SEO-poisoned fake Python-library pages hiding payment instructions in schema markup and hidden HTML (steering agents into cryptocurrency transfers to hardcoded wallets), and a typosquat of the DeFi dashboard DeBank whose hidden prompts instruct agents to treat the impostor as the legitimate domain. In Zscaler's test harness, 4 of 26 evaluated LLMs were manipulated into making a payment (SecurityWeek, Jul 6 2026 · Zscaler). The significance is the attacker profile: these are criminal monetization campaigns, not researcher proofs-of-concept — as agents become a browsing and purchasing interface, ordinary web content becomes an attack surface, a direct demand driver for runtime guardrails and agent-action controls.

Agentic browsers extend the attack surface to co-resident software (2026). As AI vendors ship browser-based agents that can read and act across a user's web sessions, the agent itself becomes an over-privileged endpoint reachable by other software installed in the same browser. Research by Manifold Security found that Anthropic's Claude for Chrome extension activated its built-in tasks without verifying that the triggering click came from a real user, so a separate malicious extension could forge the interaction and drive the agent to read a victim's Gmail, Google Docs, and calendar entries; under the extension's more autonomous "act without asking" mode, the action could proceed without a visible confirmation prompt. Manifold reported the issue to Anthropic in May 2026 — tied to an earlier flaw it named ClaudeBleed — and said it remained exploitable across the releases that followed. The market implication tracks the rest of this section: the spread of agentic browsers is a demand driver for runtime agent-action controls and for the vendors positioning to govern agent behavior, and another reason agent-security capability is being absorbed into larger platforms rather than sustained as a standalone product (SecurityWeek · Manifold Security).

The attack taxonomy is institutionalizing (Jul 2026). CrowdStrike's AI security research team published 18 new additions to its prompt-injection taxonomy on Jul 7, 2026, expanding coverage to more than 200 documented techniques — the largest such catalog in the industry. Five of the additions illustrate how the attack class has moved beyond "ignore previous instructions": trigger-activated rule addition (a dormant instruction that activates on a later keyword or event), cognitive token suppression (blocking safety-related terms to steer the model away from refusal patterns), algorithmic payload decomposition (fragmenting a malicious command into benign-looking pieces the model reassembles), special token injection (counterfeiting the structural markers models use to separate system commands from user input), and unwitting user context-data injection (hiding the payload in content a legitimate user pastes into a CRM record, ticket, or document that an AI system later processes) (CrowdStrike, Jul 7 2026). A 200+-technique taxonomy maintained by a platform incumbent signals that prompt-injection defense is consolidating into the platforms' research apparatus — the same dynamic that makes standalone Security-for-AI vendors acquisition targets rather than durable independents.

The agentic explosion (where risk becomes acute). The shift from AI that talks to AI that acts is the hinge. Autonomous agents plan, decide, and act — querying data, calling tools, moving money, deploying code. The Model Context Protocol (MCP) is the de facto standard connecting agents to tools, and that connective power is the danger: prompt injection that hijacks tools, malicious/counterfeit MCP servers, software-supply-chain risk, and over-privileged "helpful" agents. The consensus control framework: authentication/authorization, provenance tracking, isolation/sandboxing, inline policy enforcement, centralized gateway governance.

AI identities as an attack surface (Jul 2026). A Sophos research report published Jul 22 2026 identifies enterprise AI adoption as the fastest-growing source of new exposure, and frames the risk primarily as an identity and governance problem rather than a model-behavior problem. As coding agents, assistants, and open-weight models are granted privileged access to core systems, the credentials and permissions surrounding them — OAuth tokens, AI service credentials, developer tools, and exposed AI infrastructure — become high-value targets, and breaching one creates a new pathway into the enterprise network. The report cites separate research finding a 466.7% year-over-year increase in active AI agents in enterprise environments, and notes that governance and access policy have not kept pace (Sophos, Jul 22 2026 · Infosecurity, Jul 23 2026). The recommended controls — treat each agent as a scoped non-human identity, require manual verification for new access, and alert on anomalous agent behavior — restate the linkage below: securing AI is largely an identity problem, and agent adoption expands the non-human-identity pool that identity vendors govern.

The AI build chain as an attack surface (Jun 2026). North Korea's Sapphire Sleet (APT38/BlueNoroff) compromised an npm maintainer account and backdoored 144 packages in the @mastra scope (Mastra is an open-source TypeScript framework for AI apps/agents) in a single ~88-minute automated campaign (compromise Jun 17; Microsoft attribution Jun 19), injecting credential/crypto-wallet-stealing malware — tied to a separate Axios npm attack in April 2026 (Infosecurity · SecurityWeek). Securing the packages, pipelines, and agent dependencies that build AI — provenance/SBOM, registry integrity, dependency governance — is a Security-for-AI frontier beyond model/prompt defense (cf. Chainguard + JPMorgan + BNY teaming Jun 16 to secure open source against AI threats). See Threat Economy.

