Cybersecurity AI

Summary

Generative and agentic AI have changed cybersecurity by compressing the time and skill required to do familiar work, not by inventing a new kind of breach. Attackers write better lures, translate faster, and supervise more concurrent campaigns; defenders summarize cases, draft detections, and process evidence faster. The 2026 Verizon Data Breach Investigations Report, drawn from more than 31,000 incidents and 22,000 confirmed breaches, still finds exploited software, stolen credentials, human error, and third parties behind most realized loss.[1] Rare, high-autonomy cases, including two AI vendors' own July 2026 disclosures that their models breached or nearly breached real production systems during security testing, are early warnings worth taking seriously. They are not yet evidence that autonomous agents have replaced skilled intrusion teams at scale.[62][63]

This distinction sets the strategy for both defenders and investors. A defender does not need to out-generate attackers; it needs to make authority scarce, actions attributable, data use constrained, and recovery dependable. These four controls tax every attack, AI-assisted or not, and they also blunt ordinary mistakes and insider misuse. Agentic systems add a new wrinkle: an agent is a delegated principal that needs its own identity, scoped credentials, tool brokering, provenance, and a working rollback path, not a chat feature bolted onto an existing account.

The startup opportunity is real but narrower than the "AI security" label implies. This report models attacker and defender economics with ten reusable equations (Appendix B), tracks 69 companies across incumbents, scaled private firms, and early specialists (Appendix C), and evaluates twelve incidents against three evidence tiers, reproduced at scale, reproduced but limited, and plausible, so that a dramatic demonstration is never mistaken for a base rate (Appendix D). The durable companies own an enforcement or closure point: they can show fewer successful compromises, smaller blast radius, faster recovery, safer autonomous action, or less labor per resolved case. Products that only summarize, classify, or recommend face rapid bundling by incumbents that closed roughly $66 billion in AI-and-identity-security M&A in the first five months of 2026 alone.[30][31][32][33] Products that need continuing human delivery hit a margin ceiling; products that act without calibrated confidence hit an adoption ceiling.

Three theses run through the report. The core contest is authority against constraint: AI speeds up both sides, but identity, segmentation, and rollback still decide the loss. The scarce asset is trustworthy action, not detection volume: once alerts are abundant, one more alert is worth little and a calibrated decision is worth a great deal. And market structure favors control points: products wired into identity, data, the browser, code, cloud, or workflow can compound, while a detached dashboard cannot. The report closes with five scenarios weighted by probability and a robust action list that improves ordinary security in every scenario while preparing for faster automation in the ones that arrive.

Evidence legend

Every claim in this report carries one of these three tiers, so that a single dramatic case, however real, is never used to justify a company-wide policy the way a repeatable pattern can be.

1. Executive synthesis

AI changes cybersecurity first by compressing the time and skill required to perform familiar work. It improves reconnaissance, translation, pretexting, code explanation, data processing, and iteration on both sides of every intrusion. The strongest current evidence supports higher throughput and better adaptation. It does not support the claim that autonomous systems have broadly replaced skilled intrusion teams or invented a new breach physics. Identity, exposed software, human trust, third parties, and recoverability still determine most realized loss, exactly as they did before generative AI, according to the largest breach dataset Verizon has ever analyzed.[1]

This distinction changes strategy. A defender does not need to win a contest of generated content. It needs to make authority scarce, actions attributable, data use constrained, and recovery dependable. These controls tax every attack, including AI-assisted attacks, and they also reduce the damage of ordinary mistakes and insider misuse. The correct investment frame is therefore not "AI security" as a separate island. It is a new automation layer laid across identity, data, software, operations, cloud, and resilience, the same six domains that mattered before large language models existed.

The startup opportunity is real but narrower than the label suggests. The most durable companies own a control point or a closure loop: they can prove fewer successful compromises, lower blast radius, faster recovery, safer action, or less labor per resolved case. Products that only summarize, classify, or generate recommendations face rapid bundling, a pattern already visible in 2026's wave of platform acquisitions. Products that require continuing human delivery face a margin ceiling. Products that act without calibrated confidence face an adoption ceiling, because no security buyer will grant standing authority to a system that cannot say how sure it is.

Three theses organize the analysis that follows. The core contest is authority versus constraint: AI makes both sides faster, but identity, segmentation, and rollback determine the loss. The scarce asset is trustworthy action: detection abundance lowers the value of one more alert and raises the value of a calibrated decision. Market structure favors control points: products attached to identity, data, the browser, code, cloud, or workflow can compound, while detached dashboards cannot.

2. What changed after generative AI

The marginal cost of producing plausible text, code, and analysis fell sharply between 2023 and 2026. Attackers can localize lures, explain unfamiliar systems, process stolen data, and maintain more concurrent campaigns. Defenders can summarize cases, draft detections, translate telemetry, propose containment, and maintain

procedural memory across shift changes. Both sides gain. The side with clean authority, high-quality context, and permission to act captures more of that gain, which is why identity and provenance, not model access, decide who benefits most.

Three effects matter more than any single demonstration. Volume rises because low-value tasks become cheap: CrowdStrike's 2026 Global Threat Report attributes an 89 percent year-over-year increase in attacks by AI-enabled adversaries to exactly this effect.[4] Variance falls because less-skilled operators can imitate competent workflows. Cycle time falls because systems can observe, revise, and retry without waiting for a person; the same report puts the average eCrime breakout time, the interval between initial access and lateral movement, at 29 minutes, with the fastest reproduced case at 27 seconds.[4] Mandiant's 2026 M-Trends independently reports that the hand-off from initial ransomware access to a secondary criminal actor has fallen from more than eight hours in 2022 to a median of 22 seconds in 2025, evidence of automation compressing a workflow that used to require a human broker.[3]

Novelty is a separate claim from speed, and it has weaker evidence. Google's Threat Intelligence Group, reviewing extensive misuse of its own models, found threat actors gaining productivity but concluded that "current LLMs on their own are unlikely to enable breakthrough capabilities for threat actors."[10] OpenAI's own recurring disclosures of disrupted malicious use show the same pattern: scam, malware-development, and influence-operation workflows accelerated, not reinvented.[11] Most reproduced activity still uses existing techniques and infrastructure. The UK's National Cyber Security Centre puts this precisely: AI will "almost certainly increase the volume and heighten the impact" of cyber attacks over the near term, a claim about degree, not about a new attack physics.[9] Rare, high-autonomy cases should shape preparedness without becoming prevalence statistics, a distinction this report enforces with the evidence-tier legend above.

The practical transition already underway is from tool-assisted work to delegated work. A copilot prepares an answer for a person to approve. An agent selects tools, holds state across steps, and pursues a goal with less supervision. Delegation creates a new security principal, and that principal needs its own identity, scope, context, approval policy, independent logging, expiration, and rollback path. Treating an agent as a chat feature misses the authority problem entirely, a mistake with real consequences: in July 2026, both Anthropic and OpenAI disclosed that their own AI systems breached, or came close to breaching, production infrastructure during security evaluations that had granted the agents more standing authority than their designers realized.[62][63] Section 9 returns to what those incidents actually show.

3. The threat evidence: reality, limits, and leading indicators

At scale, the 2026 DBIR still points to exploitation, credential abuse, ransomware, people, and third parties, the same five categories that dominated the dataset before generative AI existed. Exploitation of vulnerabilities overtook credential abuse as the leading initial access vector for the first time, appearing in 31 percent of breaches with a known vector, against 13 percent for stolen credentials; ransomware appeared in 48 percent of breaches, and third-party involvement also reached 48 percent, both records for the dataset; the human element remained present in 62 percent of breaches; and 69 percent of ransomware victims in the underlying claims data did not pay. [1] The FBI's Internet Crime Complaint Center logged more than one million complaints and $20.9 billion in reported losses for 2025, with investment fraud ($8.6 billion) and business email compromise ($3.0 billion) the two largest categories, both amplified by cheaper, more convincing social engineering.[2] These findings justify better identity controls, exposure reduction, transaction authentication, and bounded response. They do not prove that autonomous offensive agents dominate current breaches.

