← All sectors / The AI transformation
092 · Cybersecurity for AI systems
Attacking the model itself
Curve position
Binding constraint
Buyers who have not yet been breached in this specific way.
Why this sector sits at Liftoff
The AI-in-cybersecurity market reached $25–35B in 2026 at a 20–25% CAGR, CrowdStrike acquired SGNL for $740M and Upwind raised $250M in January 2026 alone, and Gartner projects 40%+ of cybersecurity spending tied to AI capabilities by 2027—capital is flooding in and the story is widely known.
Reviewed on a two month cycle. The position moves only when a dated, verifiable change in the binding constraint justifies it.
Heatmap / How this sector's stocks are moving
| Stock | Price | 1 Day | 1 Week | 1 Month | Year to date |
|---|---|---|---|---|---|
| $CRWD | $241.00 | −1.50% | −9.62% | −13.58% | +105.65% |
| $PANW | $348.04 | −0.62% | −11.77% | −17.12% | +88.95% |
| $ZS | $224.44 | −0.29% | −12.26% | +5.74% | −0.21% |
| $S | $23.49 | +1.64% | −8.21% | −8.95% | +56.60% |
| $NET | $266.58 | −2.57% | −16.36% | −24.91% | +35.22% |
| Sector average | −0.67% | −11.64% | −11.76% | +57.24% |
Prices as of November 5, 2026. The sector's move is the equal-weighted average of these listed companies, a market proxy for context, not recommendations. See it on the full heatmap →
Sentiment / The mood in this sector's stocks
Since 2019, Cybersecurity for AI systems has been in Capitulation and falling 13 separate times. After those, its stocks beat their usual three months 6 times (46%), by a median of −15.0 points.
Confidence: low, a split like this is common by chance, so no edge is called.
Every organisation deploying a model has created an attack surface that did not exist two years ago. Prompt injection, training data poisoning, model extraction, and agent hijacking are real techniques with almost no installed base of defences against them.
Historically security tooling defended networks, endpoints, and applications. A model that takes instructions from untrusted text and then acts on systems does not fit any of those categories cleanly.
The structural driver is agent deployment. A chatbot that answers questions is low risk. An agent with tool access that reads an attacker controlled document and then executes actions is a genuinely new problem.
The technology layer spans input and output filtering, model firewalls, agent permission systems that constrain what a model may do, red teaming services, model provenance and integrity checks, and monitoring that spots a model behaving unlike itself.
Adoption economics are pre incident for most buyers, which is the hard part. Security budgets move after a breach, and few organisations have experienced a public model compromise yet.
The beneficiaries include AI security specialists, established security vendors adding model coverage, red teaming consultancies, and the identity firms extending permissioning to non human actors.
The value chain runs from model providers through deployment platforms to the enterprise. Whoever controls the agent permission layer holds the most defensible position.
The overlooked layer includes non human identity management, agent audit logging, model integrity verification, and the specialist consultancies doing adversarial testing.
Competitive dynamics are early and crowded, with many small vendors and the large security platforms deciding whether to build or buy. Consolidation is likely and quick.
Risks: the category is pre budget in most organisations, large platforms may absorb it as a feature, threat models are shifting faster than products, and a quiet year would delay urgency considerably.
What to watch: publicly disclosed agent compromises, regulatory requirements for AI system security, non human identity adoption, and security platform acquisitions in this space.