Innovation Insights: A CTO’s Perspective

The New Attack Surface

What AI's Threat Landscape Means for Cybersecurity Investments A Tech Fund CTO's view on emerging AI risk vocabulary, the layer-by-layer threat matrix, and how the sector's leaders are positioning to meet it

Recently, while hosting an internal Gideon training session on AI Technology and Prompt Engineering, one of our summer interns asked, “What about AI is keeping you up at night?” Some of you might envision a Hollywood-style dystopian future where AI-enabled applications or humanoid robots decide that they want to take over. For others, it is concern about job loss or reduced wage growth. From my perspective, however, the more immediate threat is AI’s potential to penetrate our best cybersecurity defenses and compromise the underlying operating systems and IT applications that we depend on to run almost every aspect of our society.

This is a Big Problem - Cybercrime’s Economic Impact Data

I recently read that Mastercard CEO, Michael Miebach stated “By 2030, the amount of fraud and cyber risk driven damage is going to amount to $15.6 trillion. If cyber risk were a country, that would be the third largest economy in the world.” “What we essentially need to do is move from defense to offense. And that’s where our last investments have been in threat intelligence.”

Michael Miebach’s statement prompted a deeper dive into the trillion-dollar financial impact of cybercrime. Industry estimates reviewed vary by an order of magnitude depending on the methodology used to calculate them. What's counted (direct losses only vs. downstream productivity, IP theft, and remediation) appeared to matter more than which year is being measured. To ground the discussion, the figures below are presented with their source methodology intact rather than collapsed into a single consensus number.

Table 1. Global Cybercrime Cost Estimates, 2025

If cybercrime were measured as a national economy at the $10.5 trillion figure, it would rank as the third largest in the world, behind only the United States and China, up from $3 trillion in 2015. Cybersecurity Ventures now projects roughly $12.2 trillion in cybercrime annually by 2031 (a somewhat lower number than the $15.6 trillion stated by Mastercard’s CEO), implying growth is decelerating to about 2.5% a year from 2026 onward, down from the 15% compound annual growth rate used to project the 2015 to 2025 climb.

Per-Incident Breach Costs (IBM Cost of a Data Breach Report 2025)

For those of you running an international business, the global average cost of a data breach fell 9% to $4.44 million in 2025, the first reported decline in five years. This was driven largely by faster detection and containment through security AI and automation. Organizations using AI tools extensively cut their breach lifecycle by 80 days and saved nearly $1.9 million on average, and the global average breach lifecycle dropped to 241 days, a nine-year low.

The United States moved in the opposite direction, however, with the average U.S. data breach cost climbing to an all-time high of $10.22 million in 2025, up 9% year-over-year and 2.3x the global average, driven by steeper regulatory fines, slower detection times, and more complex breach investigations. The U.S. has led the world in breach costs for 15 consecutive years, and our healthcare sector remains the single most expensive industry at $7.42 million per breach, its 15th consecutive year at the top.

At the aggregate economy level, US-specific cybercrime costs are estimated at roughly $639.2 billion in 2025, an estimated 43–53% of the broader global cybercrime total under that methodology. Separately, the FBI's Internet Crime Complaint Center fielded 859,532 complaints from US victims in a single year, with reported losses topping $16.6 billion, a 33% increase over the prior year. That said, it should be noted that this reflects only reported/confirmed losses, not the full economic footprint including downtime, remediation, and indirect costs.

AI's Dual Role in the 2025 Figures

Attackers used AI in 16% of breaches to power phishing campaigns and deepfakes, while “shadow AI” (unauthorized AI tools operating without governance) was involved in 20% of breaches. Of these AI-related breaches, 97% occurred at organizations lacking proper access controls, and 63% had no formal AI governance processes or policies. At the same time, AI-driven cyber defense is the primary reason the global average breach cost declined for the first time in five years.

