AI’s cyber paradox is becoming investable

The week began with a fresh escalation in the debate over frontier artificial intelligence, as warnings about autonomous systems, cyber capability and the prospect of AI operating beyond human control broke out of specialist circles and into markets, policymaking and boardrooms.

Dario Amodei’s call for the industry to slow the development of increasingly capable models, subsequently echoed by OpenAI chief executive Sam Altman and Elon Musk, reframed the familiar AI race. This was no longer solely about who could build the most capable model, secure the largest pool of computing power or capture the greatest share of enterprise spending. It was about whether the world’s digital systems can remain governable when intelligent agents can act, learn, code and potentially attack at speeds beyond human response.

The market reaction was telling. As investors reconsidered the durability of parts of the AI infrastructure trade, cybersecurity shares drew renewed attention. CrowdStrike, Palo Alto Networks, Zscaler, SentinelOne, Okta and related names have become a more direct expression of the next phase of AI spending: securing what AI makes more productive, more connected and more exposed.

The investment case is not simply that cyber threats are getting worse. Cybersecurity has always been an arms race. The change is that AI is reducing the time between discovery and exploitation of a flaw, while increasing the number of potential attackers and attack paths.

For decades, enterprises operated to a predictable rhythm. A vulnerability was disclosed, a vendor issued a patch, technology teams assessed its relevance, tested the fix and deployed it across the organisation. There was never a guarantee that this process would finish before an attacker acted, but there was usually a window.

That window is narrowing rapidly.

Andreessen Horowitz, or a16z, has highlighted data from Zero Day Clock suggesting that exploitation increasingly occurs on or before the day a vulnerability is publicly disclosed.

The precise headline figure requires caution because Zero Day Clock has revised its methodology and the current 2026 dataset remains incomplete. But the direction is unmistakable. Organisations can no longer manage high-risk vulnerabilities as a weekly or monthly administrative exercise. They must discover exposure, prioritise it, test remediation and contain attacks continuously.

This is the backdrop to Peter H. Diamandis’s essay, When Both Sides of Cybersecurity Are AI. His argument is stark: the machines have learned to break in, but they can also help fix what they find. Models capable of identifying weaknesses, producing exploit code and testing hardened systems can also scan corporate environments, validate patches, detect anomalous activity and help rewrite decades of insecure legacy software.

Diamandis calls this “co-scaling”. If attackers are probing networks, applications and identities with AI at machine speed, defenders must deploy AI at machine speed too. A human analyst manually reading vulnerability advisories and working through queues of alerts cannot reliably operate within a same-day exploitation cycle.

The surge in reported critical and high-severity vulnerabilities reinforces the urgency, though it also needs careful interpretation. A sharp increase can mean that software is becoming less secure. It can also mean that AI-assisted discovery, vendor scanning and responsible disclosure are becoming more effective. In practice, both forces are likely at work.

The important message from Andreessen Horowitz, is not that every disclosed flaw will instantly become catastrophic. It is that defenders can no longer assume they have weeks to prioritise, test and install a patch.

OpenAI says Astra reached its “Critical” cybersecurity capability threshold, meaning that, given appropriate tools and access, it can identify previously unknown flaws and develop means to exploit hardened systems without step-by-step human instruction. It recorded a 100 percent score on OpenAI’s ExploitBench test of exploit development from known vulnerabilities.deploymentsafety.openai+1

That does not mean an autonomous model will imminently “take over the internet”. Benchmarks are not real-world incident rates, models remain subject to safeguards, and serious operations require access, persistence and operational judgement. But it does mean that the skill barrier for many offensive tasks is falling, while the volume of attack paths rises.

Where the spending goes

The current market rotation reflects that logic. Cybersecurity shares rallied as investors reassessed AI not only as a productivity threat to software businesses, but as a driver of new defensive spending. CNBC reported that CrowdStrike and Okta led a broad August rally after earnings, with investors responding to demand linked to the rising AI threat environment.

This is not a blanket argument that every cyber stock is cheap, or that recent share-price gains are risk-free. Valuations already reflect high expectations in several large-cap names. Investors should separate companies selling genuinely integrated platforms and recurring services from those merely attaching “AI” to an older alerting product.

Apocalypse or adaptation?

The immediate corporate priority is therefore not merely to acquire another security dashboard. It is to modernise the security operating model. Every AI agent inside an organisation should have a defined identity, limited access rights, monitored connections and a complete audit trail. Every application, cloud workload and software supply-chain dependency should be continuously tested. And every security team needs clearer objectives than simply “reduce risk”, such as preventing successful payment fraud, stopping privileged-account compromise or keeping sensitive data out of unauthorised AI tools.

This is also where the commercial opportunity lies. Endpoint protection, identity security, cloud defence, AI governance, autonomous remediation and application-security testing are likely to command larger enterprise budgets through 2027. Palo Alto Networks chief executive Nikesh Arora has argued that much of the existing security estate was not built for attacks moving at machine speed. CrowdStrike’s George Kurtz has similarly warned that AI is exposing gaps in legacy defences, even at well-funded companies.

So, is this an AI apocalypse or an adaptation?

The rhetorical answer is that it can be either, depending on whether institutions continue to run a machine-speed threat environment with human-speed controls. AI will not eliminate cyber risk. It will create new forms of risk through autonomous agents, poorly governed employee use of AI, insecure integrations, stolen credentials and open-weight models in the hands of capable criminals.

But it also offers defenders something historically rare: the ability to automate detection, remediation and secure software development at scale. The choice is not whether organisations will face AI-enabled threats. They already do. The choice is whether they use the same technology to build a smaller, more resilient and more defensible digital estate.

Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.