The defensive response is consolidating around the coding agent (Jun 2026). Snyk launched Evo Agentic Development Security (Evo ADS) on Jun 23 2026 (GA Jun 29), governing — inside the agent's workflow — the tools an agent pulls in (incl. MCP servers), the actions it takes at runtime, and the code it generates. Evo ADS completes the Snyk AI Security Platform (Evo AI-SPM for AI-asset visibility + Evo Continuous Offensive Security for simulated attacks), and pairs with Snyk's Invariant Labs acquisition (announced Jun 24 2025; agentic-AI/MCP security) for a build-time-to-runtime agent-security stack (SiliconANGLE · Snyk). OWASP's 2026 LLM report puts prompt-injection +340% YoY (its fastest-growing attack category) and frames agent security as "a supply-chain problem first" (Help Net Security). A dev-security incumbent assembling a full Security-for-AI platform organically and by tuck-in simultaneously is a clear current instance of the pattern in which a platform absorbs the category as a feature, compressing the standalone-pure-play window from the SDLC side.

The data-cloud platforms are building Security-for-AI natively (Aug 2026). At Black Hat USA 2026, Snowflake introduced enterprise AI-security controls around its Cortex AI Gateway — agent-identity controls, data-exfiltration prevention, and governance for Model Context Protocol (MCP) tool use — positioning the data platform itself as the enforcement point for how AI agents access governed data. This is the same absorb-the-category dynamic seen from the SDLC side (Snyk) and the network/ADC tier (F5, A10), now from the data-cloud side: the platform where enterprise data already lives extends into agent-access governance rather than leaving it to a standalone Security-for-AI vendor. It reinforces the read that much of Security-for-AI accrues to incumbents adjacent to the asset being defended — here, the data warehouse — narrowing the durable-independent window for agent-governance point products (Snowflake, Aug 2026).

→ Key linkage: Securing AI is largely an identity problem — every agent is a non-human identity to authenticate, authorize, monitor, and govern. Agents are exploding the non-human-identity count, supercharging the identity profit pool (see Vendors, Market Structure). This extends the same migration that drove Palo Alto–CyberArk ($25B).

The defensive stack & standards

• Posture (AI-SPM): continuous discovery/monitoring of models, apps, data flows (HiddenLayer, Palo Alto Prisma AIRS).
• Runtime guardrails: real-time prompt/response filtering & policy (Lakera, Prompt Security, Patronus, AWS Bedrock Guardrails, Azure Content Safety).
• AI red-teaming: automated adversarial testing pre/post deployment (Mindgard, Lakera, General Analysis).
• Agent identity & governance: non-human identity, agent visibility/governance (Zenity, Straiker, Noma, Aembit/Astrix adjacency).
• Standards/regs driving mandatory demand: OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS, EU AI Act (risk-tiered, phasing in). See Regulation.

Vendor landscape & M&A

Market context: AI-in-cybersecurity market ~$34B (2025) → ~$44B (2026) → $130B+ by early 2030s (≈20%+ CAGR). The "security for AI" slice is young and the highest-multiple, highest-aggregation-risk part of it.

→ Profit-pool read (three lenses, see [04 economics lens]): margin = software-rich; migration = forceful (value flowing toward AI security as enterprises build on AI); structural attractiveness = high but shadowed by aggregation risk — the Protect AI / Robust Intelligence deals signal the platforms intend to absorb AI security as a feature, and cloud providers bundle guardrails at near-zero marginal cost.

Two buyer archetypes in the Security-for-AI consolidation. The acquirers of AI-security pure-plays now split into two distinct groups. The first is the security platform absorbing AI security as a feature of its own suite — Palo Alto (Protect AI), Cisco (Robust Intelligence) — the aggregation-risk pattern above. The second, newer archetype is the AI or data-science platform internalizing AI security to make its own AI outputs trustworthy: Anaconda's August 2026 acquisition of Enkrypt AI (red-teaming, runtime guardrails, and NIST-AI-RMF / EU-AI-Act compliance automation) governs "every step from a builder's first prompt to the AI-native application running in production." For this second buyer, AI security is not a product line to sell but a control the platform must own to ship trusted AI — a demand pulled forward by the Aug 2, 2026 EU AI Act GPAI-enforcement milestone (16b). It widens the exit set for AI-security independents beyond the security incumbents to the AI-tooling vendors themselves.