Note on sourcing: Cybersecurity Ventures' $10.5 trillion estimate for 2025 and its $12.2 trillion projection for 2031 are among the industry's most widely cited headline figures, but both are proprietary estimates rather than bottom-up audited figures like IBM's per-breach data. They are presented here as widely cited industry benchmarks, not verified facts.

Cybercrime’s Market Growth Projection – Sizing the Opportunity

Table 2. Cybersecurity Market Growth Projections, 2025–2030

Currently, enterprise IT budgets allocate an average of 10.9% to 13.2% to cybersecurity. Industry benchmarks establish a best-practice target of 10% to 15% for typical organizations, which equates to roughly 0.69% of an enterprise’s total revenue. Budget allocation varies by industry segment as security spending is heavily dictated by regulatory oversight and the sensitivity of the data handled. regulated industries (financial services, healthcare) often allocate 15% to 18% (or higher) of their IT budgets to compliance and threat mitigation. high-tech and defense contractors also generally exceed standard benchmarks due to severe nation-state and IP theft risks. Aaron Newman, a 20-year cybersecurity expert leading Cloud Storage Security as CEO, contends that cybersecurity budgets must scale to match the AI age: "AI gives attackers machine-level consistency without needing to rest. Exploiting vulnerabilities, attacking LLMs, networks, applications, and storage has become scalable in ways they just weren't before." While enterprise spend has yet to reflect this reality, AI-powered attack persistence pressures cybersecurity budgets unlike before.

The standout sub-segment is AI-specific security spending. Gartner projects the “AI-amplified security” market for tools and services purpose-built to secure AI systems will grow from about $10.0 billion in 2024 to $204.5 billion by 2030, a 65.3% compound annual growth rate and roughly 20x expansion, with security services within that category growing from $364 million to $59.0 billion. Gartner also projects that by 2028, over 75% of enterprises will use AI-amplified cybersecurity products for most use cases, up from less than 25% in 2025.

Separately, Gartner's broader 2Q26 forecast shows the “securing AI” spending category overtaking endpoint protection as the single largest line item in enterprise security by 2029 ($31.2B vs. $30.1B), with that gap widening to $37.6B vs. $33.0B by 2030, a segment now compounding at 18.5% annually versus the 5.1% growth Gartner's own forecast projected just two quarters earlier.

For governance context, 94% of respondents to the World Economic Forum's Global Cybersecurity Outlook 2026 identified AI as the single most significant driver of cybersecurity change, and 87% flagged AI-related vulnerabilities as the fastest-growing cyber risk of 2025. Yet roughly one-third of organizations still have no process to assess AI tool security before deployment, which is the governance gap the accelerating “securing AI” spending category is being built to close.

Growth Summary

Two numbers matter more than the headline trillions:

1. The cybercrime-cost growth rate is decelerating (15% → 2.5% CAGR per Cybersecurity Ventures)

2. At the same time the defensive spend growth rate in AI-specific security is accelerating (5.1% → 18.5% CAGR in consecutive Gartner quarters, and 65% CAGR in the broader AI-amplified category).

This, in our view, is a rare situation. We appear to be experiencing a maturing threat cost curve paired with an accelerating spend curve. To better understand this phenomenon, it is the segment-level data that we will explore here in greater detail.

The Evolving Threat Matrix

For the better part of the past two decades, cybersecurity investing followed a predictable event cycle. First, a new attack vector emerges, then a category of point solutions from various specialty vendors responds, and eventually the leading cybersecurity platform vendors consolidate the winners. Today, AI has accelerated that cycle into months rather than years and it has done something more structurally important. It has created an entirely new attack surface, the AI model itself. Thus, while AI shrinks demand for some software, in security, it widens the attack surface these companies get paid to defend. As investment portfolio managers, our job isn't just to evaluate the revenue and margin growth of the cybersecurity solution vendors; we now need to understand whether the threats these companies are building against are real, sustainably durable, and monetizable. Increasingly, the answer runs through a vocabulary most portfolio managers and our investors didn't need to know just two years ago.

