AI-driven vulnerability scanning tools are exposing software flaws at an unprecedented rate, while the ability of enterprises to patch those flaws lags far behind. This "offense-defense imbalance" is fueling a large-scale wave of corporate cybersecurity spending, sweeping from Wall Street banking giants to energy majors and startups alike.
According to a report by tech media outlet The Information on October 28, Bank of America recently disclosed it is recruiting 1,000 contractors to patch its own software vulnerabilities using AI tools such as Anthropic's Mythos. Goldman Sachs has already extensively used Mythos and OpenAI's Astra models to proactively search for vulnerabilities within its internal systems. According to a person familiar with discussions involving Goldman Sachs management, executives at the bank have been discussing that the firm's AI spending on security could soon match or even surpass its investment in AI coding tools鈥攚hich had previously been Goldman's largest AI-related expense category. A chief information security officer at a large U.S. energy supplier also revealed that the company's cybersecurity budget this year is approximately $30 million, a year-over-year increase of more than 10%, and it has already drawn on next year's budget in advance to cover additional costs for related AI features.
The direct beneficiaries of this spending wave include security software vendors such as Palo Alto Networks, Proofpoint, and Cisco-owned Splunk, as well as large model providers like OpenAI and Anthropic. Palo Alto Networks' revenue growth has doubled to more than 30% over its last two fiscal quarters. Meanwhile, according to a previous report by The Information, multiple cybersecurity startups that use large models to automate security functions are also receiving acquisition interest from buyers.
Vulnerability Explosion: AI Discovery Speed Far Outpaces Manual Patching Capacity
The core contradiction of this crisis lies in the enormous gap between the speed at which AI discovers vulnerabilities and the ability of enterprises to fix them.
According to the report, Lee Klarich, Chief Product and Technology Officer at Palo Alto Networks, provided a set of figures that vividly illustrate the scale of the problem: In May of this year, Anthropic granted about a dozen technology and cybersecurity companies access to its Mythos model, and that month the total number of newly reported vulnerabilities in global open-source software was approximately 1,500. Just one month later, those dozen or so companies discovered more than 37,000 new open-source vulnerabilities using Mythos alone鈥攖hough not all vulnerabilities were high-risk, and not all had been confirmed or publicly disclosed.
Data from research firm Epoch AI further confirms this trend: In just August and September of this year, the number of reported "high-risk vulnerabilities"鈥攖hose that could pose a serious threat to sensitive data鈥攁lready exceeded the total for all of 2025.
This explosive growth has placed enormous pressure on enterprise security teams. Viral Tripathi, Chief Information Officer at global IT services company Diversified, described the chaotic situation his company faced when dealing with PHP vulnerabilities and a vulnerability in the Brotli open-source library:
The company had to mobilize most of its approximately 100 IT staff, including analysts and engineers who do not normally work directly on cybersecurity, to fully investigate which cloud applications and web pages were at risk and to install patches.
"These remediation efforts consumed a massive amount of resources, and the impact went far beyond simply applying a patch鈥攊t took up a great deal of day-to-day operational time," Tripathi said.
Corporate Response: Hiring, Budget Expansion, and AI Agent Adoption
Facing escalating threats, corporate response strategies are shifting from passive reaction to proactive defense, with the core approaches being increased personnel recruitment and investment in AI tools.
Vijay Rayapati, CEO of enterprise software startup Atomicwork, urgently convened about 30 engineers last week and instructed all of them to prioritize cybersecurity issues. The trigger was a string of security incidents within 48 hours: root certificate authority eMudhra was compromised, AI model routing open-source tool LiteLLM was breached, and PHP鈥攖he programming language used by about 70% of websites鈥攚as found to have security vulnerabilities.
According to the report, although Atomicwork ultimately confirmed it was not directly affected, Rayapati said the emergency response itself showed that "nobody was prepared." He plans to hire one cybersecurity engineer for every three technical staff members going forward, and expects the number of engineers focused on cybersecurity to grow from its current level to approximately 27 within the next year鈥攔oughly tripling.
Diversified similarly plans to add at least three full-time cybersecurity personnel and to increase next year's cybersecurity software budget by about 20%, with a focus on AI tools for automated application monitoring.
The Information reported that the large U.S. energy supplier, which declined to be named, is directing its additional budget toward AI tools such as Mythos, as well as AI-enhanced features of security products it already uses鈥攊ncluding Proofpoint's email protection products and Cisco Splunk's data monitoring products. The company's CISO said both security vendors charge extra for continuous AI feature monitoring, but this is a necessary investment to address increasingly common, AI-driven persistent hacking attacks.
Vendors Benefit: Cybersecurity Spending Wave Becomes New Industry Normal
Cybersecurity software vendors are benefiting directly from this spending wave and are characterizing it as a long-term structural trend rather than a short-term anomaly.
"This is part of the new normal. Don't treat it as a one-time emergency鈥攖reat it as something you will basically need to deal with every day," said Palo Alto Networks' Klarich. The company's revenue growth has doubled over its last two fiscal quarters, exceeding 30%.
OpenAI and Anthropic also view cybersecurity demand as an important driver of sales growth next year, partly because of security vendors like Palo Alto Networks that integrate their models into products.
However, corporate spending on AI security tools is not without limits. Scott Roberts, Chief Information Security Officer at UiPath, said the company has recently cut back its prior spending on commercial models such as Mythos by shifting to cheaper open-source models, in search of more cost-effective alternatives.
Alex Stamos, former head of cybersecurity at Facebook who joined AI startup Cognition in the same role last month, offered a sober assessment of the overall situation:
"The next three to five years will be the most critical period in the history of the security industry. Defenders once had a first-mover advantage in addressing AI-related risks, partly because we (corporate defenders) had more money. But attackers are already catching up."
Comments