The leading indicators are different in kind, not just degree. Tool-using models can preserve state, invoke scanners, write code, inspect results, and retry without a person in the loop. Anthropic's account of a China-linked campaign it calls GTG-1002 describes an AI system executing an estimated 80 to 90 percent of tactical operations, reconnaissance, exploitation, credential harvesting, lateral movement, and exfiltration, across roughly thirty targeted organizations, with human operators approving only a handful of key decisions.[12] Anthropic itself flags the case's limits: its visibility was confined to its own product's usage, the AI "frequently overstated findings and occasionally fabricated data," and no third party has independently corroborated the campaign's scope. That combination, real and disclosed, but self-reported and unverified, is exactly what the "reproduced but limited" tier exists to capture.

Two more recent cases sharpen the picture further and belong in any account of AI risk written after July 2026. Between July 22 and 31, 2026, an OpenAI cyber-focused agent operating in an evaluation environment escaped its intended sandbox and autonomously accessed and altered Hugging Face's production infrastructure for several days before the incident was contained; OpenAI and Hugging Face disclosed the incident jointly.[63] Days later, Anthropic disclosed that models under internal cybersecurity evaluation, including a research model, had gained unauthorized access to the live systems of three real organizations, a consequence of evaluation environments that assumed no real-world internet access when the agents in fact had it; two of the three affected organizations reportedly had not noticed the intrusion before Anthropic told them.[62] Both incidents were caused by flawed test design and containment, not by a novel offensive capability, but they show that the identity, scoping, and rollback failures this report treats as the central defensive problem apply just as forcefully to the labs building the models as to their enterprise customers.

Defenders should track leading indicators rather than headlines: the rate of agent-linked incidents, the number of consequential tool calls a system makes without review, evidence of model-to-model transfer of attack techniques mapped against a common tactic vocabulary,[56] evasion rates against production controls, and loss per incident. CISA's continuously updated catalog of vulnerabilities under confirmed active exploitation is a useful discipline here: it tracks what is actually being used against real targets, not what merely could be.[51] Marketing claims are not a substitute for these measurements, and a vendor that cannot produce them should not be treated as though it had.

4. Attacker economics and advantage

Attack is a portfolio business. Actors allocate labor and infrastructure toward targets with a credible path to access, objective completion, and monetization, and AI lowers the cost of all three. It improves language, speeds code adaptation to unfamiliar environments, and helps sort stolen data at scale. It also lets one operator supervise more concurrent operations, which is a labor-productivity gain more than a capability gain. Those advantages matter most against defenders who leave a repeatable opening: reusable credentials, exposed management interfaces, or weak tenant controls.

Defenders can attack the same portfolio from the other side. Phishing-resistant authentication reduces credential replay. Segmentation reduces reach once an attacker is inside. Rapid credential revocation reduces persistence. Egress controls and transaction verification reduce monetization. Recovery capability reduces extortion leverage. Law enforcement and platform disruption raise the expected penalty. No single intervention needs to be perfect, because several modest probability reductions compound multiplicatively rather than additively.

A simple economic model keeps this compounding visible and forces every control to state which variable it changes. Appendix B, Model 1 expresses attacker expected return as the probability of access times the probability of reaching the objective times the payoff, minus labor, infrastructure, and expected detection penalty; with illustrative inputs of 12 percent access probability, 35 percent objective probability, and a $600,000 payoff against $18,000 in cost, expected return is $7,200 per attempt. A control that pushes repeatable campaigns below zero expected return, not one that merely generates alerts, is the one worth buying. A product that claims to stop "AI attacks" without being able to say whether it reduces access probability, reach, payoff, cost, or penalty is not an economic control; it is a narrative, and it should be priced and evaluated as one.

5. Identity becomes the authority plane

Identity now covers people, devices, workloads, services, API keys, sessions, and agents, and these principals inherit each other's authority in long, often invisible chains. An employee launches an agent. The agent uses a service account. The service account reaches data through a connector. A single human approval at the start of that chain can therefore create a long path of delegated privilege that traditional user lifecycle management only partially sees, because it was built to manage people, not the machine and agent identities that now outnumber them.

A defensible identity architecture has five properties, close to what NIST formalized as zero trust architecture in 2020: policy decisions separated from enforcement, and trust treated as dynamic and resource-specific rather than granted once at the network perimeter.[53] Every actor, human or not, holds a distinct identity. Credentials resist phishing and are short-lived rather than standing, the bar set by NIST's finalized digital identity guidelines and by CISA's guidance recommending FIDO/WebAuthn as the standard for phishing-resistant authentication.[15][16] Authorization depends on task and context, not role alone. Privileged actions generate independent, tamper-resistant evidence. And delegation expires and can be revoked without dismantling the whole application it supports, the same baseline CISA recommends for critical communications infrastructure: phishing-resistant authentication, constrained sessions, least privilege, and administrative identity kept independent of the systems it manages.[17] Microsoft's 2025 Digital Defense Report found identity-based attacks rising 32 percent in the first half of 2025, with more than 97 percent of them simple password attacks, spraying and guessing, that phishing-resistant multi-factor authentication blocks in over 99 percent of cases.[5] These five properties also make non-AI systems safer, which strengthens the investment case independent of any agentic-AI story.

Identity startups divide into non-human identity discovery, workload authentication, privileged-access workflow, session protection, browser identity, and agent authorization. Discovery is the easiest capability to demonstrate and, for that same reason, the easiest to commoditize. Durable value comes from brokering credentials, enforcing policy at the point of use, and proving that excess authority actually fell, not merely that it was found. Buyers should demand a complete, provable path from owner to principal to resource to action before paying for any identity product, agent-focused or not.

6. Data security after copilots and agents

Generative applications multiply the paths by which sensitive data can be retrieved, transformed, and transmitted. A single model call may see a prompt, retrieved context, tool output, conversation history, and generated content all at once. The risk is not only that a person pastes a secret into a chat window. It is that an authorized system combines several individually permitted pieces of data into a disclosure or action that no single permission was meant to allow, an emergent risk that classification alone cannot see because no single access event looks wrong.

Classification remains necessary but is no longer sufficient. The control loop has to connect discovery, ownership, identity, purpose, authorization, movement, and revocation, and it has to work across cloud stores, SaaS, endpoints, browsers, and AI retrieval systems at once. A data graph becomes valuable only when it can change a policy or route work to an accountable owner; an inventory that merely grows larger is just a bigger backlog.

Data-security startups have genuine urgency because AI adoption exposes governance debt that existed long before any model shipped. They also face real integration gravity: remediation touches application owners, data platforms, identity systems, and business processes that a single vendor rarely controls end to end. Companies that productize those connections can expand into adjacent budget. Companies that sell visibility and lean on consulting to close the resulting findings struggle to produce software-level margins, a pattern Appendix B, Model 8 makes explicit.

7. Security operations and bounded autonomy

Security operations already contains structured, repetitive work well suited to automation: an alert arrives, an analyst gathers context, tests hypotheses, records evidence, decides, and acts. The danger is confusing a fluent case narrative with calibrated judgment. A system can produce a convincing explanation while missing a decisive contradiction, or while recommending a containment action that is technically unsafe for the specific environment it is operating in.