Why the Old Mental Model Is Incomplete

Traditional application security, including the world of Structured Query Language (SQL) injection, broken access control, and misconfigured cloud buckets, still matters enormously. But Large Language Models (LLMs) introduce a fundamentally different attack surface: one where the “input” (natural language) and the “instructions” (also natural language) travel through the same channel with no hard boundary between them. That collapse of separation is why prompt injection has topped the industry's standardized risk list for two consecutive editions, and why “jailbreaking,” the term used to describe bypassing a model's safety filters, is only the most publicly understood entry in a much larger taxonomy of manipulation techniques.

For an investment thesis in cybersecurity to be durable, it must go beyond trending headlines about “jailbreaks” and chatbots being hacked. In our view it needs to be founded on the fact that a growing share of enterprise infrastructure inclusive of copilots, autonomous agents, RAG pipelines connected to proprietary data, now has an AI machine-reasoning layer that can, and likely will be manipulated, poisoned, or hijacked, often without triggering a single traditional security alert.

The Standard-Setting Body: OWASP's LLM Taxonomy

The OWASP Top 10 for LLM, maintained by the OWASP Gen AI Security Project, has become the closest thing the industry has to a shared risk vocabulary — the equivalent of what the original OWASP Top 10 did for web application security two decades ago. The project began in 2023 as a community-driven effort to highlight AI- specific security issues, and as LLMs have become embedded more deeply in customer interactions and internal operations, its maintainers continue to document the vulnerabilities and countermeasures emerging alongside that adoption.

The current ten categories run from Prompt Injection (LLM01) and Sensitive Information Disclosure (LLM02) through Supply Chain risk (LLM03), Data and Model Poisoning (LLM04), Improper Output Handling (LLM05), Excessive Agency (LLM06), System Prompt Leakage (LLM07), Vector and Embedding Weaknesses (LLM08), Misinformation (LLM09), and Unbounded Consumption (LLM10). Notably, the project has already published a further updated 2026 edition as of early August, alongside a companion “State of Agentic AI Security and Governance” report. This is further evidence that the standard itself is still being actively rewritten in near real time. That pace of revision is itself a data point worth understanding. The standards bodies are chasing a moving target, which is precisely the environment in which security vendors with continuous learning platforms, rather than static rule-set-based solutions, will tend to win share.

Beyond Jailbreaking: A Working Taxonomy for Portfolio Managers

“Jailbreaking,” the practice of manipulating an AI model into bypassing its safety controls or operating restrictions, often receives outsized media attention because it is intuitive and easy to demonstrate. But jailbreaking describes only one narrow attack objective. The more consequential risks, from an enterprise-security and monetization standpoint, sit elsewhere in the broader taxonomy. Examples include:

Input and Conversational Manipulation

• Direct prompt injection — An attacker types in instructions straight into the chat interface, attempting to override the system's original instructions with their own.

• Indirect prompt injection — The more dangerous enterprise variant: malicious instructions are hidden inside a document, webpage, email, or file that the AI is asked to summarize or process, so the model executes an attacker's commands without the user ever typing them.

• Prompt hijacking — An attacker redirects a model's output or behavior mid-task toward an unintended goal, often by exploiting how the model weighs competing instructions.

• Prompt smuggling — Malicious intent is disguised through encoding, formatting tricks, or obfuscated language so that content filters don't recognize it as a policy violation until the model has already processed it.

• Multi-turn or escalation attacks (e.g., “Crescendo”) — Rather than asking for something harmful outright, the attacker builds toward it gradually across a conversation, each turn slightly extending what the model has already agreed to, until safety boundaries erode by increments.

Core Model and Architecture Exploits

• Prompt leaking — Extracting the confidential system prompt or instructions an enterprise has configured behind the scenes, exposing proprietary logic, business rules, or embedded credentials.

