Idea → Industry

From a hunch to where to dig

AI is making attackers faster and is opening up whole new things to attack (AI agents, AI apps, machine identities), so companies will have to spend more on cybersecurity, for years.
Technology-adoption theme, so the generic chain lens. This isn't a physical shock or a one-off market event; it's a technology being adopted on both sides of a fight, so I follow the plain chain: what AI changes → who is forced to spend → who sells them the answer → who keeps the profit. One twist makes this theme unusual: AI pushes demand from two directions at once (offense gets cheaper, and the attack surface grows), and the map keeps them apart.
A starting map, not a study · generated 12 October 2026
How to read the evidence tags: [CRWD Q2 FY27 call] = a filing or transcript in this research folder's sources/. [web] = outside sources/, from a web search on 12 Oct 2026 (often vendor or third-party; treat as directional). (inferred) = my reasoning, not a confirmed source.
How the idea fans out — why each industry is on the list
Step 1 — The cause: AI changes the fight in two ways
  1. Offense gets cheaper and faster. Generative AI "makes it easier for low-skilled adversaries to move faster and launch more sophisticated attacks" [CRWD FY26 10-K]. Frontier models that can find and exploit software bugs (Anthropic's restricted Mythos model, spring 2026) were described by Palo Alto as reframing the problem "from visibility to velocity" [PANW Q4 FY26 call].
  2. The thing to defend gets bigger. Every AI agent a company deploys is a new actor that holds credentials, touches data and talks to other systems. CrowdStrike saw Claude usage on customer endpoints grow over 400% and custom-agent usage over 100% "in recent months" [CRWD Q2 FY27 call]; Cloudflare says more than half of the traffic on its network in Q2 2026 was not human [NET Q2 FY26 call].
Step 2 — Who is forced to spend
Any company deploying AI agents or AI apps (it must govern them); any company with internet-facing software (its old bugs are now found in minutes); AI labs and new AI data centers (critical infrastructure from day one). Gartner's forecast puts 2026 security spending at about $249B, up 12.7%, and for the first time counts spend to secure AI itself [web: Gartner 2Q26 via third-party blog].
Step 3a — Who supplies them: guarding the new attack surface (AI adoption)
Identity security for machines and AI agents#1
An agent can only act through an identity with permissions, so every new agent is a new identity to issue, scope, watch and revoke. Palo Alto calls this "a fundamental identity crisis for the enterprise" and bought CyberArk (closed Feb 2026) to build its Idira platform covering "human, agentic, and machine identities" [PANW FY26 10-K; Q4 FY26 call]. CrowdStrike's identity ARR grew 34% to over $585M, and Falcon Shield (third-party agentic apps) grew more than 185% [CRWD Q2 FY27 call]. Okta and SailPoint (listed) have launched agent-identity products [web].
AI security: governing AI apps and agents at runtime#3
A brand-new product category: seeing which AI tools employees use, what prompts and data flow to models, and stopping prompt injection or rogue agent actions. Palo Alto's Prisma AIRS passed $100M ARR in its first year with 800+ customers; CrowdStrike's AI Detection & Response ARR "nearly tripled" quarter on quarter [PANW Q4 FY26 call; CRWD Q2 FY27 call]. Real, but young and small.
Endpoint security as the agent control point#4
AI coding tools and agents now run on the employee laptop, where they open files and use credentials. The vendor that already has a sensor on the device sees them first. CrowdStrike's endpoint business accelerated for a fourth straight quarter "as customers look to secure their growing AI attack surface"; Palo Alto bought Koi for "agentic endpoint security" [CRWD Q2 FY27 call; PANW FY26 10-K].
Cloud and AI-workload security#6
AI workloads live in the cloud and in new data centers, which need posture checks and runtime protection. Alphabet agreed to pay $32.0B for Wiz [GOOG FY25 10-K]; CrowdStrike cloud ARR passed $905M, up 29%, including an eight-figure deal with a frontier lab [CRWD Q2 FY27 call]. Gartner names cloud security the fastest-growing segment [web].
Step 3b — Who supplies them: keeping up with faster attackers (AI offense)
Exposure management: find, rank and fix bugs before AI does#2
If AI finds bugs faster, the patch window collapses and companies need to know which of thousands of flaws matter today. CrowdStrike: "you simply cannot patch vulnerabilities fast enough", and its exposure management business accelerated [CRWD Q2 FY27 call]. Disclosed CVEs reportedly rose from ~9,000 (Q3 2025) to 16,000+ (Q1 2026) [web: JPMorgan note via Yahoo]. Listed specialists: Tenable, Qualys, Rapid7.