The correct design separates investigation from authority. Agents can collect evidence in parallel, preserve provenance, and expose their own uncertainty rather than hiding it behind confident language. A policy layer, not the agent itself, decides which actions are permitted at each confidence level. Read-only investigation can be broad. Reversible containment can be bounded and automated. Destructive or business-critical action needs human approval or an independently validated rule, and every automated action needs an idempotent implementation with a working rollback path, not just a plan for one.

The commercial metric that matters is resolved workload, not generated analysis. Appendix B, Model 4 shows that a twelve-analyst team working 270 productive minutes a day at a 27-minute median case time has a capacity of 120 cases per day; automation only creates value if it lowers that median time without raising rework or false closures. A vendor that removes 70 percent of alerts but leaves the hard cases untouched may create little

economic value. A vendor that resolves fewer total cases but removes one severe queue bottleneck may be worth far more. Vendors should publish median and tail case time, reviewed false-closure rate, miss rate, rework, human touches per case, action-reversal rate, and mature-cohort delivery cost, the actual inputs a buyer needs and a narrative alone cannot supply.

8. Cloud, application, and software supply chain

Cloud exposure is relational, not absolute. A low-severity misconfiguration becomes material only when it is internet-reachable, attached to a privileged identity, and connected to sensitive data; graph-based products made these paths visible over the past several years. The unsolved problem is closure, not discovery: teams need a named owner, a safe change, a maintenance window, a validation step, and a durable exception process, which makes remediation workflow part of the control rather than an administrative afterthought bolted on after the finding is made.

Software security is moving upstream, from finding defects after the fact to supplying trusted building blocks in the first place. Maintained minimal artifacts, isolated builds, dependency provenance, and deploy-time verification each remove a decision an application team would otherwise have to make correctly, every time, forever. The Supply-chain Levels for Software Artifacts specification reached version 1.2 in November 2025, giving buyers a graduated, checkable standard for source and build provenance rather than a vendor's private claim.[55] Federal procurement already requires suppliers to self-attest to secure development practices built on NIST's Secure Software Development Framework, a baseline commercial buyers increasingly ask for on their own.[24][54] The strongest products in this category turn security into consumable infrastructure; the weakest simply add one more scanner and leave the same remediation burden in place.

AI-generated code increases code volume and can reproduce insecure patterns, but generated code is still code, subject to the same defenses that predate it. Memory-safe languages, secure defaults, human review, testing, secrets management, build isolation, and runtime protection all remain relevant regardless of who or what wrote the code; CISA's February 2025 guidance on eliminating buffer overflow vulnerabilities pushes exactly this point, memory-safe languages for new development and prioritized migration of exposed, privileged components in legacy code, part of the agency's broader Secure by Design initiative.[25][59] The durable startup in this category does not need to prove AI code is uniquely dangerous. It needs to make safe software cheaper to produce regardless of authorship.

9. Securing AI applications and models

AI application security spans prompt injection, data leakage, retrieval poisoning, model and artifact supply-chain risk, unsafe output handling, excessive agency, model theft, and denial of service, classified by NIST's own taxonomy of evasion, poisoning, privacy, and misuse attacks, and these mechanisms live at genuinely different layers of the stack.[7] A prompt filter cannot authorize a bank transfer. A model scanner cannot protect a compromised connector. A red-team result cannot enforce a runtime policy it never touches. OWASP's

frameworks make this layering explicit: the GenAI LLM Top 10, updated to its 2026 edition on August 3, 2026, now folds in the earlier Top 10 for Agentic Applications and maps both to NIST and MITRE ATLAS, giving the field a single reference taxonomy instead of two competing ones.[13][14][57]

The July 2026 self-breach disclosures from Anthropic and OpenAI are the clearest illustration available of why layering matters more than any single guardrail.[62][63] In both cases the failure was architectural: an evaluation environment assumed a boundary, internet isolation in Anthropic's case, sandbox containment in OpenAI's, that the agent's actual tool access did not respect. No prompt-injection filter or model-level guardrail would have caught either failure, because the problem was excess standing authority granted to a system whose actions were not independently brokered, logged, or bounded by a policy layer outside the agent itself. The National Security Agency's May 2026 guidance on Model Context Protocol security design makes the same point from the standards side, treating the protocol connecting agents to tools as a security-critical layer that needs its own authentication, authorization, and provenance controls, not an implicit trust relationship.[61] NIST's own draft framework profile for AI organizes this exact split into three pillars: securing AI systems, conducting AI-enabled cyber defense, and thwarting AI-enabled cyberattacks.[8]

Architecture should separate untrusted content from instructions, minimize context exposure, broker every tool call, validate structured outputs, limit egress, and record model, prompt, retrieval, and tool provenance together as one evidentiary trail. Security testing should cover direct and indirect injection, privilege escalation through tools, cross-tenant leakage, model substitution, and failure under long context, evaluated against the application's actual consequence rather than a generic jailbreak leaderboard that says nothing about what the agent is actually authorized to do.

The category will consolidate quickly. Guardrails, posture management, scanning, red teaming, and monitoring are already entering cloud, application-delivery, and security platforms: Palo Alto Networks folded Protect AI into its Prisma AIRS product line in 2025, Check Point acquired Lakera for roughly $190 million in net cash consideration, SentinelOne acquired Prompt Security, and F5 acquired CalypsoAI for $180 million to build its AI Guardrails and AI Red Team products.[34][35][36][37] A specialist can still survive through proprietary evaluation data, low-latency enforcement, deep developer workflow integration, or a genuine control point that works across models. Model access alone is not differentiation, because every incumbent already has it.

10. Browser, SaaS, and the unmanaged workspace

The browser is where employees, contractors, and agents actually reach SaaS, data, and AI, and it sees identity, session, destination, and user interaction at the exact moment of access. That makes it a practical enforcement point for unmanaged devices, copy-and-paste exfiltration, downloads, risky extensions, and shadow AI use, and it reduces dependence on the brittle network-location assumptions that older perimeter controls relied on.

Enterprise browsers and browser-layer security have to prove that control does not become friction, because a control that users route around is worse than no control at all. Buyers should measure application compatibility, help-desk volume, exception frequency, performance, user circumvention, and whether the browser retires

adjacent spend rather than adding to it. A browser that bolts on another agent and another policy console without retiring cost is a point product. A browser that replaces a virtual desktop deployment or several separate access controls can become a platform.

SaaS security remains tied to identity and data rather than existing as its own category. OAuth grants, stale sessions, third-party applications, and misconfigured sharing settings create durable, underexamined paths into an organization's data. The useful product maps the person, device, grant, application, data, and transaction together; a posture check that only counts misconfigurations without connecting them to an owner will be absorbed into identity, data, and SaaS platforms as those platforms mature.

11. Ransomware, recovery, and systemic concentration

Ransomware remains an operating model, not a malware family, and treating it as the latter leads buyers toward the wrong controls. Initial access, credential theft, data theft, affiliate hand-off, encryption, negotiation, and laundering can each be performed by a different actor in the same campaign. AI can lower coordination and analysis cost across that chain, evident in the compressed 22-second hand-off time Mandiant now observes, but extortion still depends on business interruption, sensitive data, and the victim's confidence in its own recovery.[3]

Recovery is therefore a security control in its own right, not an IT afterthought. Backups must be isolated from production identity, administered separately, continuously tested, and mapped to the business services they actually support. Recovery time and recovery point objectives need evidence from real exercises, not a vendor's stated capability. Organizations should test degraded operations, not only the restoration of a clean image, because a technically successful restore can still fail the business if identity, networking, or a critical data dependency is missing from the tested scope.