• Model hijacking — Repurposing a deployed model for an entirely different function than intended, effectively stealing compute and capability for the attacker's own use case.

• LLM evasion — Adversarial inputs engineered specifically to slip past a model's classifiers or moderation layer without tripping detection.

• Data poisoning — Corrupting the training, fine-tuning, or embedding data itself, so the vulnerability is baked into the model before it's ever deployed. Basically, the AI equivalent of a supply-chain compromise.

The common thread across all of these is that none of them require breaching a network perimeter in the traditional sense. That's precisely why the legacy EDR/firewall/SIEM stack, however well-run, doesn't fully address this category and why it's created genuine white space for vendor platform capability expansion.

The Evolving Threat Matrix: AI's Impact Across the IT Infrastructure Stack

Perhaps a better way to describe AI's accelerating impact is to map the threat landscape by IT infrastructure layer rather than by attack technique alone, although both perspectives are helpful in understanding the full scope of the cybersecurity challenge. The following illustrates how AI is compressing both sides of the fight, attacker and defender, at nearly every layer simultaneously. That symmetry is exactly why the vendor response has had to become platform-wide rather than proceed point solution by point solution.

AI Impact Bottom Line:

Every layer shows the same pattern: For the attacker, AI lowers the cost and raises the speed of the attack, and the cybersecurity vendor response is to lower the cost and raise the speed of detection and correlation in kind, with human judgment deliberately retained at the highest-stakes decision points on both the identity and the agentic- response side. That symmetry is worth watching closely as an investment thesis, because it means the long-term winners won't be the vendors with the single best point solution at any one layer, but the ones who can correlate signal across all of them coherently.

How the Cybersecurity Platform Leaders Are Responding

At Gideon, we have explored more than 60 publicly traded cybersecurity companies. In this section, I take a deeper dive into a few of the industry leaders, as well as a group of private-market entrants bringing new AI- native solution capabilities to market. While we can’t cover them all in this newsletter, the responses from the three bellwether names in the space that we follow most closely illustrate three different, and largely complementary, strategic bets.

● Palo Alto Networks has pursued a platformization strategy aimed at securing the full AI lifecycle rather than a single point in it. Its Prisma AIRS 3.0 platform is built to secure the entire lifecycle of AI agents. It works by discovering the AI tools running across an organization's network, assessing the risk each one carries, and applying consistent policy from a single console. That "discover, assess, govern" sequence matters to enterprise buyers because most large organizations don't know how many LLM-powered tools their employees have already connected to sensitive systems. Shadow AI is quickly becoming what shadow IT was a decade ago and it was everywhere in most large firms. Analysts have also pointed to Palo Alto's Cortex XSIAM and Prisma AIRS lines, alongside its identity-security push following the CyberArk acquisition, as central to its AI-security growth narrative. (Note: Every AI agent needs its own login to the company’s systems it works in, so the more agents that companies deploy, the more IDs there are to check at the door and the bigger the market for Palo Alto and others playing the role of “bouncers”.)

● CrowdStrike has leaned into the speed argument. If AI-driven attacks operate at machine pace, then your defense must do so as well. CrowdStrike’s CEO recently said, “Mythos set off a surge in customer inquiries from companies wanting to make sure they were protected against the next wave of AI hacking.” The CrowdStrike Agentic MDR platform is designed to autonomously handle detection, investigation, and response rather than simply alerting an overwhelmed human analyst. Essentially, CrowdStrike is fighting AI agents with AI agents. On the AI model-facing side, the company expanded Falcon Shield to cover AI agents built on third-party platforms such as ChatGPT Enterprise, Codex, or Claude Code, giving security teams visibility into what those agents are doing and the ability to link risky behavior back to the person who created the agent. CrowdStrike has paired that with a new AI-native detection engine, Signal, designed to learn what's normal in any given environment and surface subtle or hidden, easy-to- miss indicators of an early-stage attack, alongside dedicated AI Systems Security Assessment and AI-for- SecOps-readiness services.