Funding signal (Jun 2026): fresh capital keeps entering the runtime/agent-governance edge even as platforms absorb it. Runlayer raised a $30M Series A led by Felicis with Khosla Ventures (announced Jun 24, 2026; ~$42M total raised) to be the security & governance layer for the enterprise MCP / AI-agent workforce — tool-mapping, human sign-off on sensitive actions, full-session observability, and detection of prompt injection, tool poisoning, exfiltration and intent drift, with early adopters incl. Gusto, dbt Labs, Instacart and Opendoor (PR Newswire · Fortune). Earlier in June, NeuralTrust (Barcelona) raised a $20M seed led by Alstin Capital (Jun 17, 2026) — reportedly the largest cyber seed by an EU company to date — for enterprise AI-agent security (prompt-injection/jailbreak defense, runtime guardrails, red-teaming, observability) (PR Newswire). Together they mark MCP / agent-runtime governance as a distinct, fast-funding sub-segment (cf. Snyk–Invariant/Evo, Koi→PANW, Promptfoo→OpenAI) — the European locus (NeuralTrust) carries a NIS2/DORA + EU AI Act tailwind, while the US cluster (Runlayer) draws marquee tier-1 sponsors.

Funding signal (Aug 2026): the agent-governance edge produced its largest independent round to date — Zenity's $125M Series C (Aug 3, 2026; led by Norwest; total funding ~$185M), which added strategic corporate backers SoftBank Vision Fund 2, Hitachi Ventures, and LG Technology Ventures whose participation is tied to their own enterprise agent adoption. Following the July agent-governance cluster (Onyx $113M, plus the Neo/Hush/Act identity rounds), it marks the first agent-security independent capitalized to attempt durable scale rather than an early absorption — the sliver the falsifiable "feature-or-market" test flags as the one platforms have not yet closed (03l, 07). (Fortune, Aug 3 2026 · SiliconANGLE) The next day (Aug 4, 2026) the agent-governance lane priced its first unicorn: Obsidian Security's $85M Series D at a ~$1.1B valuation (led by Crescent Cove Advisors; total funding over $200M) — a runtime-governance platform for AI agents inside third-party SaaS applications, the second nine-figure agent-governance round in two days. Alongside it, Oligo Security raised $60M (total ~$140M) for runtime application/cloud and AI-systems protection — an AI-for-Security runtime play rather than agent governance. The four AI-security rounds across Aug 3–4 total roughly $520M: about $210M into Security-for-AI agent governance (Zenity, Obsidian) and about $310M into AI-for-Security validation and runtime protection (Horizon3.ai, Oligo) — both lenses of the framework capitalizing at once (03l, 11). (SecurityWeek — Obsidian · SecurityWeek — Oligo)

Several AI-security deals are frequently misdated to June 2026 but are in fact June 2025; search results recurrently conflate the two years' M&A roundups. All of the following are primary-source-verified to June 2025:

2) AI for security (offense & defense)