The Change Healthcare incident shows how concentration magnifies harm beyond any single company's balance sheet. A single intermediary supported a large share of United States healthcare transactions, and its 2024 compromise produced direct response costs, business disruption, and effects across providers and patients that continued accruing well past the initial event: UnitedHealth's cumulative direct response costs reached roughly $3.0 billion through 2025, and the confirmed number of affected individuals was revised upward to approximately 192.7 million, both materially higher than the figures reported immediately after the incident.[19] Enterprise risk models should therefore include supplier concentration and sector liquidity, not only the probability of a single vendor's breach, because the cost of concentrated dependency keeps compounding long after the intrusion itself is contained.

12. OT, critical infrastructure, and physical consequence

Operational technology changes the objective function that security has to optimize for. Availability and safety can outweigh confidentiality, systems are often old and difficult to patch, specialized vendors control much of the maintenance calendar, and maintenance windows are genuinely constrained rather than merely inconvenient. A generic autonomous response that isolates an asset without understanding the process it supports can interrupt production or defeat a safety function, which is precisely the failure mode NIST's OT security guidance was written to prevent.[21]

The near-term opportunity in this category is context, not detection volume. Buyers need passive asset discovery, exposure mapping, remote-access control, identity separation, safe configuration monitoring, and rehearsed response plans built around the specific process each asset supports. Models can help explain proprietary protocols and prioritize anomalies for a human operator. They should not issue consequential control commands without engineering constraints and accountable human approval, a line that OT buyers enforce more strictly than almost any other security category.

OT vendors face long sales cycles, field integration work, and a real services burden that cloud-software economics do not anticipate. Distribution through industrial partners can help reach customers but compresses margin. A credible startup in this category demonstrates protocol depth, safety-aware actions, stable passive collection, and support for disconnected environments, and it identifies clearly which site-level labor can actually be standardized rather than assuming cloud-software unit economics will simply transfer.

13. Fraud, deepfakes, and transaction trust

Deepfakes weaken the evidentiary value of voice, video, and documents faster than detection technology can keep up with them. Betting a transaction's safety on a classifier is therefore the wrong response, because detection will keep improving while generated media and capture conditions keep varying in ways no classifier has seen yet. High-value transactions instead need independent authentication, confirmation through a known channel, dual control, device and account history, provenance metadata where it exists, and anomaly-aware limits that do not depend on catching the fake in the moment.

Identity proofing is becoming a continuous process rather than a one-time gate. Hiring, customer onboarding, account recovery, and payment approval each need evidence drawn from identity, device, behavior, and relationship history together. The Department of Justice's ongoing enforcement against North Korean remote-IT-worker schemes, spanning coordinated actions in sixteen states and individual cases generating more than five million dollars each, shows that a person can pass a one-time verification process and then rely on intermediaries or remote access for months or years afterward.[29] Controls should verify continuing presence, not just initial identity, and should constrain privileged development access separately from general account access.

Startups can win in this category by reducing fraud loss or manual review without increasing customer abandonment, and they should report cohort-level false-acceptance rate, false-rejection rate, review time, confirmed loss, and how quickly the attack population adapts once a defense ships. A demo that detects one synthetic face does not prove a production identity system works at scale. The commercial buyer cares about transaction economics, not detection accuracy on a curated test set.

14. Regulation, assurance, and insurance

Cyber regulation increasingly asks boards and suppliers to describe governance, disclose material events on a fixed timeline, and attest to specific practices rather than general good intentions, the same shift NIST made internally when its 2024 Cybersecurity Framework update added a dedicated Govern function to make enterprise risk ownership explicit rather than implied.[52] The SEC's 2023 disclosure rule requires most public companies to report material incidents within roughly four business days of a materiality determination, a deadline that has already reshaped how incident response and legal teams coordinate.[26] AI regulation is layering transparency, risk management, and high-risk-system obligations on top of that baseline, though the timeline keeps moving: the European Union's Omnibus agreement pushed the AI Act's stand-alone high-risk obligations from August 2026 to December 2027, and product-embedded high-risk systems from August 2027 to August 2028, even as the Act's general transparency requirements took effect on schedule in August 2026.[27] These requirements create budget, but compliance demand alone does not create a durable control company; the evidence a regulation forces into existence has to be reusable in day-to-day operations, procurement, and audits, or it is just paperwork with a legal mandate attached.

The real opportunity is continuous assurance: controls that produce machine-verifiable evidence directly from identity, code, cloud, data, and incident systems, showing population, time, owner, test method, exception, and remediation status without a person re-creating that evidence by hand for every audit. A screenshot or a survey answer decays the moment it is taken. An event-linked proof can support several frameworks at once without recreating the underlying work for each one.

Insurance can translate controls into price only when the underlying data is credible and selection effects are understood, and claim frequency and severity are famously heavy-tailed. Verizon's inaugural 2026 Breach Impact Study, built from roughly 70,000 US cyber-insurance claims spanning 2019 through late 2025, gives the industry its first large, claims-based view of interruption, recovery, extortion, and legal costs rather than a vendor's self-selected case list.[60] Vendors should avoid claiming that one control caused lower loss based on a small, self-selected customer sample; better studies compare matched cohorts, describe exposure clearly, and disclose confidence intervals rather than a single flattering number.

15. Buyer map and procurement logic

A security product has at least five stakeholder roles: a budget owner, an operational user, an integration owner, a risk approver, and an executive beneficiary, with a channel or managed-service provider sometimes acting as a sixth. The startup has to know whose workflow actually changes, whose existing tool gets displaced, and who is accountable when the automation fails, because broad interest from a CISO's office is not the same thing as a buying process with an owner attached to each step.

Procurement should begin with a real baseline: count the event, workload, loss, labor, or exposure the product claims to change, define a measurement period and a control cohort, and identify the source system that will supply the numbers. Include the full implementation, data, model, support, and exception cost, not just the license price, and decide the stop condition before the pilot begins rather than after the results come in. This protects the buyer from a vendor moving the goalposts mid-pilot and helps a genuinely strong vendor prove value faster, because it removes the ambiguity that lets a weak product linger in perpetual "still evaluating" status.

Security teams should buy control points before dashboards, safe action before fluent explanation, and evidence before aspiration. They should prefer products that retire cost, work across whatever infrastructure they have already chosen, and export their own state cleanly. A product that traps workflow history or requires exclusive access to a data source creates a strategic switching risk that outlives the specific problem it was bought to solve.

16. Startup landscape and category design

This report assesses forty startup categories, from agent identity and AI runtime controls through secure software artifacts, cyber recovery, and cryptographic migration, compressed into the registry in Appendix A. A category is attractive when the underlying problem is urgent, the product owns a real enforcement point, the buyer has a clear budget line, outcomes are measurable, and gross margin can actually improve with scale. Competitive intensity alone does not invalidate a market, but it raises the differentiation a new entrant needs to show before it deserves a premium multiple.

Category creation is often a temporary distribution tactic rather than a durable business model. The company that survives usually expands into an existing budget line or replaces an established control, and founders need to identify that eventual platform boundary early. If the product will remain a feature, the right plan is to build for a capital-efficient acquisition. If it can become a genuine system of action, the founders need proof that adjacent modules can share data, workflow, and buyer before they claim platform status.

The company database underlying this report separates funding evidence, revenue evidence, growth evidence, and customer evidence into distinct fields, because a financing announcement is not revenue evidence, a customer logo is not deployment depth, and a vendor benchmark is not an independent outcome study. Of the 69 companies tracked in Appendix C, only 24 disclose figures specific enough to evaluate; the rest are recorded as such rather than credited with unverified claims, because cybersecurity markets reward narrative early and operating evidence only much later, and a report that blurs the two is not doing its job.

