AI Accelerates Software Vulnerability Discovery, Triggering a Surge in Enterprise Cybersecurity Spending
nashnova research
AI tools now discover vulnerabilities far faster than enterprises can patch them. This structural mismatch is driving sharp increases in cybersecurity budgets across finance, energy, and IT services, shaping a new corporate security spending cycle.
Bugs found faster than they're fixed — how wide is the gap?
Epoch AI data shows high-severity vulnerabilities reported in August–September 2026 alone already exceeded the full-year 2025 total. This means → the discovery rate has jumped in a step-change, not a gradual climb.
The surge tracks closely with the spread of AI tools — AI helps defenders find bugs, but it also lets attackers spot exploitable flaws faster.
In plain terms = companies used to patch one batch of bugs a year and keep up. Now two months' worth of discoveries outpaces an entire prior year, and patching can no longer keep pace with finding.
Where exactly is the money going?
Bank of America is hiring 1,000 contractors to use Anthropic's Mythos and other AI tools to patch its own software vulnerabilities.
Goldman Sachs is running Mythos and OpenAI's Astra model extensively to scan internal code. Management believes AI spending on security could soon match or exceed AI coding-tool spending — previously Goldman's largest AI line item.
This reflects a shift at major financial institutions: AI security has moved from an add-on to a core investment on par with AI-assisted programming.
Beyond finance — are energy and IT services spending too?
A major U.S. energy company with a cybersecurity budget of roughly $30 million increased it by more than 10% year-on-year, directing new funds to Mythos and AI add-ons from Proofpoint (email security) and Cisco's Splunk (data monitoring).
The company even drew down next year's security budget early to cover the new features. This means → the spending pressure already exceeds what a single year's budget can absorb.
IT services firm Diversified mobilized about 100 IT staff to address the PHP vulnerability and a new flaw in Brotli — an open-source web-traffic compression library — and plans to add at least 3 full-time security hires while raising next year's security software budget by roughly 20%.
Are startups rethinking security headcount?
Atomicwork CEO Vijay Rayapati faced three security incidents in 48 hours: certificate authority eMudhra was breached, AI model-routing tool LiteLLM was compromised, and a vulnerability was found in PHP — the language behind roughly 70% of websites.
He immediately assembled about 30 engineers and ordered a full pivot to security, announcing a hiring ratio of one security engineer for every three technical staff.
The company's security engineering team is expected to grow to about 27 people within a year — roughly tripling. In plain terms = startups that once treated security as a side task now need dedicated headcount.
Can this spending wave last — and what should we watch?
Security vendors are already seeing accelerating revenue. Proofpoint, Splunk, and others charge extra for continuous AI-powered monitoring features.
This means → vendors are building an "AI premium" business model — not one-off tool sales, but ongoing subscription fees for continuous monitoring.
Two questions will determine whether this cycle has staying power: can the AI-premium pricing model hold, and where is the ceiling for corporate security budgets — the fact that some firms are already raiding next year's budget suggests they are approaching short-term spending limits.
市场有风险，内容仅供研究参考，不构成投资建议。