● Okta describes itself as "The World's Identity Company," and its core stack now spans four connected layers: Workforce Identity Cloud (employee authentication and SSO), Auth0/Customer Identity Cloud (customer-facing identity for developers), Identity Governance (access certification and least-privilege enforcement), and, most recently, Okta for AI Agents, which reached general availability on April 30, 2026. The new AI Agents product enforces least-privilege, context-aware authorization so that even if an agent is compromised by prompt injection, the blast radius of what it is authorized to do stays contained. The broader framework behind it, Okta's "blueprint for the secure agentic enterprise," organizes everything around three questions: where are my agents, what can they connect to, and what can they do, essentially applying identity governance discipline to non-human actors for the first time.

Because Okta is the identity layer nearly every other system trusts, it has become one of the highest- value targets for AI-accelerated social engineering specifically.

Okta's answer to its own attack surface is a defensive product, Identity Threat Protection with Okta AI (ITP), which continuously assesses user risk throughout an active session rather than just at login, using behavioral analytics to flag anomalies and automatically trigger remediation across the connected tech stack. The company's broader push is toward an "identity security fabric" that unifies previously siloed identity tools specifically because fragmented, legacy architectures can't keep pace with AI agents operating at machine speed or deepfakes that blur legitimate users from impersonators. Gartner, the industry leader in IT vendor research, is cited as projecting that fabric-based identity immunity will prevent 85% of new attacks by 2027. That combination, securing human identity against AI-generated impersonation while simultaneously extending identity governance to machine/agent identity, won Okta the 2026 AI Breakthrough Award for AI Security Innovation, alongside category winners including NVIDIA, Snowflake, and Dell.

The three vendors are converging on the same enterprise problem from three different entry points: Palo Alto secures the AI workload (Prisma AIRS), CrowdStrike secures the SOC's response speed (Agentic MDR, Falcon Shield), and Okta secures the identity underneath both humans and agents. That's a meaningful distinction for cybersecurity portfolio construction as identity is being treated across the industry as the control plane for the agentic era, not just one more log source feeding a SIEM, which positions Okta less as a competitor to the other platform security vendors and more as complementary access-security infrastructure that they're increasingly designed to integrate with.

In addition to the public leaders highlighted there are several new entrants focusing on AI threat detection and mitigation. These firms can be categorized into Agentic AI Security, Runtime Protection, and AI Security Posture Management (AI-SPM). While the established giants are adding AI layers, these venture-backed and PE-backed startups are building AI-native defense platforms from scratch.

Agentic AI & SOC Automation

● Arambh Labs: Builds an agentic AI platform that acts as an automated extension of Security Operations Center (SOC) teams to autonomously detect, investigate, and remediate incidents. ● Tenex.AI: Delivers a Managed Detection and Response (MDR) model powered by AI-native automation to handle triaging, investigation, and threat hunting, backed by human oversight. ● Aurascape: Closes emerging agentic gaps by specifically securing Model Context Protocol (MCP) interactions and multi-step agentic threats. ● Noma Security: Focuses heavily on the protection of AI systems, providing real-time adaptive policies and threat hunting for "multi-step agentic threats".

Runtime Cloud & Vulnerability Defenses

● Upwind: A fast-growing runtime cloud security platform that tracks workloads and network flows in real time. It utilizes precision engines to mitigate only actionable, exploitable risks rather than theoretical ones. ● Cloud Storage Security (CSS): CSS secures data where it actually lives, in your cloud storage across AWS, Azure, Google Cloud, SharePoint, and OneDrive, by watching who accesses it and when, showing you where sensitive data lives and what it contains, catching misconfigurations before they turn into breaches, and stopping ransomware, malware, and viruses in their tracks. Trusted across regulated industries and used by public sector agencies, it gives organizations the visibility and control they need to meet frameworks like PCI DSS 4.0, HIPAA, and FedRAMP. ● Astelia: An AI-native exposure management platform that filters out background noise by mapping and identifying vulnerabilities that are actively reachable and exploitable.