• Defense: autonomous SOC, AI-driven detection/triage/response, agentic security operations — directly attacking the talent-scarcity margin ceiling in services (see Economics). The agentic-SOC race is now mainstream: CrowdStrike shipped agentic MDR + seven Charlotte agents (and created a Chief AI & Autonomous Systems Officer seat, Jun 3 2026), and Microsoft is rolling Security Copilot for SOC to M365 E5 customers (see The Agentic SOC, Key People). Vendor product launches (Jul 3–10, 2026) underscore the breadth of AI-for-defense embedment: Digi International (DANI, AI network-operations agent for managed network/security); Netzilo (expanded AI-agent governance for Amazon Bedrock AgentCore); iboss (AI Security Platform for organization-wide AI tool visibility); First Recon AI (AI Security Runtime for enterprise AI governance, GA mid-July); Codenotary (AgentMon 3, enterprise AI security platform with adaptive runtime policies); Automox (MCP Server 2.2, agentic endpoint operations); Attestiv (DeepScan, file validation before business-critical decisions); CyberProof (Agentic MXDR Service combining AI agents with human response). The cluster reflects two patterns: (a) security platforms extending into AI-agent governance as a feature, and (b) infrastructure/operations vendors adding a security/governance layer as AI adoption accelerates in their customer bases.
• Commercial agentic SOC at scale (Aug 3 2026): Arctic Wolf reported new operating milestones for its Aurora Agentic SOC and Aurora Superintelligence Platform — more than 10 trillion security events processed weekly, more than three million security cases resolved, and more than 200,000 investigations run each week, with many resolved in as little as 12 seconds and case-resolution times 26% faster year over year. Its "Swarm of Experts" architecture autonomously closes over 60% of case volume as high-confidence closures, escalating roughly a third of complex cases to human analysts, and the company introduced Mean Time to Trusted Action (MTTA) as a new performance metric. The service is priced on flat, unlimited-ingestion terms it frames as roughly 12x cheaper than building an agentic SOC in-house, in contrast with the metered, consumption-based pricing common among AI-security products. Coming from the largest independent MDR, it is a concrete instance of the "software eats services" thread — variable analyst labor converted into fixed software cost at production scale (cross-ref MDR, The Agentic SOC) (Arctic Wolf, Aug 3 2026).
• Purpose-built defensive foundation model as a distinct archetype (Aug 10 2026): Corma raised a $60M seed led by Sequoia Capital, with Khosla Ventures and Coatue, to build what it calls the first frontier defensive cybersecurity AI lab. Rather than embedding copilots in a platform or building agents on general-purpose frontier models (GPT/Claude/Gemini), Corma is training a foundation model specifically on security telemetry (logs, audits, pattern detection) and delivering it as AI agents that operate across a customer's existing security tools as an end-to-end virtual analyst; reported early Fortune 100/500 deployments cut threat-response times by more than 94% and expanded coverage roughly 15x (valuation undisclosed). The round marks a fourth distinguishable pattern within AI-for-Security supply — a security-specific base model as the substrate for defensive autonomy — alongside platform copilots (CrowdStrike Charlotte, Microsoft Security Copilot), operator-scale agentic SOC (Arctic Wolf Aurora), and autonomous validation (Horizon3.ai). It is also a live test of build-versus-buy on the model layer: whether a domain-specific defensive model outperforms enough to sustain an independent lab, or whether the frontier labs' general models (Anthropic Mythos, OpenAI Aardvark) and platform incumbents absorb the defensive-autonomy workload first. In delivering the model as working agents, it also sits on the software-eats-services thread (cross-ref The Agentic SOC, Venture Capital) (Sequoia, Aug 10 2026 · Fortune).
• Platform incumbent ships a purpose-built cyber model (Aug 3 2026): Microsoft put Project Perception into public preview — a multi-agent defensive system it markets as a new "Cyber Stack." It is built around MAI-Cyber-1-Flash, an in-house model trained specifically for cybersecurity, and calls on OpenAI's GPT-5.4 for the roughly 10% of tasks it classifies as exceptionally hard. The architecture organizes more than 100 specialized agents across four stages (prepare, scan, validate, dedupe) into red-team agents that identify paths to compromise, blue-team agents that investigate activity and judge which findings represent meaningful risk, and green-team agents that take corrective action. Early-preview customers include Nationwide. Project Perception is the platform-incumbent counterpart to the security-specific base-model archetype that Corma (above) represents at the startup layer: rather than relying solely on a general-purpose frontier model, the largest platform vendor is training its own domain-specific cyber model as the substrate for defensive autonomy — a data point on the build-versus-buy question at the model layer resolving toward incumbents building in-house (cross-ref The Agentic SOC, Vendors) (Microsoft Security · TechRepublic, Aug 2026 · GeekWire, Aug 2026).
• A distinct meta-layer emerges — AI applied to managing the security program itself (Jul–Aug 2026): two Series A rounds within a week funded companies that use AI agents not to defend a threat surface directly but to run the security program as a system. Discern Security raised $13M (announced Jul 30 2026, led by Forgepoint Capital, with First Rays Ventures, Growth Enjin Partners, Vela Ventures, and angels) for an agentic platform that continuously evaluates security posture — unifying environment data with AI agents and human-approved workflows to identify control gaps, mapping findings to the assets, controls, and compliance frameworks (such as MITRE ATT&CK) behind them, and converting technical findings into executive-ready reporting. Balance Theory raised $19M (announced Jul 31 2026, led by SYN Ventures, with existing backers DataTribe and TEDCO; Dan Burns, founder of Accuvant and former CEO of Optiv, as executive chairman) for an AI-native platform that consolidates the cybersecurity investment lifecycle — a system of record holding persistent context for the security program, curated market intelligence fed into decision flows, and AI agents that turn purchasing and prioritization choices into coordinated action; it reports overseeing more than $1B of customer security spend and prices its subscription against delivered outcomes rather than product volume. Both sit on branch A (AI raising the product ceiling) but at a program-management layer above threat