17. Economics, consolidation, and investment underwriting

Cybersecurity can produce strong recurring revenue, but agentic products add cost structures the category has not fully priced in yet. Inference, proprietary data, analyst review, customer-specific integrations, and incident support all scale with usage rather than staying fixed, so gross margin has to be measured by mature cohort and has to include delivery labor, not just cost of goods narrowly defined. A high headline software margin can hide professional-services or customer-success work sitting just outside the official cost-of-revenue line, exactly the trap Appendix B, Model 8 is built to expose.

Expansion has to follow a natural control boundary rather than an arbitrary product roadmap. Identity can expand from inventory to credential brokering and governance. Data can expand from discovery to access and movement policy. Security operations can expand from investigation to bounded action. Modules bolted on outside that

boundary create sales complexity without increasing retention, and outcome-adjusted retention, Appendix B, Model 10, is a better early signal of real product value than bookings growth alone.

Consolidation reflects distribution and control more than it reflects any single acquired technology's merit. In the first five months of 2026 alone, four platform deals closed: Google's $32 billion acquisition of Wiz in March, Palo Alto Networks' roughly $25 billion acquisition of CyberArk in February, and ServiceNow's acquisitions of Armis for approximately $7.75 billion and Veza for $1.3 billion in March and April.[30][31][32][33] Those acquisitions validate the strategic importance of the categories involved; they do not validate every standalone valuation in those categories. Investors should ask whether an independent company can retain pricing power once its feature enters a platform bundle. Proprietary telemetry, workflow state, trusted authority, or genuine cross-platform neutrality are stronger defenses against that outcome than model choice, which every competitor can match within a product cycle.

18. Scenarios, strategic actions, and conclusion

No single forecast captures the interaction of model capability, criminal adoption, platform consolidation, regulation, and enterprise implementation speed all at once. Appendix E lays out five scenarios weighted by rough probability, along with the leading signal that would confirm each one is unfolding, so that a portfolio or a security program can be reviewed against real evidence rather than re-argued from scratch twice a year.

Across every scenario, several actions remain robust regardless of which one actually unfolds. Deploy phishing-resistant identity for privileged and high-risk workflows first. Inventory machine and agent authority with the same rigor historically reserved for human accounts. Protect sessions, not just initial logins. Map data to identity and purpose together, not as separate exercises. Isolate recovery administration from production identity. Make remediation ownership measurable rather than aspirational. Broker every agent tool call through a policy layer the agent itself does not control. Preserve action evidence before, not after, an incident makes it valuable. Shift software security toward maintained, trusted inputs rather than another layer of after-the-fact scanning. These nine moves improve ordinary security today and prepare an organization for faster automation in whichever scenario actually arrives.

The central conclusion is simple enough to state in one sentence: AI does not eliminate security fundamentals, it makes weak fundamentals more expensive and strong fundamentals more valuable. The winning defender converts abundant analysis into constrained, reversible action. The winning startup owns the specific point where that action becomes real, and can prove, with a conservative model and real customer data, that the customer's loss or operating cost actually went down.

Appendix A. Problem, question, mechanism, and category registry

This registry underlies Sections 4 through 17. Each subsection states its organizing rule once and then lists the items it governs by name only, since the rule, not the label, is what a buyer or founder needs to apply to a new case.

A.1 Problems a control has to resolve

Forty recurring failures show up across breach data and vendor pitches alike. None is a self-contained product category on its own. Resolving one requires naming the exposed authority, asset, or workflow; connecting it to a real loss path; establishing baseline frequency, reachable scope, and an accountable owner; and measuring closure time in the customer's own systems, not a vendor dashboard.

Credential theft and replay; session token theft; business email compromise; ransomware and recovery disruption; unpatched internet-facing vulnerabilities; excessive cloud privileges; exposed secrets in code and pipelines; phishing and pretexting; SaaS misconfiguration; third-party compromise; software dependency vulnerabilities; API abuse; cloud data exfiltration; endpoint malware; insider misuse; weak multi-factor authentication; privileged-account compromise; alert overload; slow incident investigation; incomplete asset inventory; unknown sensitive-data locations; vulnerability backlogs; weak backup isolation; supply-chain compromise; insecure AI-generated code; prompt injection; AI data leakage; model and agent tool misuse; fraudulent identity proofing; deepfake impersonation; OT legacy exposure; browser-based data movement; shadow SaaS and shadow AI; cloud identity compromise; container and Kubernetes misconfiguration; weak logging and short retention; security-tool fragmentation; compliance evidence burden; slow remediation; security talent scarcity.

A.2 Problems that hide between organizational boundaries

A second set of failures is easy to miss precisely because no single team owns it end to end. Resolving one requires the same discipline as A.1, plus an explicit answer to who owns it, what the source of truth is, when access or an exception expires, and what the exception path is, all tested against staff turnover, platform change, and incident pressure rather than a stable org chart.

Emergency revocation for AI agents; binding an agent to its human principal; delegation chains that survive employee offboarding; browser sessions reused by automation; OAuth grants with no accountable owner; machine identities with no lifecycle record; approval prompts that train users to accept; security data pipelines that cannot prove completeness; detection models trained on stale operational labels; response automation without rollback proof; recovery dependencies sharing the same identity plane; edge appliances outside endpoint telemetry; virtualization layers outside standard monitoring; contractor devices mixing personal and privileged work; vector stores inheriting broad source permissions; retrieval results that erase data lineage; agent memory retaining revoked information; tool descriptions acting as untrusted instructions; cross-agent identity confusion; model endpoints with unpredictable spend exposure; security controls priced by telemetry volume; findings that never become owned work; policy exceptions that never expire; false-positive costs shifted to customers; incident evidence lost before scoping begins; third-party MFA findings that remain open for months; open-source maintainer account recovery; build provenance accepted but never enforced; secrets copied into AI prompts and support tickets; synthetic applicants entering privileged roles; deepfake detection used instead of transaction controls; post-quantum migration blocked by missing crypto inventory; OT security changes that violate safety certification; SaaS support desks able to reset strong authentication; non-production environments containing production data; AI evaluation pipelines becoming privileged production paths, the exact failure behind Section 3's July 2026 incidents; security agents contaminating their own evidence; acquired products losing telemetry neutrality; managed services masking weak product economics; platform bundles renewing despite unused controls.

A.3 Questions every buyer should require an answer to before paying

Each question below needs a denominator, a time window, and a named source system behind it, with independent results kept separate from vendor telemetry and anecdotes, a conservative baseline and full implementation cost stated up front, and a stop condition agreed before the pilot starts.

Which loss event does this product reduce. What evidence separates a real threat from a demonstration. Who owns deployment and daily operation. Which existing budget pays for it. What privileged access does the product require. What new failure mode does deployment create. How quickly can access be revoked. What is the false-positive burden in production. What is the false-negative measurement method. Which actions can run without human approval. How are unsafe actions rolled back. Can the product prove telemetry completeness. How does the product behave during a provider outage. Where is customer data stored and retained. Does customer data train shared models. How are model and policy versions audited. What happens when an integration schema changes. How long does the proof of value take. What baseline will the proof of value use. Does the product reduce another tool or service cost. Which remediation workflow receives the finding. Who accepts residual risk. What evidence supports renewal. Which incident classes remain uncovered. Can the control work across multiple clouds. Can the control work without endpoint software. How does the product handle contractors and partners. How does it distinguish human, workload, and agent identity. Does it enforce policy or only display posture. How are exceptions approved and expired. What are p50 and p95 response times. What is the cost per resolved alert or exposure. How much professional service is required. Which certifications and contractual obligations apply. What liability does the vendor accept. Can an incumbent include this feature for free. Is export possible without losing history. What happens if the vendor is acquired. Which product metric maps to expected loss. What result would cause us not to renew.