Security operations (next-gen SIEM) and telemetry pipelines#5
Defending at machine speed means AI must read every signal, and agents themselves create a "massive volume of telemetry" [PANW Q4 FY26 call]. CrowdStrike's next-gen SIEM ARR passed $695M; both leaders bought data-pipeline companies (CrowdStrike–Onum, Palo Alto–Chronosphere) [CRWD Q2 FY27 call; CRWD FY26 10-K; PANW FY26 10-K].
Edge security: web firewalls, bot and API protection#7
The internet's front door is where AI scrapers, agents and automated exploit attempts arrive. Akamai reported strong WAF demand "from customers eager to protect against vulnerabilities that could be exposed by frontier models"; its security revenue grew 10% to $604M [AKAM Q2 FY26 call and release]. Cloudflare sits in front of the majority-non-human traffic described above [NET Q2 FY26 call].
Anti-deepfake identity verification and fraud data#8
Cheap deepfakes attack onboarding, call centres and payment approvals. Juniper estimates 100B digital ID checks in 2026 (+16%); LexisNexis Risk Solutions (part of RELX) reports a 180% rise in attacks it sees; the FBI logged $893M of "AI-related" fraud losses in its first year tracking it [web: LexisNexis release, Veriff].
Network security and firewalls for AI data centers#9
"Every new data center becomes critical infrastructure," and agentic traffic multiplies across networks; Palo Alto's firewall bookings accelerated on 5th-generation hardware and software firewall ARR grew 29% [PANW Q4 FY26 call]. Fortinet and Check Point are the other listed names (inferred).
Security for AI-written code#10
AI coding assistants ship code faster, and testing suggests a large share of it carries well-known flaw types (one study: 45% of samples) [web: Cloud Security Alliance note, AI-assisted, unreviewed]. The need is clear; who gets paid for it is not (see the shortlist).
Step 4 — Who profits durably
Mostly the vendors that already sit at a control point (the identity system, the device sensor, the network edge, the security data lake) and can switch on an AI-era module there. Platform buying is the channel: CrowdStrike says AI-driven demand is "accelerating platform consolidation"; Palo Alto calls platformization "the only viable strategy" [CRWD Q2 FY27 call; PANW Q4 FY26 call]. The ranking below applies this verdict to each industry.
The wrong side of the same force
Pushed against by AI (detail in section 3)
Legacy signature antivirus and first-generation EDR
Tools that match known patterns lose most when AI can mutate attacks endlessly; customers are swapping them out in the AI refresh [CRWD FY26 10-K; Q2 FY27 call].
Scan-and-ticket vulnerability tools and legacy SIEM
Finding bugs becomes cheap (AI labs now offer it); the old model of a monthly scan and a ticket queue breaks when exploits arrive in minutes.
Labour-based Tier-1 security monitoring (MSSPs, IT-services SOCs)
AI agents triage alerts in minutes, attacking the per-analyst pricing model. Not visible in the numbers yet.
Standalone point products, legacy VPN/proxy, standalone ID verification, cyber insurers' older books
Squeezed by platform consolidation, by deepfakes, or by higher-severity AI-assisted losses on policies priced before the shift.
The shortlist, ranked — click a heading to sort
Industry Link Durable / passing Where the money pools Crowded / overlooked The catch
1Machine & AI-agent identity security Direct Durable
every agent is a permanent new identity		 In the permission control plane: privileged access, secrets and governance, where removal is painful once wired in. CyberArk was bought into PANW for this Getting crowded
big M&A already done; agent revenue still small		 Platforms may bundle agent identity for free (Microsoft Entra, PANW Idira, CRWD) and squeeze standalone identity vendors; Okta still growing only 11% [web]
2Exposure management (prioritise & fix) Direct Durable
if AI bug-finding keeps outpacing patching		 In prioritisation, exploit validation and fast remediation, not in detection, which is commoditising [web: Info-Tech] Overlooked
sold off on Mythos fears [web]		 AI labs and platforms do the finding themselves (CRWD buying XM Cyber assets); Rapid7 revenue flat [web]
3AI security (runtime governance of AI apps & agents) Direct Durable
category is new; shape still forming		 With incumbents that already see the traffic (gateway, endpoint), not with standalone startups, most of which are being acquired (Pangea → CRWD) Crowded
every vendor's headline product		 May end up a feature, not a market; Prisma AIRS at $100M ARR is <2% of PANW's NGS ARR