detection, and both carry a software-eats-services flavor: they automate the control-assurance, assessment, and portfolio-advisory work previously delivered by consultants and vCISOs. Whether this coheres into a durable sub-segment or is absorbed by adjacent security-posture-management (CTEM/SPM) and GRC incumbents is unresolved — two entrants in one week is an early signal, not yet a category (cross-ref GRC & TPRM, vCISO & Advisory, Deals) (Discern — SecurityWeek, Jul 30 2026 · Balance Theory — FinTech Global, Aug 3 2026). An incumbent has since taken the same layer: Sophos CISO Advantage, announced as part of the Sophos Fusion rollout with availability beginning October 2026, combines continuous control validation, compliance mapping, peer benchmarking and risk assessment with human expertise delivered through Sophos's managed-service-provider network, and is positioned both for organizations with a CISO and for those without one. The venture-funded entrants and a platform vendor with an installed MSP channel are therefore building the same program-management capability at the same time, which is the pattern that historically resolves toward incumbents where the differentiator is distribution rather than model quality (Sophos, Jul 15 2026).
• Cross-vendor standardization of the autonomous SOC (Jul 2026): ExtraHop launched the Agentic SOC Alliance with 15 founding members — including CrowdStrike, Torq, Dropzone AI, ReversingLabs, Intezer, LangChain, Prophet Security, Exaforce, Command Zero, and TENEX.AI — spanning network detection, endpoint, AI-native SOC platforms, orchestration, and agent frameworks. The group aims to define shared requirements, best practices, and implementation blueprints for a SOC built for autonomy from the ground up, organized around a three-layer Context / Harness / Model architecture. Its stated premise is that autonomous defense cannot be delivered by any single vendor; as a market-structure signal it points toward the agentic SOC consolidating around a common, interoperable operating model rather than a single bundled platform, in contrast to the hyperscaler bundling pressure tracked below (cross-ref The Agentic SOC) (ExtraHop, Jul 22 2026).
• Federal adoption of frontier-model code auditing (reported, Jul 2026): Reuters reported, citing three sources, that CISA is using Anthropic's Mythos model to scan code repositories across federal agencies for security vulnerabilities, with the audits run by CISA's Attack Surface Evaluation team and a "large number" of flaws already found; the NSA is also believed to use Mythos (SecurityWeek, Jul 7 2026 · Reuters). Neither CISA nor Anthropic has confirmed on the record. If accurate, the federal government is now an at-scale customer on the discovery leg of the discover→validate→remediate loop — which widens the gap the EO-14409 clearinghouse debate centers on, since AI-assisted discovery continues to outrun federal remediation capacity (see Regulation).
• End-customer open-sourcing of agentic code security (Jul 2026): Capital One released VulnHunter, an internally built agentic AI code-security tool, as open source under an Apache 2.0 license. The tool applies attacker-first analysis directly to source code — starting from attacker-accessible entry points (APIs, network messages, file uploads) and reasoning forward along the exploit path — and includes a "falsification engine" that runs a structured workflow to disprove its own exploit reasoning, filtering findings that fail the test. It was tuned for Claude Opus 4.8 and Claude Code, and Capital One reports validating it internally across thousands of repositories before release (Capital One · SecurityWeek · VentureBeat, Jul 17 2026). The release is notable for who built it: a bank — an end customer, not a security vendor — constructing frontier-model security tooling in-house and giving it away, a data point both for enterprise AI-for-security adoption and for the commoditization pressure facing commercial code-scanning products.
• National-scale agentic defense (UK, announced Jul 7 2026): the UK's NCSC published plans for Cyber Shield, a national program to build "a national-scale, collaborative approach to agentic cyber defense" using frontier AI — agentic red and blue teams for vulnerability discovery and mitigation, coordinated detection and response, and national-level scanning and mitigation, with participation invited from academia, critical-infrastructure operators, frontier labs, and security vendors. The program follows GCHQ director Anne Keast-Butler's May 27, 2026 Bletchley Park statement that GCHQ had developed "the blueprint for a new national cyber defense capability that will hardwire cutting-edge agentic AI into machine speed cyber defense." Alongside the US EO-14409 track, this makes two of the largest western cyber powers building state-level agentic-defense programs in the same summer — a second sovereign demand signal for the autonomous-defense cohort. Practitioner criticism has focused on whether agentic defense addresses the configuration- and process-failure breaches that dominate today's incident mix (NCSC — Cyber Shield · SecurityWeek, Jul 9 2026). See also Sovereign & Government, EU & UK Regulation.
• Offense-as-defense (autonomous pentest / exposure validation): AI agents that act as the attacker to find and validate real attack paths before adversaries do — the agentic frontier of CTEM. Funded entrant: A Security emerged from stealth with $37M (announced Jun 8, 2026; Lightspeed + Cyberstarts, with Wiz CEO Assaf Rappaport and Cyera CEO Yotam Segev as angels), building autonomous attack-path discovery, exploitability validation, and remediation (GlobeNewswire · Fortune). See also AI for Offense.
• Offense (adversary side): AI-generated phishing/malware, and AI-discovered vulnerabilities at machine speed — see the Fable 5 case below. Threshold crossed (Jul 2026): Sysdig's JADEPUFFER research (disclosed Jul 1–2 2026) documented the first end-to-end agentic ransomware operation — an LLM agent autonomously exploited Langflow (CVE-2025-3248), chained the full kill chain, and ran destructive database extortion, including a 31-second self-correcting fix mid-attack. The skill-barrier collapse RaaS started, agents finish — the sharpest demand datum yet for the agentic-SOC/autonomous-defense cohort (detail + economics on Threat Economy).
• Remediation consolidates (the machine-speed patching leg): Aikido acquired Root (~$70M, announced Jun 30 2026) — Root's AI-agent swarms research, write, test and ship a verified backported OSS patch in ~15–40 minutes to the exact pinned versions a customer runs. With OpenAI Daybreak's patch-over-discovery refocus (Jun 23) and BOD 26-04's risk-based-patching mandate, the discover→validate→remediate loop now has M&A prints at every leg (see Deals).