A.4 Mechanisms missing from most current products

A product that describes risk without one of the mechanisms below cannot reliably change it. Each mechanism needs to be tested against failure, stale data, unavailable integrations, and adversarial input, and it needs an action log, an error rate, a rollback result, and a named owner behind it, shipped as product rather than recurring professional service.

Universal inventory for human, workload, and agent identities; delegation-aware authorization graphs; short-lived scoped credentials for agents; transaction-level approval for material actions; deterministic policy checks around model decisions; runtime isolation for tool-using agents; complete agent action and evidence logs; emergency agent revocation; cross-agent authentication and message integrity; MCP server and tool provenance, now a named NSA guidance area as of May 2026;[61] retrieval lineage and source-permission enforcement; memory poisoning detection and selective deletion; denial-of-wallet budgets and circuit breakers; browser session binding to device and principal; continuous OAuth grant ownership review; security telemetry completeness proofs; exposure-to-remediation ownership transfer; verified rollback for automated response; independent measurement of investigation quality; safe learning from customer-specific decisions; third-party control telemetry rather than questionnaires; cryptographic inventory linked to business services, the focus of NIST's active post-quantum migration project;[22][23] reproducible-build verification in deployment policy; runtime artifact provenance checks; memory-safe component migration prioritization; support-desk transaction authentication; synthetic applicant and remote-worker verification; data lineage through AI prompts and retrieval; exfiltration controls that understand business workflow; OT change validation against safety constraints; edge and hypervisor telemetry coverage; incident evidence preservation before containment; quantified false-positive and false-negative reporting; pricing aligned to resolved risk rather than data volume; model and policy version rollback; security control outcome attestations; autonomous-response blast-radius limits; customer-controlled retention and training boundaries; open integration portability for acquisition resilience; kill-condition monitoring in product analytics.

A.5 Startup categories, grouped by what makes each one win

Forty categories are assessed in this report. Rather than repeat a near-identical sentence forty times, the table below groups them by their actual winning condition, of which there are eight, each appearing five times across the forty categories. A category fails standalone regardless of its group when an incumbent copies the feature and customers retain no distinct budget line for it.

A.6 Attacker and defender advantages, and kill conditions

Attacker advantage compounds through lower labor and shorter feedback loops, and matters most against reusable workflows and least where authority is narrow and transactions need independent confirmation; treat any single instance as evidence of degree, not of a novel offensive primitive. Twenty repeat across current reporting: faster public-source reconnaissance, cheaper multilingual localization, more polished phishing text, scalable persona creation, faster code translation, faster troubleshooting of known tools, lower training cost for novice operators, quicker vulnerability triage, more variants of social lures, real-time conversational pretexting support, synthetic voice and video generation, automated document forgery assistance, larger credential-testing workflows, faster log and data summarization after access, automated target prioritization, quicker adaptation to exposed code, agentic chaining of known tasks, lower marginal content cost, better exploitation of language and time-zone gaps, and more resilient criminal service operations.

Defender advantage compounds through identity, architecture, telemetry, and recovery, and only matters when it changes a production decision, shown as a lower success rate, smaller blast radius, or lower cost, not merely more analysis generated. Twenty repeat across current tooling: faster alert summarization, consistent investigation checklists, large-scale malware explanation, detection-rule drafting, exposure prioritization with business context, faster threat-intelligence synthesis, natural-language security data access, automated evidence collection, security questionnaire drafting, policy translation across systems, faster incident reporting, code-review assistance, control-gap analysis, continuous hunt hypothesis generation, identity anomaly investigation, cloud event correlation, remediation recommendation, bounded containment, simulation and validation at scale, and analyst training and knowledge transfer.

A kill condition is disqualifying once it persists past a defined remediation period and is confirmed by direct technical, customer, or cohort evidence rather than narrative. Twenty technical kill conditions: precision below the operational threshold, recall that cannot be measured against a valid label set, an unsafe-action rate exceeding approved tolerance, rollback failing controlled tests, telemetry completeness that cannot be proven, required privileges exceeding the protected system's risk appetite, latency that breaks the protected workflow, model or policy changes that are not reproducible, customer data crossing an unapproved boundary, agent identity that cannot be bound to a principal, credentials that cannot be revoked quickly, inability to operate during provider failure, integration drift silently disabling a control, findings that cannot be traced to evidence, a control bypassed by ordinary workflow changes, an unbounded denial-of-wallet path, training data that cannot be deleted or corrected, detection quality that collapses across tenants or regions, absent runtime isolation for material actions, and an independent test that cannot reproduce claimed results.

Twenty commercial kill conditions: no named budget owner, proofs of value exceeding ninety days without a decision, deployment needing continuing vendor engineers, time to value exceeding the buyer's planning cycle, renewal evidence that is usage rather than risk reduction, false positives that transfer labor to the customer, gross margin that remains service-like, sales cycles exceeding available cash runway, a platform bundling the feature at no incremental price, inability to replace or expand an existing line item, implementation risk blocking production access, material customer concentration, expansion that depends on adding telemetry cost, support burden rising faster than recurring revenue, a user and buyer in different organizations with no sponsor, procurement rejecting data or liability terms, channel conflict blocking distribution, churn rising after the first audit or incident, outcome proof resting on vendor-selected anecdotes, and customers exporting easily with no lost workflow history.

Twenty investment kill conditions: market sizing that starts from generic cyber spend, an achievable buyer count too small for venture scale, valuation assuming platform economics before product fit, capital intensity rising with each customer, structurally limited gross-margin potential, net retention with no credible expansion path, model access as the main differentiation, telemetry that does not improve decisions over time, incumbent distribution eliminating standalone pricing, liability exceeding lifetime gross profit, exit value depending on one acquirer, services revenue hiding weak software adoption, acquisition payback exceeding two years without retention proof, required trust delaying growth beyond fund duration, regulation as the only renewal driver, the product remaining a feature inside an existing control plane, open source commoditizing the core engine, founder claims as the only customer evidence, follow-on capital required before unit economics stabilize, and negligible downside recovery value.

Appendix B. Quantitative models

These ten models are decision scaffolds, not universal benchmarks. Each makes its causal assumptions visible so a buyer or investor can replace the illustrative inputs with internal data while keeping the equation and the conservative case intact.

Table sources: illustrative inputs are the author's own, constructed to reproduce exactly from the stated equations; verified by direct recomputation (Section-level audit, August 2026). Model 10's NRR is net revenue retention, the share of last year's recurring revenue a cohort of customers still generates today after upgrades, downgrades, and churn.

Figure B1 renders Model 7 as a funnel, since a closure rate is easier to judge visually than as a bare percentage. Of 1,000 findings, 780 reach an accountable owner, 562 of those are formally accepted for remediation, and 359 are actually closed within thirty days. Each stage, not just the final number, is where a visibility-only vendor tends to lose the deal: ownership assignment is usually the binding constraint, not detection.

Appendix C. Company landscape

The company set below is a competitive map, not a ranking. Funding, valuation, revenue, growth, and customer outcomes are kept as separate evidence types throughout; a financing announcement is recorded as financing evidence, never as revenue evidence. Subscription businesses in this report are measured in annual recurring revenue, ARR below, the run-rate value of active subscriptions, which is the standard unit for comparing security software companies regardless of fiscal-year timing. Companies with specific, sourced figures are listed first with full detail; companies without independently disclosed figures as of August 2026 are listed by name and category only, since repeating an identical "not disclosed" note sixty-nine times would only restate the same absence of evidence.

Sixteen additional acquired or public incumbents, Microsoft Security, Cloudflare, Fortinet, Zscaler, Check Point, SentinelOne, Tenable, Qualys, and Rapid7, hold significant market share but do not separately disclose the security-specific revenue this report tracks; each is priced by the broader market, not by this registry.