4Endpoint security as agent control point Direct Durable In the installed sensor plus the data behind it; endpoint is the anchor that sells the other modules (CRWD Flex uplift >40%) Crowded Microsoft Defender bundling; legacy EDR losers show the price of falling behind
5Security operations & telemetry pipelines Indirect Durable In owning the security data lake and the pipeline that feeds it (ingest volume = revenue) Overlooked
pipeline layer; few listed pure plays		 Hyperscalers (Microsoft Sentinel, Google SecOps) compete on data cost; pure plays mostly private or acquired
6Cloud & AI-workload security Direct Durable In runtime protection more than posture scans [CRWD Q2 FY27 call] Crowded
$32B Wiz price set the bar		 The clouds themselves now own a leader (Google–Wiz), so bundling pressure is built in
7Edge: WAF, bot & API security Direct Durable In the networks big enough to see global traffic (NET, AKAM) Mixed Agent traffic is also customers' future revenue (agentic commerce), so "block" turns into "meter"; AKAM security only +10%
8Anti-deepfake ID verification & fraud data Direct Durable In proprietary identity and fraud data networks (e.g. RELX's LexisNexis Risk), not in document-check apps (inferred) Overlooked
(inferred)		 The same deepfakes defeat the checks; listed pure plays are scarce
9Network security / AI data-center firewalls Indirect Partly cyclical
hardware refresh		 In software subscriptions and SASE rather than boxes; hardware is ~10% of PANW revenue Mixed Memory and storage costs rising in hardware [PANW Q4 FY26 call]
10Security for AI-written code Direct Durable Unclear: GitHub and GitLab bundle scanning; Snyk ARR reportedly +7% despite the tailwind [web: Sacra] Overlooked Real need, weak profit pool: the classic tailwind-with-no-toll trap
Parked — weaker or two-sided links: incident-response services (spikes after big events, so partly cyclical; valuable mainly as a feeder into product sales); cyber insurance (premiums can rise, but so can AI-assisted loss severity, so it is listed with the losers); security-awareness training (a stretch, since AI phishing makes training less effective); post-quantum cryptography (a separate theme).
The wrong side of the idea
The same force that lifts the industries above pushes against these. Two uses: they're shorts / avoids in their own right, and they're a confirmation test. If the industries that should be bleeding aren't under real pressure, treat the whole theme as weaker or slower than the bull story claims.
Industry Why it's hurt (mechanism) Exposure Is the harm showing?
Scan-and-ticket vulnerability management; legacy SIEM AI makes bug-finding cheap (labs offer it directly) and exploits arrive faster than ticket queues move; customers replace "legacy vulnerability management" in AI programs [CRWD Q2 FY27 call] Direct hit Showing Rapid7 revenue flat, guiding down ~3% [web]; Tenable fell 9% on the Mythos leak [web]
Legacy signature AV and first-gen EDR Pattern-matching fails against AI-mutated attacks; replaced in platform refreshes (eight-figure "replace a next-gen EDR" win) [CRWD FY26 10-K; Q2 FY27 call] Direct hit Showing SentinelOne growth decelerating toward ~20% [web; figures conflict across sources]
Standalone point-product vendors AI defense needs one data layer, so buyers consolidate on platforms; Palo Alto describes watching "40 or 50 companies" per category and buying the winner [PANW Q4 FY26 call] Partial Showing exits by acquisition (CyberArk, Wiz, Pangea, Koi) rather than independent scale
Legacy VPN, proxy and virtual-desktop access Zero-trust and SASE replace them; AI agent traffic adds pressure (AI is the accelerant, not the cause; inferred) Partial Showing named displacements in NET and PANW wins [NET Q2 FY26 call; PANW Q4 FY26 call]
Labour-based Tier-1 SOC outsourcing (MSSPs, IT-services security) AI agents do alert triage that analysts were billed for (inferred) Partial Not yet CrowdStrike's GSI business grew ~50% [CRWD Q2 FY27 call]; integrators are being paid to run the migration
Standalone document / voice identity verification Deepfakes defeat document and voice checks; Gartner predicted 30% of enterprises would stop trusting standalone IDV by 2026 [web] Partial Unclear (inferred; few listed pure plays to check)
Cyber insurers' pre-AI books Policies priced before AI phishing, autonomous ransomware and deepfake fraud; claims show higher severity [web: CFC] Partial Unclear no loss-ratio data found (inferred)
Confirmation test: mostly passes. The losers that should bleed first (legacy VM and older endpoint vendors) are visibly slowing while the platforms accelerate: CrowdStrike net new ARR +51% and ending ARR $5.84B (+25%) [CRWD Q2 FY27 call]. The labour-heavy losers are not hurting yet, so the "AI replaces security headcount" half of the story is still a forecast.
Study this first
The one slice worth a deep dive