● CyberAGI: Automates defensive threat modeling and pen testing workflows through its AI-native platform, Excalibur.

AI Governance & Data Security

● Pillar Security: Focuses on the full lifecycle of enterprise AI tools, offering end-to-end AI Security Posture Management (AI-SPM) from initial code development to live production. ● Ciphero: Specializes in human-to-AI and agent-to-agent interactions, providing a dedicated verification layer that governs and monitors enterprise AI workflows.

● WitnessAI: Provides unified enterprise visibility, letting organizations set custom guardrails and policy enforcement for internal generative AI use.

Summary: The Cybersecurity Investment Approach

We believe three things matter for an investment portfolio built around this thesis:

1. The taxonomy itself is a moat signal. When a risk category has a standards body actively revising its vocabulary in real time, that is itself a signal. Of note, OWASP's LLM Top 10 has already been substantially reworked twice since 2023. At GSP, we view that as a clear sign the underlying threat surface continues to significantly expand and is not maturing into commoditization. We believe that vendors who can keep pace with the standard, or better yet help define it, will hold pricing power longer.

2. Visibility precedes control. Leading responses such as Prisma AIRS's discovery layer and Falcon Shield's agent mapping start with the same unsolved problem: most corporate and government enterprises don't know what AI is already running inside their walls. That creates a durable, recurring-revenue wedge for cybersecurity solution vendors versus a one-time point project to protect against a specific threat.

3. Data quality is becoming a security dependency, not just an AI dependency. Agentic systems require deep, reliable context to act correctly, so poisoned or low-quality telemetry directly degrades their defensive value. This means that the security vendors best positioned to win are the ones that already sit on the richest, cleanest data estate, not simply the ones with the newest model. In this area size matters.

While important, none of the above displaces the fundamentals-first discipline we believe any good investor should apply, including growth durability, margin trajectory, and competitive moat. Rather, it is complementary and means that “AI security” is no longer a single line item to implement once and move on from. It's a taxonomy that will keep expanding, a standards process that's still being written, and, for vendors that can operationalize both, a genuinely structural growth driver rather than a cyclical one.

Appendix: Market Size Reference Sources

Appendix: Cybersecurity Taxonomy, Technology & Vendor Reference Sources

Disclaimer: This material is for informational and educational purposes only and does not constitute investment, tax, or legal advice, nor a recommendation or solicitation to buy or sell any security or strategy. Investing involves risk, including possible loss of principal, and past performance is not indicative of future results. Any decisions should be made in light of your individual objectives, risk tolerance, time horizon, and financial circumstances. Please consult a qualified, licensed financial professional before making any investment or financial decision.

Disclosure: Investors should carefully consider their investment objectives, time horizons, income tax brackets, risks, fees, and expenses associated with any variable product before investing. This and other information about the investment company is contained in each fund’s offering memorandum, which can be obtained by emailing info@gideonsp.com.

Please read it carefully before investing. By accepting these materials, the recipient agrees to keep the materials and their content confidential and not to use them or the content for any purpose other than to evaluate a financial transaction with Gideon Strategic Partners. LLC of the type described in the materials, except that there is no limitation on the disclosure of the tax treatment or tax structure of the products and/or transaction structures contained herein. Any unauthorized use or disclosure of these materials without Gideon Strategic Partners, LLC’s written consent is prohibited. Securities and Investment Advisory Services offered through Simplicity Investments. Securities Dealer, Member FINRA/SIPC. 475 Springfield Ave, Summit, NJ 07901 (303) 797-9080. Gideon Strategic Partners is independently owned and operated and is not affiliated with Simplicity Investments