AI labs in cybersecurity — partnerships & programs (2026)

The frontier AI labs have moved directly into cybersecurity, partnering with the largest public companies. This is now a primary axis of the industry. (See also Key People and Intelligence Sources.)

Anthropic — Project Glasswing

• Launched April 2026. Industry-wide AI cyber-defense initiative built on the Claude Mythos frontier model (which had already found thousands of zero-days across every major OS and browser).
• Founding partners (public co's): AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks.
• Commitment: up to $100M in model usage credits + $4M to open-source security orgs.
• Results/expansion: 10,000+ high/critical-severity vulnerabilities identified; expanded (June 2, 2026) to 150 more orgs in 15+ countries (power, water, healthcare, comms, hardware).
• Significance: Mythos can autonomously discover and weaponize zero-days; Anthropic briefed US officials that uncontrolled release could make large-scale attacks "significantly more likely." → directly sets up the regulatory action below.

OpenAI — Daybreak / Aardvark (Codex Security)

• Daybreak (announced May 11, 2026): cybersecurity initiative combining OpenAI models + Codex agentic harness + security partners; prioritizes high-impact threats, generates/tests risks in-enterprise with scoped access, produces audit-ready remediation evidence.
• Aardvark → "Codex Security": an agentic security researcher delivering continuous protection as code evolves; rolling out to ChatGPT Enterprise/Business/Edu.
• Zscaler + OpenAI: Zero Trust Exchange + OpenAI models; Zscaler uses OpenAI in its AI Asset Analysis (MCP tool/risk analysis for agents).

Hyperscalers & platforms (agent-security land grab)

• Microsoft: Agent 365 (govern AI agents); MDASH (multi-model agentic vuln discovery, 100+ specialized agents, integrates with Defender), now productized as Project Perception (public preview Aug 3 2026), a red/blue/green multi-agent "Cyber Stack" built around Microsoft's own in-house cyber model MAI-Cyber-1-Flash with a fallback call to OpenAI GPT-5.4 for the hardest ~10% of tasks (see Section 2 above); Purview controls for coding agents (Claude Code, GitHub Copilot, OpenAI Codex, OpenClaw).
• Google Cloud (+ Wiz, $32B closed Mar 2026): Threat Hunting agent and Detection Engineering agent (preview); Wiz integrates across agent studios. On Jul 21 2026 Google moved CodeMender — the DeepMind agentic code-security project introduced in October 2025 — into public preview as a fully managed enterprise AI code-security agent on the Gemini Enterprise Agent Platform and as a component of Google AI Threat Defense (working alongside Mandiant and Wiz). CodeMender runs the same discover→validate→remediate loop AWS Continuum ships: it builds and runs proof-of-concept exploits in customer-managed sandboxes to confirm exploitability, then delivers tested fixes to development pipelines as code diffs, using an LLM-as-judge to check that changes do not break business logic. It is multi-model (Gemini 3.5 Flash default, 3.1 Pro and 3 Flash in preview, with third-party frontier models slated later in 2026) — the router pattern that treats frontier models as interchangeable inputs. A security-tuned Gemini 3.5 Flash Cyber model is in a limited-access pilot restricted to governments and trusted partners on dual-use grounds. In its research phase CodeMender upstreamed 72 security fixes to major open-source projects under human oversight (Google Cloud, Jul 21 2026 · Infosecurity, Jul 22 2026). AI-for-Security read: a second hyperscaler now productizes the full vulnerability-discovery-and-remediation loop that the funded autonomous-pentest/CTEM cohort sells, and does so behind a multi-model router — reinforcing both the bundling pressure on sub-scale AI-SOC pure-plays and the supplier-commoditization leg of the frontier-lab bear case (20e).
• AWS (Summit New York, Jun 17 2026): Continuum — an AI-native vuln-management platform that continuously discovers → prioritizes → validates → remediates code/security risk "at machine speed," validating exploitability by building working exploits in a sandbox and graduating from human-in-the-loop "learn mode" to automated "enforce mode" (gated preview); plus Context, a sibling service for AI-agent security. AI-for-Security read: a hyperscaler now ships the same discover-validate-remediate loop the funded autonomous-pentest/CTEM cohort sells (cf. A Security, below) — bundling pressure that tightens the consolidate-or-fade clock on sub-scale AI-SOC pure-plays (AWS · Infosecurity).
• Cloudflare: Mesh (private networking for AI agents) and zero-trust egress for agents (Agents Week 2026).