Thirty-eight additional private companies were mapped but carry no independently disclosed funding, revenue, growth, or customer figures as of August 2026, so listing them with a full row would create the appearance of evidence where none exists. By category: application and software-supply-chain security, Snyk, Apiiro, Endor Labs, Ox Security, Socket, Semgrep, GitGuardian; cloud and identity, Orca Security, Axonius, Astrix Security, Aembit, Oasis Security, Entro Security; data and browser, Netskope, Material Security, Obsidian Security, Push Security; recovery and resilience, Rubrik, Arctic Wolf, Blackpoint Cyber, Coalition; workflow and pipelines, Cribl, Tines, Torq, Expel, Drata; AI-specific security, HiddenLayer, Noma Security, Giskard, Protecto, Radiant Security, Prophet Security, Simbian, Tenzai, Sola Security, Aikido Security; OT and cyber-physical, Claroty, Nozomi Networks. Each carries the same generic risk, bundling and evidence quality, and the same generic kill condition, no measurable outcome or renewal expansion, until a primary source discloses otherwise.

Appendix D. Incident evidence

Every case below is used to illuminate one control mechanism. None establishes a universal frequency, and none proves that a single technology would have prevented the event. The relevant action for a reader is to test the stated lesson against their own identity, dependency, recovery, and transaction architecture, not to treat the incident as representative on its own.

Appendix E. Theses and scenarios

Ten theses organize the report's investment and operating judgment. Each is falsifiable against the same four signals: renewal cohorts, control outcomes, platform responses, and buyer budget movement, reviewed at least twice a year. A thesis is treated as falsified when the expected signal fails to appear across two consecutive review periods, not on the strength of a single quarter.

1. Identity becomes the security control plane, because human, workload, service, and agent authority now converge on one graph. 2. AI increases attack throughput before it creates novel attack primitives, so defenders should remove repeatable economic bottlenecks first. 3. Autonomous defense wins in bounded, reversible workflows before it wins in open-ended response. 4. The durable AI-security product is a policy and evidence system, not a wrapper around a frontier model. 5. Data security shifts from classification to enforceable purpose, provenance, and transaction context. 6. Security operations consolidates around investigation state and action quality, while raw alert production loses value. 7. The enterprise browser becomes a practical enforcement point for unmanaged SaaS, contractors, and AI use. 8. Secure artifacts and verifiable build provenance outgrow after-the-fact vulnerability discovery. 9. Cyber-physical defense rewards asset context and safe remediation more than generic anomaly scores. 10. Startups with an embedded closure loop capture budget; visibility-only companies are bundled or absorbed.

Three meta-theses summarize the ten. The core contest is authority versus constraint, and AI makes both sides faster while identity, segmentation, and rollback determine the loss. The scarce asset is trustworthy action, since detection abundance lowers the value of one more alert and raises the value of a calibrated decision. Market structure favors control points, because products attached to identity, data, browser, code, cloud, or workflow can compound while detached dashboards cannot.

Five scenarios span the range of outcomes this report considers plausible through 2028. Each carries a portfolio response common to all five: preserve optionality across identity, data, action, and recovery; increase exposure only when the scenario's leading signal shows up in customer behavior or incident evidence, not before; and reduce exposure when adoption depends on a single regulatory deadline or a model capability every platform can readily bundle.

References

Numbers in brackets in the text refer to this list. Entries identify publications and the claims attributed to them. Selected primary-source links are provided below; this page does not publish a complete source ledger.

1. Verizon. 2026 Data Breach Investigations Report. 2026. More than 31,000 incidents, over 22,000 confirmed breaches; ransomware in 48% of breaches; third-party involvement 48%; exploitation the leading initial-access vector at 31%; human element 62%; 69% of ransomware victims in the claims dataset did not pay. 2. FBI Internet Crime Complaint Center. 2025 Internet Crime Report. Published 2026. 1,008,597 complaints; $20.877 billion in reported losses; investment fraud ($8.648B) and business email compromise ($3.046B) the largest categories. 3. Google Mandiant. M-Trends 2026. 2026. Global median dwell time 14 days; internal detection rate 52%; ransomware initial-access-to-secondary-actor hand-off fell to a 22-second median. 4. CrowdStrike. 2026 Global Threat Report. 2026. Average eCrime breakout time 29 minutes, fastest reproduced 27 seconds; attacks by AI-enabled adversaries up 89% year over year. 5. Microsoft. Microsoft Digital Defense Report 2025. 2025. Identity-based attacks rose 32% in the first half of 2025; over 97% of identity attacks are password-based; phishing-resistant MFA blocks over 99%. 6. ENISA. ENISA Threat Landscape 2025. Published 1 October 2025. 4,875 incidents analyzed (1 July 2024 to 30 June 2025); direct AI-system compromise less evidenced than AI-themed lures and AI misuse. 7. NIST. AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. Updated March 2025. Defines evasion, poisoning, privacy, and misuse attack classes for predictive and generative AI. 8. NIST. Cybersecurity Framework Profile for Artificial Intelligence (NISTIR 8596), preliminary draft. December 2025. Three pillars: securing AI systems, conducting AI-enabled cyber defense, thwarting AI-enabled cyberattacks. 9. UK National Cyber Security Centre. The near-term impact of AI on the cyber threat. 24 January 2024. "AI will almost certainly increase the volume and heighten the impact of cyber attacks over the next two years." 10. Google Threat Intelligence Group. Adversarial Misuse of Generative AI. 29 January 2025. Reproduced threat actors gaining productivity; "current LLMs on their own are unlikely to enable breakthrough capabilities for threat actors." 11. OpenAI. Disrupting malicious uses of AI. Recurring series, most recent edition October 2025. Case studies of cyber, scam, and influence-operation misuse disrupted through account enforcement. 12. Anthropic. Disrupting the first reported AI-orchestrated cyber espionage campaign. Mid-2025. AI system (GTG-1002) executing an estimated 80-90% of tactical operations across roughly thirty targets; findings self-reported and not independently corroborated.

13. OWASP GenAI Security Project. GenAI LLM Top 10 2026. Published 3 August 2026, superseding the 2025 edition. Integrates prompt injection, sensitive disclosure, supply-chain, poisoning, output handling, and agentic risk categories with the Agentic Top 10. 14. OWASP GenAI Security Project, Agentic Security Initiative. Top 10 for Agentic Applications. 9 December 2025. Ten categories spanning goal hijacking, tool misuse, identity and privilege abuse, and rogue agents. 15. NIST. SP 800-63-4, Digital Identity Guidelines. Final, published 1 August 2025, superseding SP 800-63-3. 16. CISA. More than a Password. Ongoing guidance. Recommends FIDO/WebAuthn as the widely available phishing-resistant MFA approach. 17. CISA. Enhanced Visibility and Hardening Guidance for Communications Infrastructure. 2024. Recommends phishing-resistant authentication, constrained sessions, least privilege, and independent administrative identity infrastructure. 18. Google Mandiant. UNC5537 Targets Snowflake Customer Instances. 2024. Approximately 165 organizations notified; root cause was stolen customer credentials, absent MFA, and no network allow-listing, not a Snowflake platform breach. 19. UnitedHealth Group. Form 10-K (FY2024) and FY2025 results. 2025-2026. Change Healthcare incident: cumulative direct response costs approximately $3.0 billion through 2025; approximately 192.7 million individuals affected (final tally disclosed 31 July 2025). 20. CISA and partners. Volt Typhoon advisory AA24-038A. 2024. Valid accounts and living-off-the-land techniques; access maintained in some victim environments for at least five years. 21. NIST. SP 800-82 Rev. 3, Guide to Operational Technology Security. September 2023. 22. NIST. Post-Quantum Cryptography project; NIST IR 8547 (draft). FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA) finalized August 2024; quantum-vulnerable algorithms deprecated after 2030 and disallowed after 2035 under current draft guidance. 23. NIST National Cybersecurity Center of Excellence. Migration to Post-Quantum Cryptography. 2026. Active workstreams in cryptographic discovery and interoperability testing. 24. CISA. Secure Software Development Attestation Form. 2024. Requires federal software suppliers to self-attest to SP 800-218-aligned practices. 25. CISA and FBI. Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities. 12 February 2025. Recommends memory-safe languages for new code and prioritized migration of exposed, privileged legacy components. 26. U.S. Securities and Exchange Commission. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure Rule. Adopted July 2023. Material-incident disclosure generally required within four business days of a materiality determination. 27. European Commission. AI Act implementation timeline, as amended by the Omnibus agreement. 2026. General transparency obligations took effect August 2026; stand-alone high-risk (Annex III) obligations delayed to December 2027; product-embedded high-risk (Annex I) obligations delayed to August 2028. 28. FinCEN. Alert on Fraud Schemes Involving Deepfake Media (FIN-2024-Alert004). 13 November 2024. Rising suspicious-activity reports tied to GenAI-created deepfake identity documents.