Machine and AI-agent identity security: privileged access, secrets and agent governance

It is the most direct link (an agent cannot act without an identity), the most durable (agents accumulate; they don't revert), and the money pools in a control plane that is hard to rip out once wired in. Palo Alto made one of the two largest acquisitions in its history (CyberArk) to own it, yet agent-identity revenue is still small at listed vendors, so the runway is ahead rather than in the numbers.

The one thing to verify: whether non-human and agent identities become a separately priced unit (billed per identity or per agent) or get bundled free into endpoint, cloud and identity-provider platforms. If they're bundled, the tailwind is real but the profit goes to the platforms, not to identity specialists.

run learn-any-industry on machine and AI-agent identity security (privileged access, secrets management, non-human identity governance)
New to this space? Start with the line above. Already fluent in it? Skip straight to the analytical primer:
run industry-primer on machine and AI-agent identity security (privileged access, secrets management, non-human identity governance)
The catch hiding in the idea

AI raises demand for security and also lowers the cost of producing it. The same models that help attackers find bugs also let AI labs and hyperscalers sell security directly. Cybersecurity stocks fell ~8% when Anthropic launched a code-scanning tool and again when Mythos leaked [web: Vontobel, Solomon Neas], and Google now owns Wiz. Spending growth (~13% a year) is therefore not the same as profit growth for "cybersecurity": the theme pays the few vendors that hold a control point and the data behind it, and it can hurt everyone else in the sector (Rapid7 flat; Snyk ~7% despite an obvious tailwind).

A second trap: headline growth overstates the AI pull. Palo Alto's NGS ARR grew 63% to $9.1B, but that includes the CyberArk and Chronosphere acquisitions and a nine-figure migration by one LLM customer; guidance falls to 22–23% for FY27 [PANW Q4 FY26 call and release]. Read organic numbers before crediting AI.

Sources

From this research folder (sources/)

  • CrowdStrike FY2026 10-K (filed 2026-03-05) and Q2 FY2027 earnings call (2026-08-26) — Equity/CRWD_CrowdStrike_Holdings_Inc./sources/
  • Palo Alto Networks FY2026 10-K (filed 2026-09-10), Q4 FY2026 press release and call (2026-09-01) — Equity/PANW_Palo_Alto_Networks_Inc/sources/
  • Cloudflare Q2 FY2026 earnings call (2026-08-06) — Equity/NET_Cloudflare_Inc./sources/
  • Akamai FY2025 10-K, Q2 FY2026 press release and call (2026-08-06) — Equity/AKAM_AKAMAI_TECHNOLOGIES_INC/sources/
  • Alphabet FY2025 10-K (Wiz agreement, $32.0B) — Equity/GOOG_Alphabet_Inc/sources/
  • Microsoft FY2026 10-K (Defender, identity and security positioning) — Equity/MSFT_MICROSOFT_CORP/sources/

Outside sources/ — web, searched 12 Oct 2026 (directional; much is vendor or third-party)