Three of the largest hyperscalers now ship a version of the same discover→validate→remediate loop — Microsoft (MDASH, now productized as Project Perception), AWS Continuum, and Google CodeMender — each validating exploitability by building working exploits in a sandbox, each behind a multi-model router rather than a single frontier model. Microsoft's Project Perception adds a nuance to the pure-router pattern: alongside its GPT-5.4 fallback it now trains an in-house, purpose-built cyber model (MAI-Cyber-1-Flash) as the default engine — the same security-specific base-model bet the funded startup Corma is making, taken by the platform incumbent. The convergence is the concrete form of two pressures the rest of this page tracks: bundling pressure on the sub-scale autonomous-pentest/AI-SOC pure-plays that sell the loop as a standalone product, and the supplier-commoditization leg of the frontier-lab bear case, in which the general models become interchangeable, price-competed inputs behind a platform's own orchestration — though a platform training its own domain model complicates the assumption that the model layer commoditizes uniformly.

→ M&A read: the labs are picking winners (Glasswing's CrowdStrike/Palo Alto), validating AI-security categories, and accelerating the agent-security land grab among hyperscalers — supportive of AI-security M&A and an example of AI reshaping the business itself.

The federal policy frame — the June 2026 AI EO

On June 2, 2026, the White House signed the executive order "Promoting Advanced Artificial Intelligence Innovation and Security" — Executive Order 14409, published in the Federal Register June 5, 2026 (91 FR 34565). It pursues two tracks: (1) hardening federal and private-sector cyber defenses against AI-enabled threats, and (2) building voluntary benchmarking/review frameworks for the secure development and release of "covered frontier models." It directs agencies on aggressive 30-/60-day timelines — key deliverables due July 2, 2026 and August 1, 2026 — to deploy AI-enabled defenses on federal systems, stand up a classified benchmarking process (Treasury, War, Homeland Security) to evaluate models' advanced cyber capabilities, establish an AI cybersecurity clearinghouse (Treasury + National Cyber Director) for vulnerability scanning/patch coordination, and prioritize criminal enforcement of AI-enabled cyberattacks (White House presidential action · Covington/Inside Privacy analysis). The clearinghouse leg stood up on Jul 14, 2026 as the Treasury-managed "Gold Eagle" initiative — intake via the VINCE platform run with Carnegie Mellon's Software Engineering Institute, with the White House saying the system was already receiving vulnerability intelligence and prioritizing patches at launch (CyberScoop, Jul 14 2026; detail in Regulation).

→ Why it matters for M&A: the EO institutionalizes "AI cyber capability" as a national-security-graded property of models — the same logic that, ten days later, produced the BIS Fable/Mythos directive (below). For the deal machine it (a) accelerates federal demand for AI-security tooling and benchmarking/red-team vendors, and (b) raises the regulatory overhang on frontier-model access — a structural tailwind for the AI-security pool and a new diligence axis (export-control/benchmarking exposure). See also Regulation and 20f.

The allied policy frame — the Five Eyes joint statement (Jun 22, 2026)

Twenty days after EO 14409, the heads of the Five Eyes cyber security agencies — CISA and the NSA (US), the UK NCSC, Australia's ACSC, the Canadian Centre for Cyber Security, and New Zealand's NCSC — issued a rare joint leadership statement, "The AI shift in cyber risk: why leaders must act now." Its central claims: frontier AI models "are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities," and "the timeline is not years, it is months." The statement frames cyber risk as a board-level business risk rather than a technical one, and directs leaders to five priority actions: attack-surface reduction, accelerated patching (because AI is shrinking the window between vulnerability discovery and exploitation), legacy-system replacement, stronger identity and access controls, and incident preparedness — alongside an explicit instruction to use AI in defense because "adversaries are already using AI to move faster" (NSA, Jun 22 2026 · CISA). It is signed by the individual agency heads, including acting CISA director Nick Andersen and NSA cybersecurity director David Imbordino.

→ Market read (threads kept distinct): on the demand side, this is the most senior allied-government endorsement to date of the AI-cheapened-offense thesis — official confirmation that the discovery-to-exploitation window is compressing, which underwrites budget for patching automation, exposure management, and the agentic-SOC cohort. On the supply side, the "use AI to strengthen defense" directive gives boards top-cover for AI-for-Security adoption. The statement sits alongside the same summer's national programs (EO 14409, UK Cyber Shield above) as coordinated allied signaling rather than a new legal regime — it imposes no obligations, but board-level attention is itself a demand mechanism (see How Buyers Buy).