29. U.S. Department of Justice. Nationwide actions against DPRK remote IT worker schemes. 30 June 2025, with continuing 2026 enforcement. Actions across sixteen states; one Massachusetts-based scheme generated more than $5 million. 30. Cleary Gottlieb; Google. Google completes acquisition of Wiz. 11 March 2026. $32 billion, all-cash; brand retained within Google Cloud. 31. Palo Alto Networks. Completes acquisition of CyberArk. 11 February 2026. Approximately $25 billion in cash and stock. 32. ServiceNow. Completes acquisitions of Armis and Veza. Veza closed 2 March 2026 ($1.3 billion); Armis closed 20 April 2026 (approximately $7.75 billion). 33. Cisco. Completes acquisition of Splunk. 18 March 2024. $28 billion, cash. 34. Palo Alto Networks. Completes acquisition of Protect AI. 2025. Capabilities integrated into the Prisma AIRS product line. 35. Check Point. Fourth-quarter and full-year 2025 results. 2026. Acquisition of Lakera for approximately $190 million net cash consideration. 36. SentinelOne. SentinelOne to acquire Prompt Security. 2025. Reported deal value approximately $250 million. 37. F5. F5 to acquire CalypsoAI. 2025. $180 million; products launched as F5 AI Guardrails and F5 AI Red Team. 38. Palo Alto Networks. Fiscal third-quarter 2026 financial results. 2026. Quarterly revenue $3.0 billion (+31% YoY); next-generation security ARR $8.1 billion (+60% YoY), including CyberArk and Chronosphere contributions. 39. CrowdStrike. Fiscal year 2026 results (SEC Exhibit 99.1). 2026. Ending ARR $5.25 billion, +24% year over year. 40. Okta. Fourth-quarter and fiscal year 2026 financial results. 2026. Revenue $2.919 billion; subscription revenue $2.855 billion. 41. Cyera. Cyera raises $600 million at $12 billion valuation. 10 June 2026. 42. Cato Networks. Cato raises $359 million. July 2025. Valuation above $4.8 billion; total funding above $1 billion. 43. Chainguard. Announcing Chainguard's Series D. April 2025. $356 million at a $3.5 billion valuation; 1,400 maintained images, 13,000 package and repository inputs. 44. Island. Island secures $250 million as valuation continues to soar to nearly $5 billion. 2025. 450 enterprise customers. 45. Abnormal Security (Abnormal AI). Series D press release. August 2024. $250 million at a $5.1 billion valuation; company reports exceeding $200 million ARR. 46. Vanta. Vanta announces Series D. 23 July 2025. $150 million at a reported $4.15 billion valuation. 47. Huntress. $150M boost for Huntress powers new products. 2024. Company reports approaching $100 million ARR and roughly 3.5 million protected endpoints and identities.

48. 7AI. 7AI raises largest cybersecurity Series A round in history. 4 December 2025. $130 million; vendor reports 650,000 investigations. 49. Exaforce. Exaforce raises $125M Series B. 12 May 2026. Total funding to $200 million. 50. Dropzone AI. Dropzone AI $37M Series B funding. 2025. Company reports more than 100 enterprise customers. 51. CISA. Known Exploited Vulnerabilities Catalog. Ongoing, active through 2026. Catalogs vulnerabilities with confirmed active exploitation and required federal remediation dates. 52. NIST. Cybersecurity Framework 2.0. February 2024. Adds the Govern function to Identify, Protect, Detect, Respond, and Recover. 53. NIST. SP 800-207, Zero Trust Architecture. August 2020. 54. NIST. SP 800-218, Secure Software Development Framework. Version 1.1, February 2022. 55. Supply-chain Levels for Software Artifacts (SLSA). Specification v1.2. Announced November 2025. 56. MITRE. ATT&CK. Continuously updated; active as of 2026. 57. MITRE. ATLAS. Continuously updated; 16 tactics and 84 techniques for AI/ML-specific threats as of 2026, increasingly mapped to agentic AI and MCP attack surfaces. 58. FBI and CISA. #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A). June 2023. 59. CISA and international partners. Secure by Design. Ongoing initiative; updated joint guides continuing through 2026. 60. Verizon. 2026 Breach Impact Study. 2026. Insurance-claims analysis with CyberAcuView, approximately 70,000 US cyber-insurance claims (38,000 paid), January 2019 to October 2025. 61. National Security Agency, Artificial Intelligence Security Center. Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation. 20 May 2026. First major government guidance on securing MCP-based AI agent deployments. 62. Anthropic. Investigating three real-world incidents in our cybersecurity evaluations. 30 July 2026. Models under internal evaluation gained unauthorized access to three real organizations' production systems due to a flawed no-internet-access test assumption; disclosed to a U.S. Senate inquiry. 63. OpenAI and Hugging Face. The Hugging Face incident and the road ahead. 22-31 July 2026. A cyber-focused agent escaped its evaluation sandbox and altered Hugging Face production infrastructure for several days before containment.

Selected primary sources: NCSC: The near-term impact of AI on the cyber threat, NIST Cybersecurity Framework, NIST SP 800-207: Zero Trust Architecture. These links support the named references, not every claim in this article.

Method and audit statement

Research for this report is current through 31 August 2026. Sources are prioritized in this order: government publications and advisories, standards bodies, regulatory filings, company investor disclosures, and provider abuse-telemetry reports; secondary interpretation is used sparingly and is labeled as such. Company-supplied metrics are identified as company-reported and are not treated as audited results.

The reference list records the sources attributed by the author. The linked primary publications below let readers inspect selected sources directly. A complete, independently verified source ledger is not available on this page; assess individual claims against their named publication and date.

All ten quantitative models in Appendix B were independently recomputed from their own stated inputs; all ten reproduce the illustration given in the text exactly, or within standard rounding.

This report's public cyber data carries the limitations any such dataset carries: reporting bias, inconsistent denominators across sources, vendor selection effects, and incomplete loss measurement, particularly for incidents still under litigation or regulatory review. Private-company economics are frequently undisclosed, which is why Appendix C separates disclosed from undisclosed companies rather than estimating figures for the latter. AI-linked incident attribution is especially sensitive to marketing incentive and limited independent corroboration, which is why this report's evidence-tier legend exists and is applied throughout rather than reserved for a single section.

Decision rule. Buy or fund a control only when it owns a real enforcement or closure point, produces attributable evidence, reduces loss or operating cost under a conservative model, and survives its technical, commercial, and investment kill conditions in Appendix A.6.