3) AI as a strategic asset — Fable/Mythos

On June 12, 2026, the U.S. Commerce Department's Bureau of Industry and Security issued an export-control directive ordering Anthropic to suspend all access to Fable 5 and Mythos 5 for any foreign national — inside or outside the US, including Anthropic's own foreign-national employees. Because the company could not reliably screen users by nationality, it disabled both models entirely for all customers while working to comply (other models unaffected).

• Trigger: national-security concern over the models' vulnerability-discovery/weaponization capability; reportedly catalyzed after researchers circumvented some of Fable 5's anti-hacking guardrails. Reporting indicates the jailbreak was strikingly simple — a prompt amounting to the three words "Fix this code" could surface the underlying offensive capability (Fortune). The "Is Informed" letter from BIS landed June 12, 2026 — just three days after the models launched (June 9).
• Reaction (escalating): dozens of cybersecurity experts signed an open letter urging the government to lift the controls, arguing the models are net-positive for defense and that restricting them cedes ground to adversaries (Mezha). Anthropic reviewed a demonstration of the claimed risk and found it surfaced only previously-known, minor vulnerabilities also discoverable by other public models (e.g., OpenAI's GPT-5.5) — i.e., not a unique threat (CyberScoop). The episode is now the canonical precedent-setting AI export-control action.
• Significance: frontier models are now treated simultaneously as cyber weapons, cyber defenses, and national-security assets, controlled like munitions — even when the controlling agency and the model's maker disagree on whether the capability is unique. AI export controls + sovereign AI reshape sovereign cyber demand and cross-border deal structures (see Sovereign). Full treatment: Book Ch. 28 — AI as Strategic Asset.

Status as of 2026-07-04: the export controls were lifted. Anthropic said on Jun 30, 2026 that the administration removed the restrictions (CNBC); Fable 5 returned globally Jul 1, 2026, and Mythos 5 was restored to approved U.S. organizations (government sign-off reported Jun 26). The resolution was a settlement rather than a rescission: it includes prerelease federal review of frontier models and dedicated government-priority research teams, so the precedent hardened into a negotiated regime. Full treatment: Fable/Mythos & AI Export Controls. Open questions are whether prerelease review generalizes to other labs and how it interacts with the EO 14409 ≈Aug 1 benchmarking track.

Fable 5's cyber classifiers and the CJS framework (Jul 2, 2026)

Alongside Fable 5's global redeployment, Anthropic published the first detailed public taxonomy of what a frontier model's cyber safety classifiers block, plus a draft Cyber Jailbreak Severity (CJS) framework built with the Glasswing partners (Amazon, Microsoft, Google) — a proposed industry standard for scoring jailbreak risk (Anthropic, Jul 2 2026):

• Four classifier categories: prohibited use (ransomware/wipers, malware development, C2, exfiltration, internet-backbone attacks → always blocked); high-risk dual use (pentesting/red-teaming, exploit development, privilege escalation, ICS/telecom/financial-infrastructure assessments, and "high-uplift" vulnerability finding → blocked "until we have better controls to limit access to known good actors"); low-risk dual use (OSINT, commodity vuln finding → monitored, partially blocked as safety margin); benign (secure coding, SOC/IR, malware RE → allowed).
• CJS-0 → CJS-4 severity scale, scored on four axes (capability gain, breadth, ease of weaponization, discoverability) — explicitly framed as a CVSS-analog for AI jailbreaks so labs and governments can communicate in consistent terms; accompanied by a HackerOne cyber-jailbreak bounty program.

→ Two market reads (threads kept distinct): (1) Security-for-AI — the model's misuse surface is being standardized; if CJS is adopted, it becomes compliance infrastructure the AI-governance/AI-SPM cohort can map to. (2) AI-for-Security implication — blocking pentest/red-team/exploit work on the frontier model is a capability-access constraint on the autonomous-pentest/offensive-validation cohort: "known-good-actor" access programs (cf. OpenAI's "Trusted Access for Cyber," Jun 23) become a moat-and-diligence question for any AI-for-Security target that depends on frontier-model offensive capability.

/ angle

→ Sell-side origination: founder-led, VC-backed AI-security pure-plays in a hot, migrating pool with declared strategic acquirers = textbook sell-side mandates; the scarcity window closes as platforms aggregate.

→ Buy-side: every platform and many sponsors now have an explicit AI-security gap to fill; targeted sourcing here extends a buy-and-build program.

Adjacent market: the AI infrastructure and governance layers as industries of their own are mapped on AI Infrastructure & Governance.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.